Cloud and As-a-Service Procurement Best Practices

Happy Friday and happy St. Patrick's Day. I'm Joe Morris, and Dustin Haisler is on vacation today, but I've got an action-packed episode with you today. We're going to be talking about the Center for Digital Government's Cloud as a Service Procurement Best Practices Guide, which is brought to us by some gracious industry partners: AWS, Citrix Knowledge Services, and VMware. And we've got the 2 co-authors of the report joining me today. Doug Enpetty and Shawn McSpaden are senior fellows at the Center for Digital Government, but they've got a rich background before they were senior fellows, and I'm going to let them introduce themselves. Gentlemen?

Well, Shawn, I'll start off. So I'm a senior fellow with the Center for Digital Government. Before I became a senior fellow, I was the Chief Information Officer in the state of Oregon, retired in 2012. came to the state of Oregon as its chief procurement official. I had served in that role in Alaska before that, so 2 states primarily spending functional area and time in functional areas for procurement and information technology. So it's no surprise that, that intersection has been something I've been living at since I retired, and this cloud procurement Best practice guide is something that I've had the opportunity to work on almost since I retired till present day. I'll turn it over to you, Shawn.

Absolutely. Good to be with you all. Shawn McSpaden, Senior Fellow for the Center for Digital Government. This is my 25th year in Oregon state government, the first 15 of those years in the executive branch, and the reason I let Dugan go first is that he served as the state CIO, and I had the pleasure of serving as his deputy state Chief Information Officer for Oregon for about 5 and a half years. And then for the last nearly 10 years, I've worked for the Oregon Legislature in the Legislative Fiscal Office with primary responsibility for information technology, cybersecurity, and geographic information systems oversight. So great to be with you. This is an area that Dugan and I worked on quite a bit just before his retirement, and that I've had a chance to work with Oregon Oregon state agencies and the current state CIO on for some time, our adoption as a state in regard to cloud services. So great to be with you.

Thanks for joining us. So, Dugan, you're right that the cloud procurement has had a rich history. I want to say maybe a decade ago, we at the Center for Digital Government, with your assistance, issued the first ever release of that procurement guide. It's gone through several, several updates, but maybe you could catch our audience up about When and why that procurement guy was first introduced?

Well, I think we owe this to a couple of East Coast CIOs. Jim Sills with Delaware had adopted a cloud-first policy, and the, the chief procurement officer with New Jersey was trying to implement it and, and came up with this idea of getting together, having Center for Digital Government gather up a group of interested CIOs and state officials who had a hand in cloud adoption and industry and bring them together in a session to develop best practices for cloud procurement, because everybody was kind of struggling with it. And so So we got together at that first session in New Jersey where Steve Emanuel invited us to come, and it was a cold winter day in Trenton, New Jersey, and we walked to the building and we got together and the fireworks started immediately because if you think about this, cloud means different things to everybody. And at the time, there was one kind of a framework for adopting cloud that Jim Sills had shared for a cloud-first policy, but to all of the suppliers, and we had about 30 of them in the room, it meant something different to everyone. And so we spent the first day talking over each other, talking around each other, and talking about different things. And from that, about 6 months later, we built a solution that gave us a set of best practices. What really solved that and is current with the version we're working on today is the technology stack and showing it for the different service models: infrastructure as a service, platform as a service, and software as a service. And once we started talking about these different processes, with the responsibilities, the shared responsibilities outlined under those service models, things began to fall into place. And we created a set of terms and conditions, we created some best practices for procurement, and really a fairly comprehensive guide that state could use. And so Todd Sanders, who was in charge of this project for the Center for Digital Government, said, we're looking for an 80% solution here. If we can only come to agreement On 80% of it, that'll get us a lot further. And I think we cut the corner off of adoption probably on cloud services by a couple of years by going through and using that. Before we even got the report done, one of the members, Phil Bertolini, was using the terms and conditions for Oakland County to do their cloud contracts. And then not shortly after the publication was released, About a year or two later, Utah came along in a groundbreaking contract where they put a cooperative purchase in place for the National Association of State Procurement Officials that used those model terms and conditions, which was accepted by vendors. And instead of having a bunch of different contract terms and conditions, a bunch of different meanings, we had a clearer understanding of what cloud procurement meant. in what at least the 3 best practices, the best approaches were to get to it. So I think it was pretty successful, but nothing holds true over time. Everything changes, and certainly we've seen a lot of change since 2014. In fact, in 2016, the guide was updated to include hybrid cloud services, which was attractive. And then a significant amount of effort went into describing auditing and improving the audit practices back in 2016.

Well, you're right in terms of the fireworks, in terms of the heated discussions, but what a wonderful output. I remember that we were so proud to see the impact that it had both in 2014 and 2016. So now obviously 2023, cloud, now we've got a little bit further down the path.

So what's prompted Well, I think one of the things that's been common to the— from the very beginning is the need for security. And when we did— when we looked at it in 2014 and again in 2016, cybersecurity was at the top of mind of CIOs, in fact growing. And one of the difficulties was that we— every state was doing a little bit of something different in terms of cybersecurity. Most of it was kind of a, in some ways, a holdover from when they had their own data centers because they were looking at the kind of security they did in the data center with cloud service providers where they weren't going to get logs from cloud service providers, they weren't going to be able to go into cloud service providers' data centers, so it took a different way of thinking about things. One of the recommendations that came out of the 2014 report is the need, really the pleading need, for some kind of a national standard around security. Now in 2011, NIST had adopted 800-853 and was beginning to— FedRAMP was beginning to be developed for federal agencies, but that had a long ways to go and was just in its infancy when we did this in 2014. By the time we get to 2020, '21, '22, states have began to adopt the NIST Cybersecurity Framework, And if anything, by 2022, NIST 853 was becoming kind of the de facto standard. So while we didn't have a standard for cybersecurity, we were getting close to it with those controls. So states began in 2022, 2023 to look at RAMP programs, Risk Authorization and Management programs. Arizona did one voluntarily. Texas came along with a statute change requiring them to do a risk authorization management program. Some states were using FedRAMP as a method to get authorized contractors to be ensured that they had the appropriate NIST 800-53 controls in place. And so then the next thing that came along was State-RAMP began to develop as a nonprofit organization trying to provide that sort of service to state agencies. So smart states were looking at using some kind of a risk authorization and management program in a way to make sure that the contractors that they were awarding to had those capabilities, met those controls, and those are in place throughout the life of the contract. So that big change driven by states adopting or Many, at least the tipping point was staged for 853 and the NIST Cybersecurity Framework opened up a pathway into these risk authorization and management programs. And those 2 issues really kind of drove what we did in the 2023 rewrite.

These guides, the 2014, 2016, this version, I mean, they have a massive impact in the market. they're comprehensive. So we're talking about 150 pages or so of content. So when Dugan joked that he's worked on it the entire time he's been here, that very well may be true. But we're not going to be able to cover all of it today in this session. Can one of you give us a kind of a thumbnail sketch for what's covered in the new sections of the guide?

Sure, Joe. You know, as Dugan indicated, a lot has changed in the last 8 years or so, certainly the last Since the 2016 guide was published, but we took, we took a more targeted approach. One, we had the great benefit of working with 3 cities: the City of Detroit, New York City, City of New Orleans; one county organization, Sacramento County; and then 6 states: Texas, Arizona, Massachusetts, North Carolina, Georgia, and Michigan. So a lot of smart people, great diversity in representation from the legal, procurement, IT, and cyber areas within those respective state and local government organizations. We took a targeted approach on 4 primary sections of the guide: the data section, the security section, the audit section, and then the data breach notification section. And then, of course, we created a few additional appendices to provide some tech checklists and some more comprehensive information around aligning procurement approaches with risk authorization and management programs, and then a comprehensive RAMP or risk and authorization management program checklist. So we'd be glad to dive into, you know, just a few points in each section whenever you'd like me to, Joel.

Yeah, go for it.

Okay, great. So, you know, in the data section, you know, obviously Dugan and I are here today, but this was really a team effort for the Center for Digital Government. We had the benefit of 2 additional senior fellows working with us, Otto Dahl and Bob Woolley, who are longtime senior fellows with the Center for Digital Government. Otto took the lead on the data section, and primarily the updates that folks will see in that section are around the data ownership, data protection, data privacy. Data location and access, and finally the data movement sections. That last section really deals with a client's ability to import and export data at their data in whole or in part at their discretion, not on the vendor's timeframe, but on either a predetermined timeframe negotiated in the service level agreement or, you know, on a permissive basis, however that's negotiated. With the vendor. Moving to the security section, I had the lead on that, and really we took a light touch in this area. Not a whole lot of change was required, but we primarily focused on the topic of security logs and reports. People don't think about that vital information very often unless they're deep in the weeds, and certainly they, they think about them a lot if there's an information security incident. or if there's a need for legal hold or some kind of forensic investigation. And so in this area, we focused on ensuring the public jurisdictions' real-time access to the logs and also that public jurisdictions and their cloud service providers pay attention to the need for retention, preservation, and archival of these security logs over time in case they're needed for these kinds of endeavors. In the audit section, again, I took the lead on that, and I would say In terms of the sections, this is one of the areas where we spent most of our time with our stakeholders and also with our vendor partners that you mentioned at the outset. In 2014 and 2016, the type of audit that was predominant in the marketplace was called the SOC 2 Type 2 audit. And certainly, as Dugan mentioned, with the advent of and broader adoption of the NIST Cybersecurity Framework and the NIST 800-53 security controls, more and more audits are today geared toward assuring compliance with the NIST Special Publication 800-53 controls in regard to data systems and solutions that are classified in the low, medium, and high categories. And so one, we had this generic update. We also described the further adoption by the federal government of FedRAMP, the use of and acceptance of FedRAMP certifications, but also the use of State-RAMP by some state and local government organizations in this area. We described that, provided some definitions, some background on each of those programs. And then we talked a bit about the pros and cons of each audit type. In particular, those FedRAMP and StateRAMP-based audits that involve initial assessments, what— and then continuous monitoring by FedRAMP or StateRAMP authorized third-party audit organizations. And so a lot has changed in this area, and we really wanted to spend most of our time updating that section. Certainly it was the one that took the longest to finalize, so we had a lot of spirited conversations with our stakeholders about, you know, just what was the right touch in this area. Lastly, in terms of the sections, I mentioned breach notification. And in 2014 and 2016, the state and local government marketplace, in particular the states and the territories, weren't completely uniform in terms of having a breach notification law or processes and procedures around breach notification. That's changed today. You know, all 50 states, the District of Columbia, Guam, Puerto Rico, and the Virgin Islands all have security breach notification laws that require businesses and government organizations alike to notify consumers and constituents if their personal information is breached. And so the content now includes that information as well as a checklist to provide some additional guidance for state and local governments across the country, you know, they can use in case of an incident so that they know stepwise, generally speaking, what they should do. And certainly the guide points them back to their own law. And, you know, that will be the guiding principle. So those are the primary sections that we dealt with. And then, of course, I touched on briefly those appendices.

I love it. And I appreciate the deep dive on the new Auditing adjustments there. I think that the guide's been such a phenomenal asset to the community, right? Because it's about stealing the good ideas and ripping out what you can and dropping it into your procurements and hopefully, like, you can— I think you said accelerating market movement. But now, as I understand it, there's also now a second appendix, number 8, and that in particular has to deal with aligning procurement with risk authorization and management. How does that differ from the existing appendix that's there around procurement approaches?

Well, the existing appendix had kind of a compilation of best practices about negotiations and vendor communication, improved vendor communication, and those largely still hold. But this— what's new about this section is really it provides a steps, 11 steps that a state can take to align their procurement process with RAMP. You know what's different about cloud adoption in the RAMP program is that the contracting and procurement process is integrally adopted, integrally intertwined with the cybersecurity policies. So the first step is really looking at your procurement policies and making sure with a kind of a cross-functional team, all the policyholders that are involved in this getting together and looking at that and saying, how do we align this to make sure that we get this level of security? So we talk about that. We talk about the importance again of getting all the key stakeholders to define cloud in the same way and see it in the same light. And that's something that— a theme that we continue to reinforce with this, including what needs to be done here. This is not just a solution that gets implemented in the procurement office alone, just like it's not a solution that gets implemented in the information office or the CISO's office. It really takes close coordination because each has a role to play. One of the key things is how you adopt the cybersecurity controls. And what we found is even though some states have in theory adopted some level of NIST 800-53, they're not all adopting it the same way or the same thing. And so we still have to some degree a lot of variance, and states I think are doing themselves a disservice by that because if they were to land on a full implementation of 853 Rev 5 controls, the latest version. They could probably get that as pretty low-hanging fruit if they all did it together. So that's kind of one of the takeaways from my look at this report. But anyway, we wanted to make it clear that the procurement office had to work with the CISO's office to make sure that the controls that each of these cloud contracts were clearly stated in the RFP and built into the contract. And then we wanted to use and leverage this idea of the auditing and the authorization that happens with a risk program in the due diligence assessment and the actual award assessment. So we talk about how procurement offices can leverage that RAMP authorization to make sure that the contractor is doing what they said they were going to do because the controls have been audited by a third party. And then also leverage that ramp authorization with the continuous monitoring that comes with it. One criticism of technology contracts in general has been, how did you make sure you got what you paid for? Was the performance what we expected? Sean's shaking his head because he goes through this on a regular basis in his role with legislative budget, but this is a great opportunity for states to use this audit and this continuous monitoring to make sure that the contractor is doing what they said they were going to do throughout the life of the contract. So we talk about 11 different steps that you can take to align your program. We talk about the transition from RAMP, which is particularly critical. How do you tell the contractors how you're making that transition and what's your stage of that transition? We deal with shadow IT systems and we've got an 11— we've got a checklist for things to include in the procurement. This section includes model clauses that will be helpful and a bunch of comparison charts and matrices that you can look at to get a better understanding and look at your options and choices. when you're deciding whether you're going to stand up a RAMP program or you're going to adopt a RAMP program as a service.

So that— you caught my interest on the, on the RAMP checklist. Obviously, you know, these kind of model policies, checklists have proven helpful to the states and localities. Maybe you could share a little bit more with our audience on what's included on the checklist.

Well, we have 2 checklists. One of them we have in the in the addendum for the appendix for procurement, and that's a solicitation checklist. But probably the more important one is the one that Shawn worked on, which is the overall RAMP checklist. So I'll turn it over to Shawn on that one.

Thanks, Dugan. You know, Joe, you mentioned at the outset the overall page count of this guide. It's about 150 pages. Of course, as Co-authors or co-updaters, you know, our senior fellows would love for state and local governments to read every page, right? But at the same time, we know that that isn't always going to be the case, and so some of these appendices are meant to be, you know, kind of a read-only document. There may be certain sections that are of particular interest to state and local government organizations, and—

Sure.

There is some planned redundancy of, in each— in some of these sections, in particular the 2 appendices we've talked about. But for the RAMP checklist itself, really we took kind of a general best practice approach. You know, any key information technology initiative or procurement initiative, you've really got to handle a couple of key foundational things first. One, you've got to involve the right key stakeholders. from your government organization. You really need to spend time establishing a governance body and oversight processes. In this case, granted, our recommendation is that state and local government organizations across the country don't reinvent the wheel. Follow NIST, the NIST Cybersecurity Framework, and in particular adopt the NIST Special Publication 853, Rev 5 controls, our vendor partners also felt that was so important to arrive at a state sometime in the near future where they don't have 50 state, you know, unique approaches to compliance with security controls or potentially hundreds or thousands of local governments taking the same kind of approach, one-off control sets that they have to comply with. And so really that uniformity is important. So adopting those security controls. Dugan talked a bit about the inventory process. You really do need to inventory, review, and update your existing policies, your contract templates, your terms and conditions. And we've provided some suggestions in some of the other appendices around terms and conditions for cloud service procurement. Somewhere in the middle of this checklist, state and local government organizations are going to have to make a key decision. Are they going to go the route of what we termed a do-it-yourself ramp program, à la the discretionary approach that Arizona took initially, or by statute, the TexRAMP approach? We really don't believe, and certainly getting feedback from those 2 key organizations, they don't believe that that's a sustainable approach for most organizations across the country. They're recommending the second piece, certainly for state and local governments, that they consider adoption of State-RAMP. And certainly as a component of that, because State-RAMP is based on some of the FedRAMP principles, at minimum incorporating the key, you know, initial audits and continuous monitoring approach that both the FedRAMP and State-RAMP programs include, really vital for that. Moving forward, it's critical to conduct a data discovery and classification process because, you know, all of these risk-based approaches, they're determined by the classification of your data, your systems, and the solutions that you're going to use. And so this is, you know, of all of them, I think, Our stakeholders felt that this was something that their state and local government colleagues across the country really need to spend time on and do a professional job at. Moving forward, 3 or 4 more checklist items, just determining the security impact and the required security category of those solutions, determining baseline security controls for the cloud service procurement, As I mentioned in the audit section earlier, but also in my comments in this section, really critical for state and local government organizations to identify a continuous monitoring and reporting approach, regime, set of requirements that their cloud service provider is going to be required to go through. Of course, you got to align all this to the procurement piece. Dugan just talked about that. That Appendix 8 and the checklists that are within that particular portion of the document. And then finally, you've got to communicate both internally and externally to make sure everybody knows this new risk authorization and management program that you're putting in place, that they know the requirements, that they know the expectations, and ultimately, you know, can be a partner in working with the state and local government. jurisdiction to make this kind of program a success.

You know, the 2 of you led the facilitation of this workgroup, and Sean, you outlined kind of the government members that were in the room. You had other senior fellows like yourself. You had our industry partners in the room, and the insights that happen during these workgroups are phenomenal. I'd be remiss if I didn't ask you, What did you learn along the way?

Dugan, why don't you go first?

Well, Sean just talked about one of the things that I think I learned along the way is just when we started this, we wanted to provide some alternatives and a lot of tools for states and local governments to use if they chose to do an impact ramp program. First thing, after we had Arizona and Texas kind of tell us their lessons learned, was that this is a massive, massive lift, and why would anybody want to take this on on their own? That's number one. Number 2, huge, huge benefits by having a risk authorization and management program, and by simply locking into the 853 Rev 5 controls, all of them, without changing them, and doing a RAMP program, being consistent in that, can give you incredible amount of security coverage and make you more efficient and reduce your costs of operation. It's just a huge opportunity for a small jurisdiction as well as a large jurisdiction.

And I guess in closing, because I know we're about out of time, I would say, you know, even though we were able to make substantive updates and learned a lot along the way, I got some great expertise from our from our colleagues in those cities, states, and counties, and from our vendor partners. There's much more to do in the future, and I believe the Center for Digital Government is looking at this issue of supply chain risk management, certainly additional guidance around service level agreement, you know, templates, and then this whole topic of X as a service. you know, really beyond infrastructure as a service, platform as a service, and software as a service, we've got a whole bunch of other security operations center as a service, disaster recovery as a service, network management as a service, you name it, that are kind of ripe for exploration in the future. So, you know, I think more to come from the Center for Digital Government, but, you know, You know, we're excited to have been involved in this effort and look forward to the work ahead.

Real quick before I let you guys go, there's a couple more questions. You know, we got the whole GovTech audience here with us today. How should state and local employees like that are going to be involved in the cloud contracting approach use this guide to extract the maximum value?

Dugan?

I think they— well, I think the procurement oriented people in the procurement office start with Appendix 8, and they, they use that as a checklist and a roadmap to look at what's ahead. I also think they need to make darn sure that they establish policies and are clear in their communication to the suppliers about what's included in this ramp assessment program and what's not included and what the timelines are. But I think that can be very beneficial if they look at that.

Yeah, and I guess the only kind of 2 comments I'd make is that, you know, when I first had the opportunity to get involved in this, I read the 2016 document and it was pretty darn good. I mean, I thought it was, you know, needed some update in a few areas, but most of the content was really relevant, and this most recent update and this refresh really is some excellent information for state and local governments to consider. So unless you really believe and have the due diligence behind you to say, you know, your jurisdiction is mature in this area, you've got it, got everything you need, I'd really encourage people to take a look at this guide. Don't reinvent the wheel. Really think carefully about risk and authorization management programs, trying to do it yourself, they're just so resource intensive and complex. The sustainability of them is really in question if you don't rely on, you know, programs that already exist that other jurisdictions across the country are beginning to use on a more rapid basis.

So we had industry, wonderful industry partners in the room sharing their insight, their legal expertise as well. What should other industry players do with the guide?

Well, I think number one, they ought to begin to work with their sales teams to explore, one, if they aren't already, FedRAMP certification or authorization with their federal clients, but also begin to take a real hard look at StateRAMP, which is designed for state and local government organizations. You know, there are some artifacts and Some facets of the FedRAMP program that just aren't, aren't really readily accessible to state and local governments. So there are some key differences. So educate their sales staff, number one. Number two, as they work with, you know, their state and local government clients across the country, encourage this adoption of NIST Special Publication 853 security controls. You know, they can help, you know, you know, state and local government organizations increase that adoption curve just as much as our state and local government counterparts, you know, talking amongst themselves can do. So, I mean, I think it's going to take a push and a pull from the vendor community and from state and local government folks alike to make progress in this area, become a more uniform marketplace so we can have consistent cost-effective and competitive cloud service offerings that all of us can take advantage of.

Yeah, I think one thing that we should be clear that this is not exactly a— this is not a parallel path, that a supplier who already has FedRAMP certification for an application, a platform product, there's a fast-track process for them to leverage that through State-RAMP. And State-RAMP Likewise can lead into a FedRAMP certification. StateRAMP is a little different in that it has the entry levels a little bit lower in some respects, but it still, still gets you to the same place, and it has some pretty thoughtful gradual programs like Snapshot where they'll do an assessment and work with you to help you get your controls up to where they ultimately want to be.

All right, the easiest question you guys are getting all day. Where does our audience go to get the guide?

Right there, right there at the bottom of the screen.

So you can go, you can go right to govtech.com. You can follow the direct link. If you don't, beyond that, you can go to papers.govtech.com. Doug and Sean, hey, thank you so much for facilitating this group and creating this work product. I mean, our senior fellows, the industry partners, and our government partners, it's going to make a massive impact. And, and thank you for coming on here today. And unpacking the guide with us.

Thanks for having us, Joe.

Thanks for having us, Joe. Really appreciate it.

Happy St. Patrick's Day and have a wonderful weekend. All right.