Good procurement of cloud computing services requires well-defined and measurable outcomes, risks identified and managed, and terms and conditions of contract properly tailored to the council’s short and long-term needs.
This means having a clear understanding of what type of service the council wants, the degree of flexibility required, cost expectations, an exit plan, and a procurement plan with legal input. The procurement must be underpinned by a robust business case and IT specification developed to greatest possible level of detail the council can manage, ideally with pre-procurement technical, cost and legal advice from specialist ICT and procurement advisers.
Areas needing some thought are:
- What guarantees of service availability, confidentiality and data integrity will the cloud service provider give, and how to verify their effectiveness?
- Is a modular solution needed, with the ability to stop, start and flex different elements independently?
- Will the network used be a private cloud, a community cloud, the public cloud or a hybrid service?
- What information needs to be provided to end users by the council and how will the council will obtain this?
- How will unauthorised processing in the cloud will be prevented?
Preliminary market consultations to assist designing a cloud solution are permitted by the EU procurement rules, provided that competition is not distorted. At the point of invitation to tender, the rules also require the council to be as clear as possible about its requirements. Adjustment of these once the tender process has started is constrained. Where the requirements are not fully ascertained, the council should obtain advice on the most appropriate procurement procedure and what negotiation or other flexibility this allows – the 2015 Regulations introduced a new ‘innovation partnership’ procedure. Could this be useful?
The procurement rules also set out the principles for future contract changes, and when these will trigger a new procurement process. Given that IT requirements can change rapidly, provision for future change in a cloud services contract will be essential.
Any procurement process must address data protection needs as a core consideration, both in terms of present legislation, and the forthcoming new data protection regulation expected to be issued by the European Commission in early 2016, effective by 2018. The supplier's data security measures should be vetted. Check there is clarity around who is the data controller (there may be more than one). Establish the location of processing (which may not be the same location as storage) – will this be in the UK or overseas? Where deletion of personal data is required, check whether the cloud service provider’s timescale for deletion meets the council’s own time-limited statutory obligations for deletion.
While cloud computing services involve the usual outsourcing risks and other risks specific to cloud computing, these should not be regarded as a barrier to choosing a cloud solution. A council should, however, take professional advice on how best to procure the solution.
Julian Turner is a senior associate at law firm at Geldards LLP.
