IT Governance Business Case for the City’s Data Center Refresh and Business Resiliency
THE IMPORTANCE OF THE DATA CENTER & BUSINESS RESILIENCY TO CITY OF DURHAM When it comes to IT infrastructure requirements, Data Centers are a top priority. Data centers are the biggest cost in government IT but given the explosive growth in data that needs to be managed and the ever-increasing demands for IT services, they are also the most important asset. Data centers are integral to an organization’s business and operational success, and not just a facility for storage of information. Any interruptions in the City’s data center operations due to aging or failing hardware and infrastructure, or environmental events can virtually bring down the organization to its knees if there isn’t an efficient business resiliency strategy. This is key to the organization's capability of providing effective COOP planning within its business units.
DATA CENTER REFRESH MAJOR OBJECTIVES: •To modernize our existing Data Center which will consist of storage, computing, memory and networking upgrades. •To ensure business continuity and resiliency by creating a Disaster Recovery Strategy. •To increase the ability to properly manage and align efficient capacity to the City’s Strategic business needs.
DATA CENTER REFRESH 5 MAJOR DOMAINS THAT REQUIRE FOCUS: 1. Increase Security Capabilities – Firewall, web content filtering, intrusion & prevention detection 2. Increase Computing Capacity – Virtualization, RAM, and through-put 3. Right-size Storage Capacity – Structured data/ unstructured data 4. Build Business Continuity – Overall planning strategy that ensures continuity of operations with minimal service outage or downtime.
5. Maintain Disaster Recovery – Capability to restore data and critical applications in the event your systems are destroyed when disaster strikes.
Background on the Existing Data Center • The City’s Physical Data Center is currently located in (101 City Hall Plaza). The backup for the data center currently exists in the Microsoft Azure cloud. • The City currently runs all of its core business systems from the on-prem data center within City Hall. (Munis, Cityworks, OnBase, GIS). • The City has a hybrid/on-prem data center that utilizes a Cloud approach to provide office productivity, communication, and collaboration tools within the enterprise such as SharePoint, Microsoft Office 365, One Drive, Email Backups and Network Drives (Unstructured Data). • The City also utilizes some Software as a Service (SaaS) applications such as NeoGov, LMS and its new EPEP system. • The Existing Data Center infrastructure including existing hardware and virtualization is currently at the end of its life.
Current Data Center Risks & Pain points • The existing Data Center infrastructure has significantly aged. It is reaching end-of-life and may not be supported soon. • Hardware is at the end of its life and needs to be replaced. • I.e. EMC Storage Area Network (SAN) is 5 Years Old. The lease on the current EMC SAN hardware is set to expire in December 2019 with an $85k buyout. • The demands on computing has decreased server performance over time due to the growth of the city's daily transactions. • Difficult to forecast future growth of storage and performance.
Current Data Center Risks & Pain points • Current Recovery Time Objective (RTO) from a disaster could be weeks to months. • There is not a separate physical location to restore the data center to in the event of a disaster within the city limits. • No existing virtual desktop interface capability, meaning employees couldn’t remote in from any device or location. • Limited capability to right size our data center based on growth capacity • Current IT Legacy infrastructure - separate storage, storage networks, and servers — at risk of failure. • The silos created by traditional data center infrastructure often present barriers to change and progress, adding complexity to every step from ordering to deployment to management. • Support is handled my multiple vendors
Future State Our Future state is to modernize and strengthen the integrity and security of the City’s Data by upgrading its physical Data Center while also planning for Business Resiliency and agile growth through a business continuity model. This new model will include: •
Increased operational effectiveness and efficiency through incremental agile growth.
•
Increased business resiliency which will maintain business operations during a disaster. (I.e. Revenue collection & payroll) The increase in cyber security threats makes this very necessary.
•
Increased ability to scale quickly based on the business units’ growing business needs.
Future State Benefits Business Resiliency - DCaaS with a 4 Hour RTO: In case of an incident, vital employees will be operable in less than 4 hours with the use of Virtual PCs - In-sync with the local Continuity of Operations (COOP) Planning Initiative - Physical failover locations in Morrisville (RTP) & Colorado
Scalability and Customization - Flexibility in capacity planning – including leaving more room for structured data - Provides management the customization and scalability it needs to right size on both storage and performance
Increased Performance - New software and hardware will provide the performance needed to manage the growth and ever-increasing demands for IT services (i.e. 10 new Business Cases this spring = 10 new IT Projects on the city’s IT Infrastructure) - Automation: Reduction of manual Keep the Lights On (KTLO) work. - Alignment with Duke Fiber Project
Future State Benefits
More Secure Data Center - Updated software and hardware will have the latest enhanced security features - Hyperconverged infrastructure provides a zero-trust approach to City’s IT architecture - Data Center Firewall to help protect the city’s data Hyper-converged Solution - HCI solution is a scale out architecture allows for incremental growth, no forklift upgrades. Flexibility to add different types of nodes if requirements of customer changes - 67% Smaller data center footprint
DESIRED BUSINESS VALUE • Increased protection and sustainability of the City of Durham’s data • Established Business Continuity with an extremely resilient IT recovery time • Modernized Hyper converged Data Center with agile scalability
THE NEED FOR A MODERNIZED DATA CENTER?
80% By 2025, 80% of enterprises will have shut down their traditional data center, versus 10% today.
~ Gartner, April 2018
Solution Options & Analysis
13
DATA CENTER REFRESH ALL OF THE COMPONENTS On Premises Upgrade
Business Continuity
Solution: Hyperconverged solution which modernizes our existing Data Center. This includes updates of compute, storage, and networking
Solution: Data Center as a service (DCaaS) with 4 hour RTO and failover in RTP & Colorado.
Funding Type: Capital Expenditure (Capex)
Funding Type: Operational Expenditure (Opex)
Description
Pros
Cons
Proceed with Hyper-Converged Data Center Refresh and BCaaS. This will combine compute, storage, and networking as well Business Resiliency
• • • • •
Increased Business Resiliency – 4 Hour RTO Scalability to fit City’s strategic plan Replace ageing hardware More Secure Data Center Keep the Lights On Automation
• •
Higher costs to refresh Data Center Will require additional training for staff
15
COST ESTIMATES
FUNDING
Year 1 Costs (Hours) 1 Time Costs plus Recurring
Description
Run Costs (Hours)/ KTLO
Departmental Funding Amount:
$85,000 (Available second year) $42,500 can be applied in the first year
Labor $ (Hours) Internal TS: Business Analysis TS Services TS Project Management: External:
528 hours
416 hours
0 hours
0 hours
528 hours
416 hours
96 hours
0 hours
$0 (0 hours)
Professional Services (Hyperconverged Data Center)
Professional Services (Data Center Firewall) Misc. Professional services
$53,944
$0 (0 hours)
$0 (0 hours)
Funding Requested (Y/N):
Project One Time Costs Project Run Cost (External)
*Total Project Funding for Year 1 *Year 2 Recurring Costs
Y
$1,953,403 $116,400 $1,953,403 less $42,500
$1,910,903
$116,400 less $85,000
$31,400
$6,250
$0 (0 hours)
$20,000
$0 (0 hours)
Non-Labor $ Data Center Hardware and Software: Includes Maintenance and Support (5 years) Buyback of EMC SAN
$1,120,574 $85,000
DCaaS (Data Center as a Service)
$116,400
Firewall Hardware and Software: Includes Maintenance and Support (5 years
$465,000
Data Center rack hardware: Includes Maintenance and Support (5 years)
$116,400
$86,235.23
*Total Project Funding Requested (External), includes External Year 1 Run Costs and Non-Labor
16
SECURITY OBJECTIVE CATEGORY
Confidentiality
POTENTIAL IMPACT LOW
Unauthorized disclosure of information = limited adverse effect on organizational operations, organizational assets, or individuals.
National Institute of Standards and Technology (NIST) Special Publication 800-60, Volume 2, Rev. 1
Integrity
Unauthorized modification or destruction of information = limited adverse effect on organizational operations, organizational assets, or individuals.
Availability
Disruption of access to or use of information or an information system = limited adverse effect on organizational operations, organizational assets, or individuals.
The following cybersecurity categorization is recommended for the General Purpose Data and Statistics Information Type for the Hub Advanced Final Security Categorization = Confidentiality: Low; Integrity: Low; Availability: Low
17
Risk: Are there proper resources for on-going administration and operation of an upgraded Data Center? Risk Management Plan: The Technology Solutions Department has qualified and experienced inhouse employees that have all taken part in Data Center refresh initiatives in the past. 1)
Utilizing qualified experience •
Kerry Goode, CIO/Director
•
DeWayne Kendall, Assistant Director
•
Andrew Hester, Infrastructure Manager
•
David Baird, Data Center Engineer
18
Summary & Recommendation
19
Options 1. Data Center Upgrade 2.
Increased Performance
Data Center – Desired Business Value Analysis Criteria Scalable and KTLO Automation Upgrade core 4 Hour RTO right sizing capabilities assets capabilities capability
Cost
$$$ $
20
Recommendation Proceed with the procurement and implementation of the City’s Data Center Refresh and Disaster Recovery Solution
21
Our Ask
We are asking for approval of this Business Case
Project Planning Implementation Overview
Risk & Risk Mitigation
Project Timeline
24
• Gain Approval from Steering Committee • Gain Approval from City Manager • Begin RFP Process for Data Center Refresh solution • Receive City Council approval contract • Procure solution • Begin implementation of Data Center Refresh and Disaster Recovery • Complete Data Center Upgrade by December 2019
xxx 2018
25