Denise McDonagh, director of the government's G-Cloud programme, talks to Computer Weekly about the implementation challenges of the programme and the routes being taken to break government's dependence on large outsourcers.
To describe the aims of the CloudStore as revolutionary is no understatement - if successful it could fundamentally change government's reliance on system integrators by making public sector IT a commodity. Cabinet Office minister Francis Maude has committed government to pushing 50% of its new IT spend through the CloudStore by 2015.
"[Departments] looking at their IT strategy should look toward the cloud frameworks at the end of contracts, rather than doing big outsourcing," says McDonagh, the Home Office IT director who took over running the G-Cloud programme in April.
"Why would you do big outsourcing in the future – that way lies madness as it takes us back to technology and commercial lock-in."
G-hosting
To provide a route for departments with large, complex application environments that don't fit into the CloudStore model, government recently put out a £1bn G-hosting agreement. "We have some big legacy systems that by their nature don't lend themselves to commodity services," she says.
The hope is that between the CloudStore and G-hosting projects, government departments won't need to look toward conventional outsourcing.
"We should look to the cloud first for hosting but if we can't for some reason then [G-hosting would be appropriate] for 'heavy lifting' systems with legacy constraints."
This could also apply to areas which require high security, or if the data is sensitive and has to be housed in a specific location. NHS data for example, cannot be housed outside of its home country.
"Of course there are some things we would never put in the cloud just now. Things like national security probably wouldn't even go in a private cloud until we have matured significantly," says McDonagh.
"The two do complement each other. The challenge now is to make G-hosting compatible with the philosophy of the G-Cloud – which is very much all about pay as you go, flexibility and scale up and down."
The G-hosting framework will be for an initial term of two years with possible extension allowing for contracts up to five years in duration. The second version of the G-Cloud framework will be for one year, with a two-year extension in special circumstances - although McDonagh says much shorter durations are encouraged.
Security issues
Certain services offered through the CloudStore require accreditation to ensure they meet the security standards set down by government for data deemed as sensitive - known as impact levels.
There are currently 46 suppliers going through pan-government accreditation conducted by CESG, the government's IT security arm, to obtain accreditation for services at impact levels one to three.
"We've not had anyone through security pan-government accreditation. But we do have a number of suppliers who are more or less there," she says.
"We do recognise this is a challenge, and are looking for a more innovative approach. We are continually improving the process – better guidance for suppliers, improved industry awareness and lessons learnt from services that are going through the process."
The new revised impact levels on the Government Protective Marking System (GPMS), which determines the level of sensitivity of information, are in the process of being reclassified to a three-tier category from a current scale of one to six.
The hope is this will lead to more proportionate IT requirements for information which has previously been categorised at higher levels than necessary, and consequently broaden the range of systems running cloud services.
McDonagh says tier 1, for example, could be applied to the use of commodity desktops and allow the use of applications from Microsoft Azure and Google. "I'm happy if it gives us that kind of framework," she says.
"The GPMS is a good piece of work and a lot of people are looking at it in a way that would be helpful to them. It will hugely help how we simplify and categorise data - and challenge ourselves not to put everything upward. "
Engaging buyers
More than £1.15m has been spent through the CloudStore to date. McDonagh would like this amount to be much higher, but believes it's not a bad start considering the CloudStore has only been live since February.
"Anecdotally I'm hearing back from people who say they've saved 95% of what they would have paid if they'd gone down the normal route and others who have negotiated with incumbent suppliers using G-Cloud pricing as a benchmark and got the supplier to lower their prices."
While there's been no shortage of interest from the supply side, the big challenge ahead is to engage buyers, she says. "Definitely the most important thing now is propagation," she says. "We have a diversity of suppliers. But the big thing is to stimulate the buyer community."
The CloudStore will be available to local government, police, education and the BBC, charities, and its services will even be made available to the Bank of England.
"We need to help the buyer community gain a better understanding of what there is to buy. And in order to do that we are taking Buy Camp [events] on a tour around the UK," she says.
"We will also be setting up communities of interest – getting everyone helping and supporting each other so the G-Cloud market becomes owned and thus driven by the consumers and suppliers, enabling faster take-up than a small central team could do alone.
"This is a different way of doing business and as with any big cultural and behaviour change will take time. It's getting into the mind-set that IT is a commodity and we can increase competition and buy off lots of different people [by using cloud services]."
The future infrastructure of government will be based around the G-Cloud, PSN (Public Services Network), G-hosting, and end-user device strategy infrastructure, says McDonagh.
"We are all working closely together, even though we are at different maturity points of the programme," she says.
"It all comes back to the integration conversation. It's not about separate services and systems – but how we integrate these programmes.And it is also about having the right technical standards and capability in place to ensure from an integration perspective we can [integrate them]."
Certainly McDonagh is no less committed to the cloud than former director Chris Chant, who made a name for himself by slamming previous ways of working as unacceptable.
"People ask why have you been so quiet about the G-Cloud now Chris has left? What they don't realise is that Chris was instrumental in defining and delivering the vision and getting it off the ground," she says.
"My job is the hard grind of embedding the work that Chris started. When you're getting on with that work you tend to keep your head down and get on with delivery."
