Scotland's Digital Future: Report on the current landscape for Data Hosting and Data Centres in the Scottish Public Sector

Annex D - sectoral survey results

Central Government

Facilities

• 74.2% of Central Government organisations have a primary data centre in their own premises
• 63% of organisations use a secondary site, 23% of which own their own, others use another or outsource their requirement
• 17% of organisations use a third site 50% of which are on their own premises

Tier rating	Primary DC %	Secondary DC %	Third DC %
unknown	16	25	50
One	12	0	0
two	36	50	0
three	32	25	50
four	4*	0	0

* Highlands & Islands Airports Limited

• 44% use a managed service for certain services.
• 80% of those are 24/7 and are necessary because:.
• email filtering and archiving is carried out around the clock
• overseas support to Scottish Enterprise & increasing 24/7 use on citizen facing web-based systems
• commercial systems require 24/7 uptime
• it was included as part of contract
• only for critical applications that need this support type

Primary site

• 25.8% co-locate with other organisations or outsource altogether
• 32% measure their energy consumption but 0 (ZERO) % measure its PUE rating

Secondary site

• 37% use the private sector in either a cloud service, hosted service or managed service
• 18% co-locate a secondary site with another public sector organisation
• 13.6% that have a second site measure their energy consumption and none measure a PUE rating

Third site

• 33% of them are on their own premises
• 16.5% that have a third site measure their energy consumption but none of them measure its PUE rating

additional sites

• One organisation advised they had an additional site.

Costs/Efficiency (energy)

• No one who responded to the survey in central government is monitoring a PUE rating, this is currently the most commonly accepted method of measuring a data centres efficiency.
• The vast majority of organisations do not know how much their current service costs.
• The more facilities organisations own the less they manage them efficiently.
• Energy consumption in any form is not monitored by 66% of organisations

Future plans

• 38% are planning to invest in their existing data centre in the next 2 years
• 3% are planning to build a new data centre in the next 5 years
• 3% are planning to build a new centre in the future
• 50% are planning to use some form of cloud services in the next 5 years
• 17.6% are planning to use a fully outsourced managed solution in the next 2 years
• 41.2% are planning on investing in Disaster Recovery in the next 4 years

Comments

• we have already virtualised our servers, and consolidated our storage to enable mobility of our services and facilitate DR across our two main sites using internal cloud. We are actively considering hosting options and taking up some services on external cloud, but currently bandwidth and costs mean this is not feasible. We expect SWAN to increase options available
• the datacentre is in the first year of its 5 year life cycle. Currently there are no plans to replace the datacentre until the end of the life cycle. The datacentre is split across two buildings located with 300m of each other for DR purposes.
• when our building leases expire, we are looking to move our DR site into an existing public sector data centre

Sharing data centres

Views on sharing

• nearly 72% of organisations would share hosting facilities but 44% felt there was a risk of conflict of interest i.e. The host organisation would make decisions on the facility based on their own interests
• Only 21% would consider co-locating if the facility was over 1 hour away
• 94% felt sharing would offer value for money
• 87.5% felt that they would achieve energy savings
• 40% felt the risk to sharing hosting in their organisation was cultural
• 40% felt security of their data was at risk if sharing

Cloud

• 90% are considering moving some services into the cloud
• 45% would want to know more information on the cloud and how secure it is
• 100% said security and control of data would be a concern in moving to the cloud
• Over 90% said ease of transition was a concern

The types of services they would consider using is

Service	%
business applications: ( CRM, email, etc.)	68
ICT management: (backups, disaster recovery etc.)	54
Infrastructure on-demand: (storage, network, server etc.)	41
collaboration applications	60
core business applications	18
legacy applications	9
research & development	18

Those not considering moving to the cloud advised the following factors as issues

• uncertainty of data privacy
• existing infrastructure
• ability to meet SLAs
• ease of transition
• security and control of data

additional general comments

• we would need to access how communication links would affect the sharing of data centres. Most of our remote sites are on islands with poor connection speeds
• as a relatively small user of IT we have a very simple solution at the moment. very willing to consider shared services with others
• the survey questions don't really allow us to accurately reflect the current position. We are considering cloud and shared services but this is done in the context of selecting the correct approach for each specific requirement rather than a one size fits all approach

Local Government

Facilities

• 94% of Local Government organisations who responded have a primary data centre in their own premises
• 75% of organisations use a secondary site, 25% of which own their own, others use another or outsource their requirement
• 8% of organisations use a third site none of which are on their own premises

Tier rating	Primary DC %	Secondary DC %	Third DC %
unknown	6.5	0	0
One	6.5	0	0
two	67	67	0
three	20	33	0
four	0	0	0

• 37.5% use a managed service for certain services
• 85% of those are 24/7 which is necessary because:
• the service we outsource is firewall management. As our web services can be accessed 24/7 we need our firewalls to be available 24/7
• the external hosting arrangement is for the Council's website and therefore requires to be 24/7
• for access in the event of an out of hours incident
• a number of our systems operate 24/7 e.g. website, email, social care, and a number of systems run batch type jobs overnight. System maintenance & changes are done out of service hours

Primary site

• 6% outsource everything
• 62.5% measure their energy consumption but only 20% measure its PUE rating, this rates between 2 & 2.61
• Secondary site
• 16% co-locate with another public sector organisation.
• 33% that have a second site measure their energy consumption and 50% of them measure a PUE rating ranging from 1.6 - 1.63
• Third site
• 6% have a third site, 100% are on a commercial site and is a tier 4 rating.

additional sites

There were no additional sites

Costs/Efficiency (energy)

• 62.5% of organisations measure their primary sites energy costs with 33% measuring their secondary site
• 20% of local government monitor a PUE rating in the main site, this is currently the most commonly accepted method of measuring a data centres efficiency
• The ratings are between 2 & 2.61 see appendix 3 for PUE description
• The more facilities organisations own the less they manage them efficiently
• Energy consumption is not monitored by 37.5% of organisations

Future plans

• 62.5% are planning to invest in their existing data centre in the next 2 years
• None are planning to build a new data centre in the next 5 years.
• 94% are planning to use some form of cloud services in the next 5 years
• 6% are planning to use a fully outsourced managed solution in the next 2 years.
• 87% are planning on investing in Disaster Recovery in the next 4 years

Comments

• the Council will be considering disaster recovery but not in the sense of a physical site - so either by considering a shared service or a commercial provider
• offer spare capacity to other public sector providers
• server virtualisation underway. Commas switch rationalisation underway Currently in discussion with 2 neighbouring Councils regarding shared ICT service
• have agreed to reciprocal DR data centre agreement with East Dunbartonshire Council
• on asset renewal or new service/project hosting/cloud and managed services are considered under option appraisal

Sharing data centres

Views on sharing

• 100% would consider hosting another public sector organisations data centre.
• Nearly 94% of organisations would share hosting facilities but over 50% felt there was a conflict of interest in being hosted. i.e. The host organisation would make decisions on the facility based on their own interests
• Only 21% would consider sharing if the facility was over 1 hour away.
• 94% felt sharing would offer value for money.
• 87.5% felt that they would achieve energy savings.
• 37% felt security of their data was at risk if sharing.
• 25% had concerns that sharing would cost them more money.
• 31% felt the risk to sharing hosting in their organisation was cultural.

Comments received

• the risks depend on how the facility is managed
• cost/access/security/performance would be concerns

Cloud

• 87.5% are considering moving some services into the cloud
• 33% of those not considering the cloud felt more information on the cloud and how secure it is would be helpful
• 100% of those not considering the cloud felt they needed more information on security and control of data as it would be a concern in moving to the cloud
• Over 90% of those not considering the cloud felt they needed more information on the ease of transition to it

The types of services they would consider using is:

Service	%
business applications: ( CRM, email, etc.)	64
ICT management: (backups, disaster recovery etc.)	50
Infrastructure on-demand: (storage, network, server etc.)	57
collaboration applications	71
core business applications	36
legacy applications	14
research & development	43

Those not considering moving to the cloud advised the following factors as issues:

• uncertainty of data privacy
• existing infrastructure
• ability to meet SLAs
• ease of transition
• security and control of data

Comments

• already use a number of cloud based applications such as procurement, registration, web hosting etc. Have an open mind to cloud based services and look at each case on its merits
• we already use cloud for some business applications. Considered when procuring new or replacement solutions

Overall additional comments

• consideration should be given to localised DR/ backup facilities shared between local public bodies e.g. Health Board and Local Authority to provide quick business continuity implementation.
• procurement arrangements to support the use of public sector data centres need to be in place.

Scottish Police Authority

Due to the timing and circumstances of their new status as a single force the evidence gathered was captured through a discussion with the Scottish Police Authority's ( SPA) ICT Operations Manager. SPA is now the body representing the Police sector for their ICT operations in Scotland.

The Scottish Police Authority ( SPA) now represents the 8 previous constabularies and 3 other agencies including Scottish Crime and Drug Enforcement Agency ( SCDEA) & the Scottish Police College. Their services span in excess of 22 data hosting locations across Scotland supporting around 25000 staff and over 15000 end point devices. The SPA has a good number of shared national applications used by most/all of the previous organisation structure however there is also a substantial number of local and regional services still used.

SPA is currently undertaking their own strategy to establish a rationalised, leaner hosting infrastructure. This will support the cost effective delivery of services and allow for a reduction in capital spend required to maintain and develop services. By further reducing the legacy facilities that exist, SPA will look to reduce the amount of hosting facilities into 2 or 3 data centres as well as consolidating a number of commodity services.

Summary Points:

• Police use a managed service in Pulsant (in what was previously called ScoLocate) which is in excess of a Tier 3 rating
• all original Police bodies provide hosting from a local primary facility, generally confirming to Tier 2
• all original Police bodies in addition provide hosting from a number of smaller locations, generally confirming to Tier 2
• at present power consumption within Police facilities is not fully evaluated
• 24/7 availability and associated support of hosting locations is a requirement for the majority of Police services but restricted to a core set of business applications
• SPA are keen to take forward a strategy that will allow them to:
• Establish a hosting consolidation plan
• Establish DR hosting
• SPA would be happy to consider the sharing of hosting facilities or using those of an appropriate service provider as long as appropriate risk controls are in place
• SPA is fully supportive of cloud, both public and private. In general public cloud is not considered suitable at present for business critical services and systems containing sensitive information

Scottish Fire and Rescue Service

Due to the timing and circumstances of their new status as a single force the evidence gathered was captured through a discussion with the Scottish Fire and Rescue Service's ( SFRS) ICT Operations Manager. SFRS is now the body that represents all the Fire services in Scotland.

SFRS represents the 8 legacy fire services and the Scottish Fire College. Their services span in excess of 20 data hosting locations across Scotland supporting around 9500 staff and over 4000 end point devices. The SFRS has a good number of shared national applications used by most/all of the previous organisation structure however there is also a substantial number of local and regional services still used.

SFRS are currently undertaking their own strategy to establish a rationalised, leaner hosting infrastructure. This will support the cost effective delivery of services and allow for a reduction in capital spend required to maintain and develop services. By further reducing the legacy facilities that exist, SFRS will look to reduce the amount of hosting facilities into 2 or 3 data centres as well as consolidating a number of commodity services.

Summary Points:

• all original Fire bodies provide hosting from a local primary facility, generally conforming to Tier 2
• all original Fire bodies in addition provide hosting from a number of smaller locations, generally conforming to Tier 2
• at present power consumption within Fire facilities is not fully evaluated
• 24/7 availability and associated support of hosting locations is a requirement for the majority of Fire services but restricted to a core set of business applications
• SFRS are keen to take forward a strategy that will allow them to:
• Establish a hosting consolidation plan
• Establish DR hosting
• SFRS would be happy to consider the sharing of hosting facilities or using those of an appropriate service provider as long as appropriate risk controls are in place
• SFRS is fully supportive of cloud, both public and private. In general public cloud is not considered suitable at present for business critical services and systems containing sensitive information

Health

NHS Scotland comprises of 22 Health Boards consisting of 14 territorial and 8 Special Health Boards including NHS24 and Scottish Ambulance Service. This spans in excess of 3200 locations across Scotland with around 160,000 staff and over 100,000 end point devices. NHS Scotland has a good number of shared national applications used by most/all Health Boards. This is supplemented by a substantial number of local and regional applications accessed by Boards or collaborative groups where a common business need exists.

NHSScotland are currently undertaking their own strategy to establish a rationalised, leaner hosting infrastructure. This will support the cost effective delivery of services and allow for a reduction in capital spend required to maintain and develop facilities. By further reducing the legacy facilities that exist, NHS SCOTLAND will look to reduce demand by adopting commodity solutions hosted in the private and public cloud to meet the shifting demands of the service.

Summary Points:

• National hosting for NHS Scotland is contracted to Atos, served by their Livingston and Edinburgh facilities which are in excess of Tier 3
• Atos provide a managed service
• all 22 Health Boards provide hosting from a local primary facility (generally confirming to Tier 2 with a lesser number being Tier 1)
• all 22 Health Boards provide hosting from a number of smaller locations, generally confirming to Tier 1 or potentially Tier 2 in a small number of instances for larger Health Boards
• at present power consumption within Health Boards facilities is not evaluated
• available hosting capacity is not currently measured across NHS Scotland as a whole
• 24/7 availability and associated support of hosting locations is a requirement for the majority of Health Boards but restricted to a core set of business applications.
• NHS Scotland are keen to take forward a strategy that will allow them to:
  • Establish hosting consolidation plan
  • Establish a hosting catalogue
  • Establish DR hosting for all Boards
• NHS Scotland would be happy to consider the sharing of hosting facilities or using those of an appropriate service provider
• NHS Scotland is fully supportive of cloud, both public and private. In general public cloud is not considered suitable at present for business critical services and systems containing sensitive information

Education

Facilities

• 83% of universities have a primary data centre in their own premises
• 75% have a second site, 90% of which are on their own premises
• 33% have a second site, 100% of which are on their own premises

Tier rating	Primary DC %	Secondary DC %	Third DC %
unknown	11	14.5	25
One	11	28.5	50
two	44	28.5	0
three	33	28.5	25
four	0	0	0

• 16.7% use a managed service for certain services. 50% of those are 24/7

Comments

• virtual learning environment provides learning materials to students around the world 24/7 as part of a shared service in another public sector organisation.

Primary site

• 17% co-host with other another organisation
• 58% measure their energy consumption but only 25% measure its PUE rating ranging from 1.35 - 1.86

Secondary site

• 10% self-manage co-located in private sector tier 3
• 22% that have a second site measure their energy consumption but only 50% of them measure its PUE rating which is 1.92

Third site

• 25% that have a third site measure their energy consumption but none of them measure its PUE rating

additional sites

No organisations advised they had any further sites

Costs/Efficiency (energy)

• 58%% of organisations measure their primary sites energy costs with 22% measuring their secondary site
• 25% of Universities monitor a PUE rating in the main site, this is currently the most commonly accepted method of measuring a data centres efficiency
• The ratings are between 1.35 & 1.86
• The more facilities organisations own the less they manage them efficiently
• Energy consumption is not monitored by 42% of organisations

Future plans

• 72.7% are planning to invest in their existing data centre in the next 2 years
• 17.7% are planning to build a new data centre in the next 4 years
• 71.8% are planning to use some form of cloud services in the next 5 years
• 18.2% are planning to use a fully outsourced managed solution in the next 2 years
• 45.5% are planning on investing in Disaster Recovery in the next 4 years

Sharing data centres

Views on sharing

• 63.6% would consider hosting another public sector organisations data centre
• Nearly 91% of organisations would share hosting facilities but over 54% felt there was a conflict of interest in being hosted. i.e. The host organisation would make decisions on the facility based on their own interests
• Only 27.3% would consider sharing if the facility was over 1 hour away
• 81.8% felt sharing would offer value for money
• 81.8% felt that they would achieve energy savings
• 45.5% felt security of their data was at risk if sharing
• 45.5% had concerns that sharing would cost them more money
• 36.4% felt the risk to sharing hosting in their organisation was cultural

Comments received

• the risks are all very much dependant on the organisations set-up, capabilities and the agreed SLA

Cloud

• 90.9% are considering moving some services into the cloud.
• 100% of those not considering the cloud felt they needed more information on security and control of data as it would be a concern in moving to the cloud.
• 100% of those not considering the cloud felt they needed more information on the ease of transition to it.

The types of services they would consider using is:

Service	%
business applications: ( CRM, email, etc.)	73
ICT management: (backups, disaster recovery etc.)	55
Infrastructure on-demand: (storage, network, server etc.)	64
collaboration applications	64
core business applications	36
legacy applications	18
research & development	36

Those not considering moving to the cloud advised the following factors as issues:

• uncertainty of data privacy
• existing infrastructure
• ability to meet SLAs
• ease of transition
• security and control of data