Software-as-a-Service Enterprise Design Pattern

1 VA Enterprise Design Patterns Cloud Computing Software-as-a-Service OFFICE OF TECHNOLOGY STRATEGIES (TS) OFFICE OF INFORMATION AND TECHNOLOGY (OI&T) VERSION DATE ISSUED: APRIL 2017 2 APPROVAL COORDINATION REVISION HISTORY Version Date Approver Notes April 11, 2017 Bonnie Walker Final version for TS leadership approval and signature, including all applicable updates addressing stakeholder feedback and Section 508 Compliance. 3 CONTENTS 1 5 Business Problem .. 6 Business Need .. 7 Business Case .. 7 Approach .. 8 2 Current Capabilities and Limitations .. 9 Current Software-as-a-Service Offerings .. 9 Cloud Email .. 9 Customer Relationship Management (CRM).

2 9 Current Limitations .. 10 3 Future Capabilities .. 10 Key Attributes of Software-as-a-Service .. 11 Analysis of Service Models .. 12 Alignment to the One-VA Technical Reference Model (TRM) .. 15 Alignment to Veteran-Focused Integration Process (VIP) .. 15 4 Use Cases .. 16 Cloud Email Piloting and Rollout .. 16 16 Assumptions .. 16 Use Case Description .. 16 Software-as-a-Service Customer Relationship Management (CRM) Application .. 18 18 Assumptions .. 18 Use Case Description .. 18 Independent software Vendor (ISV) Software-as-a-Service Deployment and Hosting . 19 19 Assumptions .. 20 Use Case Description .. 20 Appendix A.

3 Scope .. 22 Appendix B. Definitions .. 23 Appendix C. 24 Appendix D. References, Standards, and Policies .. 26 Table 3: List of Approved Tools and Standards .. 15 Figure 1: Architectural Concept for VA Cloud Computing based on NIST Architecture .. 6 Figure 2: DevOps Process (via VA Industry Partner) .. 12 Figure 3: Cloud Security Responsibility Model .. 14 Figure 4: Process Flow of using SaaS to pilot and rollout e-mail .. 17 Figure 5: Changing needs of SaaS CRM .. 19 4 Figure 6: SaaS independent software vendor workflow .. 21 5 QUICK JUMP Select an icon to skip to a section. Current Capabilities Future Capabilities Use Cases One-VA Technical Reference Model The Veteran-Focused Integration Process Enterprise Design Pattern Scope 1 INTRODUCTION In order to respond to rapidly changing business needs and Information Technology (IT) product capabilities, the Department of Veterans Affairs (VA) requires a standard approach to leveraging Software-as-a-Service (SaaS).

4 SaaS is defined by the National Institute of Standards and Technology (NIST) as a capability provided to the consumer that runs a provider s applications on a cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser ( , web-based email), or an application programming interface (API). Other than limited, user-specific, application configuration settings, the consumer does not manage or control the underlying cloud infrastructure of network configurations, host operating systems, storage, and individual application capabilities.

5 This Enterprise Design Pattern (EDP) is an extension of the Cloud Computing Architecture EDP, with an emphasis on SaaS. The VA consensus standard for deploying SaaS consists of the following attributes: Provides a fully managed set of business services ( , e-mail and Customer RelationshipManagement [CRM]) that are scalable for Enterprise use Delivers on-demand IT capabilities that require minimal customization by the Office ofInformation and Technology (OI&T) Allows VA to subscribe to the service provider, pursuant to Service Level Agreements(SLAs) and security requirements that are referenced in the Cloud Security EDP; andwithin the established Government Accountability Office (GAO) SLAs6 Figure 1 illustrates the key components of cloud computing, based on the NIST reference architecture, which enable VA to maximize the benefits of integrating cloud services .

6 In the diagram, the NIST recommendation for the architecture framework for the SaaS component is highlighted in red. FIGURE 1: ARCHITECTURAL CONCEPT FOR VA CLOUD COMPUTING BASED ON NIST ARCHITECTURE SaaS delivery models consist of: Hosted application management, in which the provider hosts software for the consumer and provides it over the web software on demand, in which the provider gives consumers network-based access to a single copy of an application Business Problem VA requires a more agile IT operating model that provides the ability to rapidly develop, modify, test, and deploy IT capabilities and functionality on scalable, dynamic cloud infrastructure.

7 Across the commercial industry, cloud is now a mainstream delivery platform and market share is increasing dramatically. 7 Currently, VA does not have a standard approach to evaluating and selecting SaaS solutions to address business needs across all VA Lines of Business (LOBs). Despite VA s adoption of the Cloud First policy (VA Directive 6517), there has been reluctance among OI&T stakeholders to adopt fully managed services . Security concerns and a lack of control over the operating environment have resulted in the tendency to develop custom in-house solutions to business needs, even when more cost-effective SaaS providers are readily available.

8 Therefore, VA OI&T has chosen to implement a VA Enterprise Cloud Brokerage concept to provide and enhance IT services in support of VA s mission capabilities. These efforts combine with strategic policy, tactical support and teamwork by IT Operations, and implementation tools, such as Enterprise Design Patterns ( , the Cloud Security EDP), to move VA closer to a Cloud First policy. Business Need VA OI&T can support business needs more efficiently through the use of SaaS providers. SaaS implementation can reduce the code base and development time that streamlines and facilitates agile solutions. SaaS has the potential to simplify development and acquisition of IT capabilities for business operations.

9 VA requires greater awareness of the benefits that a fully hosted and managed SaaS can provide the Enterprise . Cloud computing brings business value to VA. It contributes to savings on capital equipment, operating expenses, and support, while significantly increasing business agility. By optimizing the use of cloud computing, VA will achieve several critical goals: Deliver IT systems via mainstream technologies that are flexible and responsive to demand in order to support VA s mission Encourage and exploit dynamic and responsive supplier marketplaces and support emerging suppliers Achieve economies of scale in IT development and operations, while meeting budgetary and return-on-investment objectives Allocate IT expenditures to services and users by shifting from a Capital Expenditures (CAPEX) to an Operational Expenditures (OPEX)

10 Model Business Case VA OI&T intends to take advantage of marketplace developments to bring an improved level of agility and cost savings to VA, in support of the Veteran initiatives, while complying with Federal Government mandates, such as FISMA/FedRAMP, FITARA, and Section 508. As VA shifts to a Cloud First approach, it must include an externally managed SaaS as part of its IT service offerings. A SaaS moves the responsibility for software support and improved services to the 8 SaaS provider, while simultaneously managing costs, enabling innovation, reaching a wider Veteran community, and securely exchanging information among VA partners.