Government Operations Committee on Nov. 6th, 2012

[The Chair, NDP, Pat Martin]

Good morning, ladies and gentlemen.

We'll call our meeting to order.

We're very pleased to welcome to the government operations committee representatives from Shared Services Canada as we undertake a study of the first year of operation of this new entity.

We're pleased to welcome today—and we're grateful for their time—Liseanne Forand, the president of Shared Services Canada; Mr. Grant Westcott, the chief operating officer; and Gina Rallis, the assistant deputy minister and chief financial officer of corporate services.

We would welcome opening remarks from whomever chooses to speak—Ms. Forand, I presume—and then we look forward to questions.

The floors is yours, Ms. Forand.

[Liseanne Forand, President, Shared Services Canada]

Thank you very much, Mr. Chairman.

Thank you for the opportunity to make some brief opening remarks to describe the progress that Shared Services Canada has made in its first year of operation.

The government announced the establishment of Shared Services Canada on August 4th, 2011, with a mandate to consolidate, standardize and streamline the delivery of email, data centres and network services in the Government of Canada.

The first step in achieving those objectives was the transfer, by order in council, of information technology infrastructure responsibilities and resources—including approximately 1,200 employees from Public Works and Government Services Canada—to Shared Services Canada. This was followed by a second set of orders in council on November 15, 2011, which transferred IT infrastructure services and resources from 42 other departments and agencies, as well as over 5,000 employees who were responsible for supporting those services.

On April 1, 2012, SSC was granted full financial authorities. For 2012-13, SSC has an appropriated annual budget of $1.5 billion, with additional revenue authority of $368 million.

And on June 29th, 2012, royal assent was granted to the Shared Services Canada Act, which established the department in legislation. Under the terms of that legislation, SSC's minister has the authority to procure goods and services related to the department's mandate. Resources were therefore transferred from PWGSC to SSC to support the new procurement functions.

As a result, the legislated departmental structure is now in place with the necessary authorities for SSC to function. We have now brought together some 6,500 employees, as well as the assets, funding, contracts and projects related to IT infrastructure across the Government of Canada.

The department is now focused on four priority areas, as set out in our report on plans and priorities for 2012-13.

Our first priority has been to maintain and improve the delivery of IT infrastructure services. This is critical, as over 2,100 mission-critical systems across the Government of Canada depend on our infrastructure to continue delivering programs and services to Canadians and businesses on a daily basis.

In order to make sure that we were equipped to assume the responsibility for those operations as of November 15, 2011, we focused on completing the following steps.

We established an operating model organized around seven operational portfolios to promote visibility, accountability, and responsiveness. We identified qualified staff for key positions. We designed and implemented an incident management process to identify, address, track, and monitor incidents that affect the performance of the mission-critical systems for which we're responsible. Also, we developed, in consultation with our staff, an initial operational plan around which they could align their activities and objectives.

The model that we put in place has served us well through our first year of operations, and will evolve as we move forward with our modernization plans.

Our second priority is to launch the renewal of the Government of Canada's IT infrastructure, with a focus on e-mail, data centres, and networks. As planned, the e-mail transformation initiative is the most advanced, with a commitment to the delivery of a single e-mail solution for partner departments by 2015.

This integrated solution will replace the 63 individual e-mail systems currently in place in the 43 departments we serve. The new solution will support a consistent approach to all aspects of e-mail, including instant messaging, calendars, contacts, folders, directories, and anti-virus and anti-spam protection.

SSC has made substantial progress on this initiative since last November. We have completed an inventory of existing email systems in use today, and confirmed the future requirements of partner departments. The project has been scoped to consider all relevant considerations, including security, mobility and the need for application integration.

Following an industry engagement phase that began in June 2012, a procurement process is now in progress to identify a potential supplier. This will lead us to the identification of an e-mail solution by the spring of 2013, followed by implementation in waves over the next 24 months.

SSC is also moving forward on plans to consolidate data centres and networks, which will enable us to deliver greater security, higher service quality, and lower costs.

Given the size and complexity of such an initiative, the planning stage is particularly critical. We are therefore carefully assessing the current state of our data centre and network operations. At the same time, we are working with our partners and the industry to design what the future data centre and network configuration should be. We expect to have this work completed, along with a proposed strategy for the transition from current state to end state, for presentation during the first half of 2013.

Our third priority is to establish the governance mechanisms and implement the partnerships that are essential to a successful enterprise-wide approach. As part of this work, we've undertaken extensive engagement with partners, both within government, including departments and bargaining agents, and in the private sector.

Between November 15, 2011, and March 31, 2012, in advance of the establishment of the necessary SSC financial authorities, we operated on the basis of business continuity framework agreements with our partner departments, according to which we all agreed to continue to provide services and support in such a way as to maintain operational continuity. Since April 1, we've been entering into business arrangements that set out the high-level expectations and commitments that will govern our relationship with our partners.

In the case of organizations with unique business requirements, such as the RCMP, for example, we're also entering into bilateral operating protocols or memoranda of understanding to reflect specific commitments.

I am also pleased to note that we have established a constructive relationship with bargaining agents over the course of the last 12 months. Working through bilateral and multilateral approaches, we have collectively designed a national consultation framework and addressed operational and other issues as they arose in the course of the year.

From the very beginning, we understood that the development of a positive relationship with the information and communications technology sector would be key to our success. We therefore launched an early engagement process with industry associations to seek their views on a variety of issues, from procurement to innovation. The results of that process led us to propose the establishment of what we are calling the IT Infrastructure Roundtable, which is a forum that will bring leading technology innovators together with SSC staff and key government partners, for a dialogue on our long-term transformation agenda.

Our final priority is to implement the efficient and effective business management processes and services. As a new organization, and as an organization established to take an enterprise approach, we are seizing the opportunity to apply best practices. We are designing a lean and efficient corporate services model that relies on technology to offer responsive services at lower costs; we are adopting common business procedures and partnering with other departments to implement financial and HR systems.

And we are introducing a workforce management strategy to support our staff through the transition that lies ahead.

I will conclude my remarks by recognizing that SSC has much more to do to realize all the objectives that the government has set for us. Nonetheless, a good foundation is now in place — thanks to the active contribution of staff at all levels of the department. They have offered up their expertise and their commitment to deliver results.

We're very proud of what they've accomplished and look forward to great things in the future, as SSC supports the delivery of programs and services to the Canadians and businesses that depend on them, by providing modern, reliable, and secure IT infrastructure services to the Government of Canada.

We look forward to your questions.

Thank you very much.

[The Chair, NDP, Pat Martin]

Thank you very much, Ms. Forand.

I noticed that you've circulated quite a comprehensive package of information to committee members. They've had them in advance, and I'm sure that has generated some questions.

For the NDP, the official opposition, we'll go to Linda Duncan.

Five minutes, please.

[Linda Duncan, NDP, Edmonton Strathcona, AB]

Thanks, Mr. Chair.

Thank you for being here today.

Ms. Forand, I'm left a little bit confused. You have testified to us today that the first priority for Shared Services Canada is to maintain and improve the deliver of IT in the federal system, but in a letter in June of this year to the Parliamentary Budget Officer, you advised that your first priority is meeting your ambitious target of a $150 million reduction towards deficit reduction by 2014. Perhaps you could clarify for us what is the first priority of Shared Services Canada.

[Liseanne Forand]

Thank you.

In terms of the priorities, as we were established last November, we articulated very clearly for ourselves that our first priority was to maintain operations. We recognized that we were entrusted with the support of 2,100 mission-critical systems. The Government of Canada runs on IT and it was important for us to equip ourselves to be able to support all of that IT, so we did put a tremendous focus on operational continuity in context and in cooperation with our partners.

As well, as all other departments did, we did have as a priority to meet the deficit reduction targets of government. We were asked to identify initiatives that could add up to 5% and 10% savings. We made a proposal to that effect to the government, which was accepted and announced in the budget.

I don't really separate out the two. We did articulate our first priority in our RPP as being operational continuity. I would say that in identifying the potential initiatives for savings at Shared Services Canada, we did take great care to protect our ability to maintain operations while realizing those savings. We didn't want those changes to affect our ability to operate the systems of government, and we also didn't want those savings to jeopardize our ability to launch our transformation agenda, so we identified initiatives that would enable us to do that.

[Linda Duncan, NDP, Edmonton Strathcona, AB]

Thank you.

Following up on your response, I wonder if you could provide us briefly—and if you could provide to us later—the baseline unit costs for IT delivery and your performance framework for meeting these cost reduction targets.

[Liseanne Forand]

I'll talk about the cost reduction targets first and then ask my colleague, Grant Westcott, to talk about the unit costs, perhaps, after that.

By the way, the initiatives that we identified for our cost reductions in the context of deficit reduction are listed in the integrated business plan that we provided to the committee and to committee members. If you want to look at it, it's on page 13 of that report. We did list the initiatives that we chose.

We were a new organization when we were faced with the requirement to identify 5% and 10% savings. We, as yet, did not have a financial system. We had not yet onboarded the bulk of our employees. We were still very much in a development phase. However, we knew, and I think we discussed this last year when we were before this committee and the minister mentioned it...we were confident that there was what we were calling a “consolidation dividend” that would be available by bringing departments together.

[Linda Duncan, NDP, Edmonton Strathcona, AB]

You've targeted that at $75 million this fiscal year, right?

[Liseanne Forand]

So we identified pricing and costing in the first instance. We had knowledge of contracts that had been passed where the prices had come down. We had knowledge of other contracts that we would be entering into where the prices would be at that level as well. So we were able to identify savings that really leveraged our buying power and our ability to consolidate contracts. Those are the areas that we went to in terms of our initiatives.

[Linda Duncan, NDP, Edmonton Strathcona, AB]

So those measures will be achieved in this fiscal year?

[Liseanne Forand]

The measures for this fiscal year have already been achieved. We have achieved the savings that we identified for this year. Again, it's through contract consolidation and through.... As I mentioned in my opening remarks, in putting together our business processes, we're looking at a very lean internal services model. One of the areas where we identified the possibility of reductions was through internal services, and that's $25 million in cost reductions. That's not cutting; that is not building from the first—

[Linda Duncan, NDP, Edmonton Strathcona, AB]

Does that include the additional costs for improved cybersecurity?

[Liseanne Forand]

In fact, none of our savings initiatives have to do with cybersecurity.

We have received additional funding this year to support the government's cybersecurity strategy, and those funds were included in the supplementary (A)s this year—$10 million for this year. We are actually receiving additional funding as part of the government's cybersecurity program.

[The Chair, NDP, Pat Martin]

I'm afraid that's the five minutes. People should keep in mind that the five minutes is for questions and answers, so the time goes very quickly.

Next, for the Conservatives, is Jacques Gourde.

You have five minutes, Jacques.

[Jacques Gourde, Conservative, Lotbinière—Chutes-de-la-Chaudière, QC]

Thank you, Mr. Chair.

I would like to thank the witnesses for coming here this morning.

Ms. Forand, could you please tell us about the progress you have made with respect to emails and how this initiative will improve the efficiency, reliability and overall security of the system? Could you also tell us whether we are now able to see the impact and results of these changes?

[Liseanne Forand]

Thank you very much.

As I mentioned in my opening statement, we really launched our initiative to modernize and merge the email systems right from the outset. This was, indeed, the first initiative we undertook. In certain respects, this was the easiest of the three initiatives but, despite everything, it is not a simple one to do. Departments are all organized in their own way. We are talking about 63 systems at present.

We began by really focussing on the situation, establishing how the current systems operated, drawing up an inventory and so on and so forth. We consulted the departments to determine their requirements and what they needed in that respect. We also considered the issue of security. We held discussions with our partners, in particular with the CSTC, Public Works Canada and Justice Canada. It was acknowledged that the email systems are vulnerable in the current information technology systems. I believe that this holds true for both the government and the private sector. Agents are often able to infiltrate our systems through the email systems. And these systems are all interconnected. The email systems are connected to the networks which are in turn connected to the data centres, etc. There really is a gap here which makes the system vulnerable. From the outset we understood that we had to adopt an approach offering greater security.

We then turned to industry for their input. We held information briefings with representatives from the technology sector. These initiatives generated a great deal of interest. Approximately 150 people participated in these sessions. Following that, we prepared a request for information for the industry. In zeroing in on our requirements, we wanted to ensure that we were as well-informed as possible about what industry could provide.

In September, after going through this entire process, we implemented our purchasing and procurement process. We will proceed by determining which preselected companies we will work with for a period varying from six weeks to two months. Our objective is to specify the contract requirements. We did not want to specify these requirements ourselves without first having spoken to people who would be able to provide such services.

The process will be over by the end of this week. This is what we call—and I will refer to it in English as I do not know what the term is in French—

“the request for responses for evaluation”.

We have established our requirements with respect to both security and tangible experience. We are expecting that approximately five or ten firms will be able to meet these requirements. We are then going to work with these five or ten companies in order to specify the requirements and then, next January, we will prepare a proper request for proposal. We are expecting a solution to be determined before the spring of 2013. Only the 5 or 10 preselected firms will be authorized to submit proposals.

[Jacques Gourde, Conservative, Lotbinière—Chutes-de-la-Chaudière, QC]

Are these all Canadian companies?

[Liseanne Forand]

We obviously cannot give you an answer right now, but I can tell you that we have established security requirements for those companies who will be given consideration. They will have to go through a security review of both their staff and facilities. They will also have to be able to guarantee their ability to protect Canadian information, what we refer to as data sovereignty. That means that the data centres receiving the emails will have to be located in Canada. Information will be protected in Canada and also when it is sent, for example, to our embassies abroad.

[Jacques Gourde, Conservative, Lotbinière—Chutes-de-la-Chaudière, QC]

Thank you.

[The Chair, NDP, Pat Martin]

I'm afraid that's all the time you have, Jacques. Thank you.

Denis Blanchette, please.

[Denis Blanchette, NDP, Louis-Hébert, QC]

Thank you, Mr. Chair.

I would like to thank our witnesses for coming here. This is always an issue that I really like to discuss.

When we saw each other the last time, you had not yet understood what you had inherited in its entirety. Do you now have a full understanding of this initiative?

[Liseanne Forand]

I will start to answer your question, and then I will give the floor to my colleague, who works in the technical sector much more than I do.

I will tell you that we have achieved a great deal of progress since last year. As I said, we have drawn up a complete inventory with respect to the email systems, and we are now in the process of doing the same thing with the data centres and the networks.

We also have an operating model which enables us to get a very complete overall picture of the business's activities, over the long term.

I think I will ask Mr. Westcott to give you a brief explanation of what we have observed.

[Grant Westcott, Chief Operating Officer, Shared Services Canada]

Thank you, Mr. Chairman.

If you understand, we've organized our work around e-mail, data centres, and networks. In terms of the e-mail transformation, we're very advanced. We've completed all of our current state. We know exactly how much money we were spending and where.

We have a very good idea, because of our consultations with the private sector, what the art of the possible is. We've built a business case that confirms that it makes business sense to do this and we're in process to acquire the solution. So I think that in terms of that part, the clarity is there—

[Denis Blanchette, NDP, Louis-Hébert, QC]

I'm going to stop you right there, because I have already read all about that. I know that you have a timeframe up until 2015.

The question I'm getting at is whether or not you have a complete inventory of everything that you have inherited with respect to human resources, server locations, software, contracts, etc. Have you done this yet, yes or no? If not, when do you think that you will be able to complete this process?

[Grant Westcott]

Thank you.

In terms of the data centres and telecommunications activities, we are almost complete; it's that complete inventory of everything we have in terms of the number of people, where they work, what they work on, the amount of the physical facilities we own, the amount of technologies that are deployed in these two areas of data centre operations and network operations, as well as all the software that supports both sets of activities. These things are fundamental for us to actually build a plan that we can execute from.

It has taken a long time, because there is a lot of complexity associated with doing this. We were basically dealing with the inheritances of 43 departments that had been building all of these facilities for 50-odd years. There is an inherent amount of complexity in doing that. We're almost complete with that now, as we speak.