Cloud Architecture · DevSecOps · Agentic AI

Building a Government Hybrid Cloud Platform

RMS invests heavily in technology on a yearly basis to continue to deliver quality services to both internal and external consumers, with over 200 applications currently in production service. As part of the NSW Transport cluster, RMS participated in the NSW Data Centre Reform Strategy which mandated consolidation of all NSW Government agency data centres. As a result of this reform RMS was left at a greater risk with end-of-life infrastructure accruing technical debt in the tens of millions (over 5 years).

To overcome the increased risk, RMS launched the Business Applications Hosting Strategy (BAHS) program to resolve RMS’ critical ageing technology-derived business operations risks by investing in the development and implementation of a Hybrid Cloud Platform to host applications, delivering a refreshed strategic hosting architecture, and permitting business consumption of modern strategic platforms which align to NSW Government Information and Communications Technology (ICT) and Data Centre Reform Strategies.

Hybrid Strategy

The Business Application Hosting Strategy (BAHS) program is designed to invest in the adoption of Public Cloud services, the Hybrid Cloud Platform will help RMS achieve this objective. The Hybrid Cloud solution is intended to implement cloud management through public cloud (AWS and Azure) as well as the strategic on-premise data centre, GovDC. The Hybrid Cloud solution will provide uniformity in governance, management platform integration and access control, whereby previous fragmented aggregators can be avoided. A major aspect of Hybrid Cloud will be to provide multi-cloud enablement for preventing vendor lock in and exploring other cloud partners. Hybrid Cloud has been implemented as the solution to help RMS meet the following vision and requirements:

• Comply with the mandate for all agencies to migrate from legacy data centres to Government DCs.
• Deliver savings from reduced operational costs.
• Provision up-to-date technology environment, which can support RMS into the future and provide a foundation for improvements in innovation.
• Enable RMS IT Transformation Program previously endorsed by the Finance & Investment Committee.
• In accordance with ‘Cloud First’ policy, migrate all hosted applications in Fujitsu (FAL) datacentres to cloud.
• Provide an up-to-date technology environment, which can support RMS into the future and lay a foundation for improvements in innovation.

Application Migration Strategy

If you've ever read the AWS Cloud Adoption Framework (CAF) you would know that it defines a set of perspectives which focuses on specific areas the adopting organisation can incorporate into their migration strategies to accelerate a successful cloud adoption.

With a new Hybrid Cloud platform implemented which incorporates CI/CD tooling, operations management and governance, access provisioning and the ever important sercuritisation of a foundation platfrom, the applications migrations can now progress to target state hosting environment adopting modern practices for cloud based applications.

Automation and Straight Through Access Management

One area which I'm passionate about is automation and making the use of cloud platforms for consumers as easy as possible coupled with the expected speed of access one would expect from a cloud service. In government and enterprise organisations alike, there is always far more complexity involved than which is first envisaged, though nothing is insurmountable with good design and leveraging the services the cloud providers have available.

T-Shape People

One of the big enablers of success with any technology program is that you have technologists who can perform any number of tasks and aren't fenced into being just a Project Manager, Business Analyst, Developer or Tooling Specialist, you want people who can do whatever it takes to get the job done even if its not in their job or role description.

How many times have you found you have a gap with an outcome because you don't have the right role on the team, have you ever asked this type of question of the team though? "We need to develop some Lambda functions and have no developer resources, has anyone coded in Python or Node.js before as we have to get this job done and can't afford the time to recruit?". Then all of sudden Billy the project manager says "yep, I know Python as I run my dads serverless environment for his architecture business.". These types of T-Share people are rare but when you find one, hold onto them as it shows:

• A) They're multiskilled and not affraid to utilise under used skills when needed.
• B) They're committed to achieving the outcomes of the business even if its not their core skill set.
• C) They aren't all consumed by what their job description says and won't ever say "not my job". they don't see barriers to delivering outcomes.
• D) They're reliable by nature.

There are so many organisations out in the cloud space today so their experience will have to be proven in order to ensure you get the right capabilities you’re likely paying top dollar to retain.

Get in contact to talk more about how you want to develop your Public Cloud adoption.

Building an Enterprise Public Cloud Platform

In a large enterprise environment which has numerous business units building and deploying against the latest technologies, this creates a number of opportunities to enable a platform capability which all can leverage and consume as an internal service offering.

One of the strategic principles when delivering a Public Cloud platform is being able to cater to the seemingly endless number of use cases which exist out in the business, yet enable a level of standardisation which can maintain environmental control and a known risk posture of your public cloud platform.

Strategy and Design

In structuring the program delivery and adoption of a Public Cloud platform, like any project or program you need an agreed strategy with defined design principles on how the platform will be designed, how consumers will consume services and how the platform service owner will manage the overall service offering to keep consumers safe from themselves, safe from others and others safe from them. Some of the important design questions which need to be asked are:

• What services do you want to expose to consumers for their use? Too few and you’re limiting the consumers use, too many and you may never get the job done.
• How will you maintain Security Management of those services? With public cloud use comes a greater responsibility for ensuring security across the platform is maintained 24 x 7.
• When consumers utilise services, how will you manage Identities in the cloud and will you leverage existing enterprise Identity Management services already deployed? If using separated identity stores, as a basic example how will users manage passwords, if using existing identity stores how do you managed access, do you deploy a Role Based Access Management capability (highly recommended).
• What is the level of risk which is acceptable to the organisation and how will you measure Design Effectiveness and Operational Effectiveness to rate the risk posture?
• How will platform management be maintained, will the cloud platform cater to long lived instances or will all consumption be via immutable codified CI/CD pipelines?
• Who and how will the platform be operated from a day to day operational run perspective.
• What are the regulatory, audit and compliance obligations that need to be built into the platform for regular reporting?
• How will you monitor and control the platform health, visually or manually for example. Will you implemented just detective controls or expand out and implement corrective controls too.
• How will consumers order a public cloud service and what will provisioning look like.

Delivering Public Cloud Capabilities

The usual project management fundamentals will be no different for overall completion though over the past few years there has been move to a hybrid style of delivery. Where traditional waterfall model still exists to get strategy and design artefacts completed, then software defined capabilities that underpin the public cloud platform services operate in a Scrum based delivery framework.

Taking the public cloud strategy and breaking it out into specific logical design components then enables the scrum teams to pick up designs and break them down further into logical backlog items for the scrum team to size and develop through sprints.

Incorporate Technical Risk

Risk Management has become one area which is always getting a lot of focus, though when it’s about putting High Inherit Risk workloads into the public cloud the demands from internal risk and external regulators become much greater. Technical risk management needs to be incorporated into the overall structure of the public cloud delivery model where designs are assessed for risk and subsequent determination of mitigations and resulting residual risk needs to be finalised.

Once the risks mitigations are determined those then need to be delivered against, either through manual processes or best via code and automation. Along with other key risk controls, the risk team then does an operational effectiveness assessment of the key controls and mitigations implemented and determines the residual risk rating. If the level of risk has been concluded as acceptable by executive sponsor it’s then baselined and can be used as future reference point against any variance identified.

Get the Right People

People are the core to success with any project and you need ensure they’re the right mix of technical capability, self-driven and fit for the team and corporate culture. Deciding who will deliver the capabilities that aren’t available in-house is a necessity.

There are so many organisations out in the cloud space today so their experience will have to be proven in order to ensure you get the right capabilities you’re likely paying top dollar to retain.

Get in contact to talk more about how you want to develop your Public Cloud transformation.

Enterprise Private Cloud Request for Proposal

In enterprise environments the selection process for procurement of new services is heavily governed to ensure that it’s been a fair and equitable process to get to the desired outcome. When starting on the journey to selection of a new enterprise product which more than likely comes at a lofty price there are a few items that need to be covered off at the initiation of the works.

Governance Ground Rules

As the desire to procure new services gathers momentum within the business and the decision has been made to go to market to select a new service, several items need to be established at the earliest opportunity to ensure that governance ground rules have been covered off:

• Engagement with the commercial team has been established and a commercial lead has been determined.
• Rules of engagement have been defined and agreed, such as communications channels, who is the primary contact, what are acceptable methods of contact and no single person meetings for example.
• Who will the assessment team be, what is the mix in relation to technical review against business review as well as coverage from different business units and key stakeholders.
• What are the responsibilities of the assessment team, who has responsibility for what components of the assessment.
• What’s the assessment criteria from a technical and business perspective such as technical capability and marrying business outcome requirements, or financial impact and achievability to expected outcome such as ROI.
• How will communications and correspondence be recorded and who has access to the information.
• What’s the timeframe for the tender process, when are submissions due, what’s the period of feedback, when are demos to be conducted, how are presentations to be undertaken and who will the audience be.

These are just a few of the ground rules that need to be determined, see the Resources section to review a checklist for RFP engagements as a customer.

Execution of the RFP Process

The team is established and the process to start the selection delivery has begun, the key documents required to be created need to be pulled together to guide the suppliers and invitees to the tender process, these will include but not be limited to:

• Business Objectives, Context and Requirements with the requirements preferably structured into a MoSCoW so that responders can easily associate their product to how they meet the requirement.
• Structure on how the responders are to reply to the tender, this needs to go to the detail of what format, the maximum length and complexity necessary.
• Any data metrics which will aid the responder to providing an accurate response such as expected transaction times, recovery and high availability expectations and support levels.

The Selection Methodology

There needs to be an agree balance of paper-based reviews with proof of concepts, responder presentations and use case demonstrations to ensure an qualitative review is being undertaken, everything that’s being assessed in the selection criteria needs to be measurable. Responders will provide their paper-based submissions as well as time frames for the other assessment items.

Get in contact to talk more about managing your Request for Proposal works.

Demand for Delivering Qantas Cloud Platform

Qantas was extending its IT hosted infrastructure capability to include hosting business applications in the Public Cloud for appropriate workloads.

Qantas had an immediate requirement to reduce the cost of all aspects of their IT services with the business strategy requiring an ability to stand-up environments quickly to develop, test ideas and deploy. Cloud IaaS offers advantages in terms of speed to market for new capability, configuration, utilisation flexibility and cost to develop/operate.

• Speed to Market – Agility to reduce project overhead and time to initiate
• Development and Operate Cost with rapid ability to turn off the cost when services not needed
• Flexibility and Capacity which enables low risk innovation, stop or increase resources on demand

Integrated Service Offering

The establishment of a Cloud Service Integrator capability was required to enable the ability to develop, migrate and operate Qantas business applications and enterprise systems on commercially available Public Cloud IaaS platforms, this was chosen to be Amazon Web Services.

The capability enabled Public Cloud IaaS as a hosting option for appropriate workloads as well as the Service Integration capability necessary to operate it. Specifically, these business requirements pertain to

• A service management layer, to be delivered by a Cloud Service Integrator (CSI) which overlays the Public Cloud standard “base” services to directly support the Qantas Application
• Managed Service (AMS).
• A range of tooling to support automation and provide or enable integration to a single source of truth for
• Configuration and Service management
• Security posture and compliance
• System and Application event management
• Operational run-cost and forecast
• A range of architecture patterns to support Qantas business applications of all criticalities and supporting all data sensitivities.
• Simple Dev/Test
• Dev/Ops and Continuous Integration
• N-Tier
• High Availability
• Disaster Resilience / Multi Region (or Multi Cloud)

Public Cloud Supplier Review

The Public Cloud IaaS supplier landscape was evolving rapidly. Gartner had most recently evaluated this landscape as at May 2014. Two clear leaders had emerged, being AWS and Microsoft Azure.

Figure 2: Gartner Magic Quadrant, May 2014

During Discovery, Amazon Web Services (AWS) was identified as the clear market leader in Australia and globally and has been down-selected for initial innovation and design activities.

This does not preclude the evaluation and selection of other cloud partners (Microsoft Azure or IBM SoftLayer) in the medium to long term.

Key assumptions were that a Multi-Cloud landscape (i.e. More than one Public Cloud Provider) was likely to be necessary to manage risk and that strategic investments (e.g. Cloud Management Platforms) may be necessary to achieve this outcome in the mid to longer term.

Therefore requirements, whilst being positioned to apply directly to the AWS Public Cloud in the first instance, were essentially Cloud vendor neutral as far as practical.

Cloud as an Internal Managed Service

With much of Qantas’ technology needs being outsourced there was a desire to build an internal service capability known as the Cloud Integration Service (CSI) which would support consumers with their cloud adoption, while also aligning to the existing ITIL framework within the Qantas Technology Group.

Get in contact to talk more about how you want to develop your Public Cloud transformation.

Transitioning Application Support Maintenance Agreement for 400+ Applications

Business Objectives

As a direct response to one of the most challenging operating periods in its history, Qantas embarked on a major business transformation program, focused on strengthening its core business and driving earnings recovery.

Focus areas for this transformation include reduction in Qantas’ operating costs by $2 billion by FY17, strengthening the customer proposition while maintaining yield position, and reducing technology operating risk to acceptable levels.

In support of this business transformation, Qantas IT has set out to transform the way in which it provides technology services to the broader Qantas business. This has resulted in development of the following major transformation goals:

• Simplifying the overall IT technology landscape, reducing IT run costs and directing resources towards innovation.
• Implementing a new IT Operating Model to align IT delivery more closely to Business Outcomes for details of the Business Outcomes).
• Balancing the dual IT delivery requirements of agility and innovation, against industrialisation for different areas of Qantas.
• Requiring both internal staff and suppliers to take greater responsibility for Business Outcomes through greater accountability.
• Ensuring greater contestability and flexibility across Qantas’ supplier base with a view to driving better technology innovation.

The objectives of the Program were to transition into Qantas the new Application Maintenance Services (AMS) contract which was awarded to TCS. Qantas signed a new Master Service Agreement (AMS) with TCS, with TCS taking accountability as the Application Integrator for the management and maintenance of all applications, databases and middleware environments to meet defined Business Outcome based service levels.

Defining Deliverables

With large programs that have an aggressive timeframe to complete, its important to get the deliverables defined so that the structure of the program can be established, for this program the deliverables were defined as such.

Structure the Program into Project Workstreams

Base on the deliverables the program structure can take form so that each project can operate independently yet roll up into the overall objectives of the program and business outcomes. The ideal situation is that those workstreams that delivery the greatest benefits as soon as possible are structured for success, though based on benefits realisation and business priority this isn’t always the case so in that case let the Program Steering Committee make the decisions on prioritisations.

Get in contact to talk more about how to deliver successful Transition and Transformation programs.

Project Director

The objective of the Transformation Program was to extend the existing contractual arrangement with an existing client to one of a ‘preferred vendor’ for the delivery of a new Omni channel acquiring payment solution.

To achieve speed to market and lower up-front costs, Verifone delivered the new card present POS terminal solution and eCommerce card not present acceptance solutions from payment solutions connected to or hosted directly on the Verfione Gateway solution.

The Transformation Program delivered a new Payment as a Service (PaaS) capability to one of the big four banks with Union Pay International and Dynamic Currency Conversion functional capabilities through the new to market Vx690 Terminal and real-time online merchant portal. The high level goals are stated in the below table.

Critical Success Factors

The project had the following critical success factors which were required to ensure the success of the program:

• Payment as a Service solution is operational in production environment by base lined milestone date.
• There are 25,000 UnionPay International capable Vx690 terminals operational within the acquiring business by baseline milestone date.
• There are 150,000 Vx690 terminals operational within the business by baseline milestone date.
• Profit margin associated with the delivery of PaaS meets or exceeds forecast revenue.

As this is an external customer delivery program, customer satisfaction was at the top or near the top as a success criteria.

Resource Management

Resource management will be defined in the resource management plan as required to deliver the program.

The following points dictated the resource engagement for the program.

• Internal Verifone resources required will be engaged through their respective management lines via the accountable project manager.
• External resource will be engaged via the necessary project manager stream lead. If additional costs are to be incurred outside of existing agreements then, scope of work and quotes will be agreed and signed off by the steering group.

Get in contact to talk more about managing delivery of a new payments platform.

The Problem Space

In past years a number of audit issues and risks had been raised in the Platform and Operational Access Management (POAM) space. Remediation of the root causes of these issues had proven difficult due to the large number of servers, accounts, data quality, business stakeholder buy-in and fragmented processes supporting the POAM space.

The POAM problem space also extends across all service providers, all of whom follow different processes for privileged access. To remediate the issues in the POAM space, tactical and strategic recommendations were defined in late 2012.

The tactical recommendations are aimed at containing the existing risk by addressing existing process and audit issues with minimal investment. The strategic recommendations are anchored in the IDAM strategy and the target state developed by the CTO team and required investment in technology and process and transition being a multi-year journey.

Go to Market, Request for Proposal

As a direct result of the recommendations the decision was made to go to market to select a tool which was suitable to manage privileged access across the banks technology environment and meet the business objectives

Supplier Selection Process

The project team evaluated the 4 short listed vendors using the following methods:

• Development of technical concept paper to align to technical security strategy (TSSA)
• Compiling requirements for tool capabilities
• Request for Information (RFI) including written response to requirements
• Presales vendor product demonstration (business and technical) focusing on SoD and Privileged and Identity Access Management scenarios.
• Paper based technical evaluation completed
• Site reference calls

After applying the agreed evaluation criteria and weightings and the above inputs, recommendations of the evaluated products were presented.

Get in contact to talk more about managing delivery of a privileged access management.

Transition and Transformation Background

The Department of Human Services is the second largest Commonwealth Government agency in Australia.

At the start of July 2011 Centrelink and Medicare Australia were reconstituted into a single department, the Department of Human Services and merged the ICT infrastructure of five previously separate Commonwealth agencies:

• Centrelink
• Medicare
• Child Support Program
• Commonwealth Rehabilitation Service
• Department of Veteran’s Affairs

The Department is the key delivery mechanism of social services and Medicare payments to Australian citizens.

Today DHS touches 99% of Australian citizens. It acts as the Commonwealth government lead agency in times of major incidents and natural disasters. As Australia’s population grows so will DHS, representing a long term strategic opportunity to Telstra.

Corporate Strategy

The Services Telstra was awarded to deliver comprised of the following Service towers:

• Managed Telephony Services
• Telephony Carriage Services
• Managed Contact Centre Services
• Managed Video Conferencing Services
• Cross functional services across the above towers
• Managed Mobiles – includes mobile voice, carriage, wireless broadband and support services
• Managed Data Services – including secure managed WAN services and support services along with managed external data services (internet access).

Telstra delivered DHS with a single sourced converged and unified voice, mobiles, data and contact centre network to replace disparate multi sourced networks that will allow DHS to service their customer base efficiently utilising proven technology and to improve productivity on an ongoing basis.

Telstra scoped and delivered a clear transition & transformation strategy that aligned with the DHS Service Delivery Reform and demonstrated how Telstra will work with the Agencies to transition competitive services under Telstra management and transform DHS to the identified end state and RFT objectives, as follows:

• Aligned to DHS “One network” strategy whic was to consolidate disparate networks/platforms to provide one cohesive service delivery agency seamlessly
• Illustrate how Telstra will assist DHS to realise its Shared Service platform objective
• Provide DHS with early quick wins, financial and productivity returns gained sooner to meet key Commonwealth government deliverables (political drivers)
• Meet the business drivers of each agency within the one solution
• Consistent SLAs and service across all channels of business
• This delivery represents a critical strategic account in the Federal Government, providing Telstra with a platform that can be leveraged to secure additional Commonwealth and State government business.

Key to differentiation was how Telstra articulated the unique value they brought to the table through use of strategic partnerships.

Organisational Change Management

With large transitional programs the need to have a solid change management approach is critical. This will ensure the management of each distinct user or stakeholder group through the change journey is established to build their commitment and capability to change.

Use of ADKAR is a well known method for implementing the management of change through the phases of the program, with the intent to plan, manage and reinforce change with stakeholders.

• Prepare for change by determining how much and what change is needed. The outcomes from these assessments are then used to “guide” the Business Case deliverables around Impact Assessment, Change Effectiveness and sustainability of outcomes Stakeholder Assessment, Communications, Training and any other considerations.
• The Business Impact Assessment will be used as the single source of truth in building change plans for the program.
• The Assessment should be structured from the Technical Impact Assessment (TIA)
• The TIA should exist for all items covered and should be signed off during the planning phase of the program. The TIA should be managed by a risk representative to assist in ensuring risk process is being followed
• The business outcome owner is responsible for ensuring the transitioned functions operate correctly on the new environment and must provide test cases for the testing of applications.
• Together with the Stakeholder Matrix, the Business Impact Assessment will be used to draw up a communication plan, covering all transitions

Get in contact to talk more about managing large transition and transformation programs.

Western Sydney Data Centre Engagement

Telstra was engaged in July 2010 to develop a discovery and scoping exercise to provide cost estimates and systems and services documentation related to migrating East Chatswood Data Centre (ECCC) to a new data centre located in Western Sydney (WSDC). This work was scoped in July 2010 to provide architectural consultancy and project management to identify all voice and data communications services in ECCC as well as prepare a high level strategy for building he core network and moving the services to the New Data Center (NDC).

The migration strategy was published in which was released in December 2010, this strategy document outlined the following major components.

• A high level description of the core and distribution network within the new data centre and how this will integrate into the Westpac Internal Network.
• A high level description of the new WAN Access networks for both internal and external connectivity.
• A high level description of the infrastructure needed to enable the migration of Telstra CMT managed networks from ECCC to NDC.
• A description of the relocation strategy for each identified Telstra CMT managed network that will be moving from ECCC to NDC.

Program Objectives

The following outlines the program objectives:

“Migration of the East Chatswood Data Centre (ECCC) to Westpac’s new data centre located at Western Sydney (WSDC) in a like for like approach. This migration will cover Fibre and Copper Carrier Access solution from feasibility phase through implementation and migration of Telstra managed services from ECCC to WSDC as per the Strategy Document.”

Delivery Phases

The following approach will be used across all of the projects within the program, the phases are in line with Telstra project management methodologies. Although the logical order is top to bottom, some phases can overlap depending on the stage of the individual work breakdown structure.

Risks Management

Determine the Risk Exposure threshold against program risks can be undertaken using the following risk exposure threshold.

The risk exposure “heat map” is divided into 4 zones that categorises risk exposures as Critical (red), High (amber), Medium (yellow) and Low (green). These zones guide the setting of the risk exposure threshold and the level or priority assigned to mitigation.

The vertical axis represents the 5 levels of consequence that correspond with the criteria detailed in the consequence matrix, while the horizontal axis shows the likelihood scales.

The program sponsor has the discretion to use its own risk exposure threshold if it believes that individual program circumstances justify more aggressive or conservative tolerance to risk.

The Blue Line indicates the risk exposure threshold for the program. Please change this to your desired threshold or delete the diagram and replace it with a textual description of the risk exposure threshold.

Get in contact to talk more about managing large Data Centre Consolidation programs.