Question Period Note: Cloud Services in the Government of Canada

To support the Government of Canada (GC) access to cloud services, Shared Services Canada (SSC) has established Framework Agreements with eight (8) leading Cloud Service Providers. On December 6, 2022, Deloitte released a publication titled ʺCapitalizing on government’s cloud momentumʺ, indicating that systemic issues preventing the movement to cloud by the Government of Canada continue to exist.

• Cloud application development and hosting offer opportunities to improve essential digital service to Canadians
  • The Government of Canada Cloud Adoption Strategy encourages departments to use cloud services provided by third parties, to manage and process data and applications, when it makes sense to do so
  • The government benefits from the flexibility provided by use of the cloud. Services can grow and shrink with demand and the government pays only for what it needs when it needs it
  • While reliance on cloud services is increasing, most of the government’s IT operations continue, and will continue, to rely on data centres and networks operated by government employees
  • Secure access to cloud services is only one of many services provided by Shared Services Canada to its partners and clients
  • As such, Shared Services Canada is investing to grow the capacity of its personnel to support partners and clients and allow them to operate securely both in data centres and the cloud
  • Use of cloud services through Shared Services Canada grew from $1.4 million in the fiscal year 2019-20 to $103.8 million in the fiscal year 2021-22

If pressed on Deloitte Report:

• Shared Services Canada is working to achieve a secure digital government that delivers high-value, essential digital services to Canadians and digital tools to employees, through an enterprise approach

If pressed on procurement of cloud services:

• Cloud adoption is a shared responsibility across the government. Shared Services Canada enables cloud adoption and provides critical building blocks, such as access to cloud services, secure connectivity and active monitoring, guidance and expertise
• Through a competitive process, Shared Services Canada established a procurement vehicle to provide departments with access to world-class, secure cloud services from prequalified vendors who meet security requirements
• Departments can select the cloud services that best meet their business and technical requirements

If pressed on cloud security:

• The protection and privacy of the Government of Canada data stored and processed in the cloud is a top priority for Shared Services Canada
• Measures are in place to enforce where data resides and how it is controlled
• Processes are in place to ensure that specific security requirements and standards are met when awarding cloud contracts
• To securely consume cloud services, each department must implement and maintain specific security guardrails
• Shared Services Canada actively monitors adherence to security requirements

If pressed on Cloud First/Cloud Smart:

• In the last few years, federal departments and agencies have made great progress in leveraging the Cloud
• The recent publication of a Cloud adoption strategy aims to encourage using the Cloud, based on SMART principles
• The strategy aims to accelerate modernization of government applications in an agile, secure and cost-effective way

To enable Government of Canada cloud adoption and support progress towards a digital government, Shared Services Canada ensures that a variety of cloud services are available to meet the unique business needs of each department. Shared Services Canada also acts as a centre of excellence for cloud services across the Government, providing technical expertise and tools to guide customers and simplify cloud adoption.

Shared Services Canada’s optional Cloud Brokering Service provides customers with self-serve access to commercial cloud services. Shared Services Canada acts as a bridge between customers and Cloud Service Providers offering Software-as-a-Service (SaaS), Platform-as-a-Service level (PaaS), and Infrastructure-as-a-Service (IaaS) public cloud services.

To support Government of Canada access to cloud supply, Shared Services Canada established Framework Agreements with eight leading Cloud Service Providers:

• Amazon Web Services, Inc.
• Google Cloud Canada Corporation
• IBM Canada Limited
• IPSS Inc., ServiceNow Inc. in Joint Venture
• Microsoft Corporation
• Oracle Canada ULC
• com Canada Corporation
• ThinkOn Inc.

The Framework Agreements provide departments with standardized terms and conditions, and cloud services that have been assessed by the Canadian Centre for Cyber Security and the Contract Security Program. The Government has processes in place to ensure specified security requirements are met when awarding cloud contracts.

Since the establishment of the Framework Agreements, overall consumption has been growing. The total consumption for the year 2019-20 was $1,395,709 and grew to $103,807,761 by fiscal year 2021-22. Consumption through the Framework Agreements is shared across the eight Cloud Service Providers, in alignment with the needs of Government of Canada departments.

All pre-qualified suppliers and available cloud services are accessible in one place: the Government of Canada Cloud Services Portal.

Other levels of government can, and do, make use of these Framework Agreements. A few examples are:

• The Ontario Ministry of Health and Long-Term Care
• The Halton Region
• The Government of British Columbia
• A Board of Education of School District in Vancouver

Government of Canada departments and agencies that use cloud services remain accountable for the confidentiality, integrity, and availability of IT services and related information that a Cloud Service Provider hosts.

In 2019, SSC, the Treasury Board Secretariat’s Office of the Chief Information Officer and the Canadian Centre for Cyber Security co-developed a Secure Cloud Operationalization Framework for enabling secure access to public Protected B Cloud services. This included a minimum set of 12 mandatory guardrails, which departments are obligated to implement. Shared Services Canada has the validation function, including reporting and notification of customer compliance to the guardrails, while the Treasury Board Secretariat’s Office of the Chief Information Officer has the compliance function, such as remediation oversight and enforcement.

Deloitte Report

On December 6, Deloitte released a publication titled ʺCapitalizing on government’s cloud momentumʺ and a media release.

The report’s main narrative is based on the pandemic’s effect on government, and how cloud enabled large-scale transformation. Despite the GC’s success with cloud, Deloitte’s research indicates that systemic issues continue to exist. Additionally, perceptions of Canada being behind in terms of cloud adoption remains of concern.

The report recommends that the Government of Canada take ʺbold enterprise leadershipʺ to maintain the momentum of cloud adoption, focusing on innovation, value for money, resilience, and reducing technical debt. Looking to the future, the report notes that environment, social, and governance considerations are emerging as major drivers for cloud adoption and lists several examples on how cloud service providers are doing this today.

N/A