Case Study

Government Cloud Design

A health software provider was implementing a health platform in the Cloud for multiple UK NHS government agencies. The implementation was taking considerable time, including insufficient documentation describing the overall solution and Cloud systems operations. This resulted in UK NHS government audits that relayed a series of findings that required resolving and responding to.

Opportunity

There was an opportunity to demonstrate to the UK NHS agencies that the software provider was proactive in resolving the audit findings, while increasing their Cloud understanding and maturity. This required introducing disciplines and structures to Cloud adoption and systems operations, while mapping out the regulatory, legal, security and commercial requirements that determined the standards and controls for using the Cloud. The focus being on certifying the Cloud tenancies with the agencies.

Hypotheses

Is it possible to design a set of isolated Cloud tenancies for government health agencies that can be certified for operating production workloads?
Is it possible to continuously audit operations across, and within, Cloud tenancies to track drift from the certified state?

The solution

Understand the current state by running a series of discovery sessions. Redesign the Cloud landing zone and tenancies, including selecting the CSA Security controls framework and embedding controls into the designs. Documentation was created that described Cloud systems operations and the landing zone designs, including inclusion of regulations, legal, security and commercial requirements to respond to each NHS audit finding. This included guiding the third party on implementing the solution to ensure it matched the designs and bringing in a profession Cloud partner that could assist the software provider.

Major Pain Points

No direction being provided to a third party supplier on the Cloud landing zone build.
No clear documentation, nor designs, on the Cloud implementation and systems operations.
Lack of considerations for regulatory, legal, security and commercial terms.
No clear view on systems integrations, traffic flows and how data is being secured.
No documentation existed to construct responses to the government audits.

Outcome

This resulted in new Cloud landing zone designs and detailed guidance that comprised isolated tenancies for each NHS agency, which were being built for certification. The solution included the ability to audit config drift in near-real time based on an AWS continuous compliance auditing solution. The documentation created in response to the NHS audits were accepted and the health software provider engaged a profession Cloud partner that could assist with completing the Cloud build and support Cloud systems operations - the right way.

Technological Change Consultancy

CONSULTING FROM REAL EXPERIENCES

Case Study

Government Cloud Design

Opportunity