You've Decided to Buy Cloud Services, Now What

© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.S U M M I T
Public Sector Procurement
Considerations
John Brennan
Director, Strategic Business Development
AWS Worldwide Public Sector

What we are talking about today
1. What Cloud is and how it differs
2. Roles and responsibilities
3. How to buy?
4. Some lessons learned and global
best practices

Early 2000’s Amazon.com internal and external projects delayed.
Root causes:
• not accurately forecasting the time it took to complete
projects
• too much time spent building the same old infrastructure—
storage and database solutions—over and over again.
Solution based on Amazon.com core competencies (logistics, web
presentation, ecommerce, and dependable delivery):
• “Web scale” infrastructure
• Transparent pricing
• Launch by APIs from web browser or command line (turn our
infrastructure into software code)
Resulting service—Amazon Web Services (AWS)—became
attractive for customers too.
• Commercial launch with start-ups then expands to enterprise
customers.
• Now a decade mature technology that Amazon pioneered and
commercialized.
• More than 1,000,000 customers in >190 countries run on AWS
What does being “Earth’s most customer-centric
company” have to do with cloud computing?

Cloud Computing is different
Using the Cloud often requires a fundamental shift in
thinking for technical people - procuring it does too

What is Cloud Computing?
The on-demand “self-service”
delivery of IT resources with zero up-
front costs, no long-term contracts,
and pay-as-you-go pricing

What is traditional ICT Procurement like?
The lengthy, prescriptive acquisition of
IT resources with total up-front
payment, long-term contracts, and
contract variations as requirements
inevitably change

Smooth out costly cyclical
capital outlay with
variable expense
Benefit from massive
economies of scale
Stop guessing capacity
Increase agility and bring
innovation
Stop spending money on running
/ maintaining data centers
Provision in minutes
Using the AWS Cloud means..

It is critical to get this right
If the procurement is not approached correctly, the
benefits of using the Cloud will be negated completely

What is the Cloud?
Features: Cost-plus, time and materials, firm fixed price
for initial capital outlay and technical refresh, multi-year
licensing agreements
Features: Invoice listing usage during last month, due in
30 days

Ask the Right Questions
You’ll only get what you ask for
• You are not buying physical assets; therefore, you do not need to ask for many things
you are used to asking for in a traditional data center RFP.
• Recycling data center RFP questions will inevitably lead to data center answers, and
may leave cloud vendors unable to bid.
• Make sure you ask the right question to get the best cloud solution.
• Cloud allows you to focus on application-level and performance-based requirements
– there is no need to dictate specific methods, infrastructure or hardware.

Let’s revisit that definition..
The on-demand “self-service” delivery
of IT resources with zero up-front
costs, no long-term contracts, and
pay-as-you-go pricing

+
• Cloud XaaS
• Professional Services
• Training
• Support
• Marketplace
• Requirements Analysis
• Strategy & Roadmap
• Solution Design & Architecture
• Application
Development/Support
• Tech Review & Audit
• Implementation/Migration
• Governance
• Security
• Billing & Account Management
• Program Management
• Service Desk
Cloud Service Providers
Resellers, System
Integrators, Managed
Services
Public Sector
Customers
Who is responsible for what?

Security is a Shared Responsibility
DatabaseStorageCompute Networking
Edge
Locations
Regions
Avail. Zones
AWS Global
Infrastructure
Customers are
responsible for security
‘in’ the Cloud
AWS is responsible for
security ‘of’ the Cloud
Customer Data
Platform, Applications,
Identity & Access Management
Operating System, Network &
Firewall Configuration
Client-side Data
Encryption & Data
Integrity Authentication
Server-side Encryption
(File System and/or
Data)
Network Traffic Protection
(Encryption / Integrity /
Identity)

15
Procurement Example: Encryption
• Customers/Partners should not expect a Cloud Services Provider (CSP) to do things
that aren’t within their remit under the clouds’ shared responsibility model.
• For example:
o CSPs should provide encryption capabilities.
o Partner/end customer use CSP-provided encryption capabilities in order to meet
their security and compliance requirements.
“The Contractor shall provide the following services:
Provide encryption capability for object level data store service.
Provide encryption capability for object level data store service with customer based
and managed keys.”

The delivery model is different, too
Self-service means pull instead of push. Here are some
real-world examples of what not to do in a procurement

Apportioning responsibility
“The Customer appoints the Supplier
to provide [the deliverables |
acceptance testing | change
management | return or destruction of
material | transition in / out]”

Reporting requirements
“The Supplier will send the Customer
[monthly itemized reports via e-mail
detailing all usage | a weekly report
detailing underutilized resources]
within the service.”

Access and Audit rights
“The Supplier must give the Customer
reasonable access during business
hours to the Supplier’s premises
where the Deliverables are being
performed or produced.”

Pricing
“the Supplier shall provide firm fixed
price(s)…”

Utility Pricing Model
Build an acquisition model for the on-demand, pay-as-you-go nature of
cloud computing
• Traditional IT pricing approaches can reduce or eliminate benefits of cloud.
• Accept different vendor pricing models – do not create single pricing model.
• Embrace on-demand, utility-like, OpEx model cloud pricing.
• Understand cloud provider tiered pricing, and reserved pricing (such as AWS's
reserved & spot instances), to budget for estimated usage and reduce
expenses.
Transparent, online pricing Multiple Pricing Models Pay-per-Use
Dynamic catalogs Free-tier, On-demand, Spot Market,
Volume Discounts
Variable units, e.g., per hour, per GB
per month, per event

Let’s talk vehicles and mechanics
The commercial kind..

Procurement vehicle types
1. Direct – CA, EA
2. Indirect – MSP, SI, Reseller
3. Panel arrangements

Direct – CA, EA
With Direct, your organization will
have a Customer Agreement or an
Enterprise Agreement with AWS.

Indirect – MSP, SI, and ISV. Reseller.
With Indirect, your organization will
have an agreement with a Managed
Service Provider, Systems Integrator,
or ISV. Resellers pass on terms and
conditions to you.

Panel arrangements
With a Panel arrangement, your
organization will procure AWS under
terms that have been pre-negotiated
by a lead administering organization.

Consider…
Cloud Provider Partner
What are you buying? Cloud building blocks Application, solution,
implementation
services
How are you buying? Direct / Bulk tender Indirect / Bulk Tender
Who will manage the
environment?
Mature, skilled internal
customer team
Need a partner to
manage the
environment

Our top 5 best practices..
..to make your Cloud procurement happen as smoothly
and as simply as possible

Clearly define the intended outcome
Start with a business driver and
initiative. What is the intended
outcome for the business?

Involve Governance teams ASAP
Your Security, Policy, and
Procurement, people should be
engaged early and often to
understand their mandatory
requirements.

Design your intended vehicle
Make sure you understand all aspects
of the vehicle you are using and how it
matches to the intended outcome.
1. Cloud Services
2. Migration
3. Software Marketplace
4. Training
5. Support
6. Managed Services

Focus on capabilities
Requirements should be written that
enable your organization to achieve
the intended outcome. Approaching
requirements in a prescriptive fashion
will not work.

Incentivize Early Adoption
• Participation in a “special project”
• Funded proof of concept
• Free training
• Competition or Hackathon
• Brief the senior leaders on
experience

Correctly apportion responsibility
Your Cloud provider is unlikely to
accept terms (such as liabilities and
indemnities) that should be
apportioned to more appropriate
parties in the Cloud ecosystem.

Correctly apportion responsibility

Global Benchmarks
1. UK Government: CSP and Partner framework via Digital Market (11th version)
2. Singapore: Whole of Government Agreement and Partner Framework
3. Australia: Whole of Government Agreement and Multi-Agency Commitment; Partner
Framework
4. Germany: Creating cloud model contract
5. US Army: CSP and Partner framework awarded
6. Canada: Partner Framework awarded; working on 2nd version
7. India: Partner Empanelment and Digital Market
8. Israel: Partner Framework awarded
9. Bahrain: Partner Framework and Multi-Agency Commitment
10. Japan: “Cloud by Default” policy leading to Whole of Government Agreement;
Partner Framework awarded

Review
“As Is” IT Procurement Process
• Design and technology selection (weeks)
• Prepare detailed design specifications
and requirements (weeks)
• Invitation to Tender (weeks)
• Vendor/Product Selection and Price
negotiations (weeks)
• Agreement negotiations (weeks)
• 9 months to get one virtual machine
• Set up compliance for license audits
(weeks)
• Budget for technical refresh (weeks)
• Return unused, broken, or end of life
hardware (weeks)
“To Be” Cloud Procurement Process
• Design and technology selection (weeks)
• Prepare detailed design specifications
and requirements (weeks)
• Invitation to Tender (weeks)
• Vendor/Product Selection and Price
negotiations (days)
• Agreement negotiations (days)
• 3-5 minutes months to get one virtual
machine
• Set up compliance for license audits
(weeks)
• Budget for technical refresh (weeks)
• Return unused, broken, or end of life
hardware (weeks)

Resources
AWS 10 Considerations for a Cloud Procurement
CISPE Buying Cloud Services in Public Sector Handbook
https://cispe.cloud/website_cispe/wp-
content/uploads/2019/05/Public-Policy-strategy-on-Procurement-
Handbook-Final-190528.pdf
https://d1.awsstatic.com/whitepapers/10-
considerations-for-a-cloud-procurement.pdf
https://aws.amazon.com/how-to-buy/

Where to from here?
1. Review our procurement resources
2. Send governance teams to training
1. https://www.iverson.com.my/training/
aws-business-essentials
2. https://www.iverson.com.my/training/
aws-technical-essentials
3. Experiment via a $0.00 Security and
Procurement demonstration

Questions?
Supporting your cloud procurement in the
region
Mohammed Hajar
Capture BD Manager
hajarmoh@amazon.com

• February 2011 – US CIO announces “cloud first” policy
• August 2011 – AWS launched AWS GovCloud (US)
• October 2011 – US National Institute of Standards and Technology publishes definition for cloud computing
• December 2011 – Federal Risk and Authorization Management Program (FedRAMP) policy signed
• May 2012 – First list of third party audit organizations published
• June 2012 – FedRAMP launches
• December 2012 – First authorization approved by FedRAMP
• May 2013 – US Department of Health and Human Services grants AWS GovCloud (US) FedRAMP authorization
• March 2014 – AWS commercial Regions secure DoD approval for impact level 2 workloads
• August 2014 – AWS first CSP to achieve DoD approval for impact level 4 workloads
• January 2015 – US Department of Defense creates Cloud Security Guidance on top of FedRAMP; changes requirement for
impact level 5 data center technicians to be US Citizens instead of US Persons
• November 2016 – AWS is first cloud services provider to achieve German government’s Cloud Computing Compliance
Controls Catalog (C5) attestation
• January 2017 – AWS commercial Region in London approved for UK-OFFICIAL
• September 2017 – AWS GovCloud (US) achieves authorization from DoD to support impact level 5 (national security
system) workloads
• Today AWS GovCloud (US) includes 20% commercial organizations who need to store International Trafficking in Arms
(ITAR) data
AWS GovCloud (US) in Context

AWS is positioned as the market leader in several score cards
*Gartner, Magic Quadrant for Cloud Infrastructure as a
Service, Worldwide, Leong, Lydia, Petri, Gregor, Gill, Bob,
Dorosh, Mike, August 32016
This graphic was published by Gartner, Inc. as part of a
larger research document and should be evaluated in the
context of the entire document. The Gartner document is
available upon request from AWS :
http://www.gartner.com/doc/reprints?id=1-
2G2O5FC&ct=150519&st=sb
Public Cloud Platform Service Providers' Security, Q4 2014.
The Forrester Wave™ is copyrighted by Forrester Research,
Inc. Forrester and Forrester Wave™ are trademarks of
Forrester Research, Inc. The Forrester Wave™ is a graphical
representation of Forrester's call on a market and is plotted
using a detailed spreadsheet with exposed scores,
weightings, and comments. Forrester does not endorse any
vendor, product, or service depicted in the Forrester Wave.
Information is based on best available resources. Opinions
reflect judgment at the time and are subject to change.
*Gartner, Magic Quadrant for Public Cloud Storage
Services, Worldwide, Bala, Raj, Chandrasekran, 26 July
2016
This graphic was published by Gartner, Inc. as part of a
larger research document and should be evaluated in the
context of the entire document. The Gartner document is
available upon request from AWS :
http://www.gartner.com/doc/reprints?id=1-
2IH2LGI&ct=150626&st=sb
Leader in Cloud Infrastructure Leader in Cloud Storage Leader in Cloud Security

Governments and enterprises are more secure in AWS
For more details, see Re:Invent 2013 presentations by
NASA JPL cyber security engineer Matt Derenski
( http://awsps.com/videos/SEC205E-640px.mp4 )
“Based on our experience, I believe that we can be
even more secure in the AWS cloud than in our own
datacenters.”
-Tom Soderstrom, CTO, NASA JPL
AWS is our trusted
partner that is going to
run our company for
the next 140 years.
Jim Fowler
CIO, General Electric
”
“
Migrating more than 9,000 workloads to AWS including
300 ERPs, GE plans to reduce its datacenter footprint
from 34 to 4 over the next three years.

Underlying Elements of AWS Service Delivery
AWS Region
(with 3 Availability
Zones)
AZ -1
Datacenter(s)
AZ -2
Datacenter(s)
AZ -3
Datacenter(s)
AWS Service
Teams (Dev/Ops)
Private connection
Internet
Content Delivery
Network
USG
Datacenter
Customers
and
Partners

AWS in the Public Sector
7,000+
educational
institutions
2,300+
government
agencies
22,000+
nonprofit
organizations

AWS is Architected for Government Security Requirements
Certifications and accreditations for
workloads that matter – Compliant Solutions
Example: AWS CloudTrail and AWS
Config – Call logging and
configuration management for
governance and compliance
• Log, review, alarm
on all user actions
• Browse-and-query
database of current
and previous state
of cloud resources

You've Decided to Buy Cloud Services, Now What

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a You've Decided to Buy Cloud Services, Now What

Semelhante a You've Decided to Buy Cloud Services, Now What (20)

Mais de Amazon Web Services

Mais de Amazon Web Services (20)

You've Decided to Buy Cloud Services, Now What