Evidence of meeting #5 for Public Accounts in the 42nd Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was transformation.
A video is available from Parliament.
NDP
Chief Information Officer, Treasury Board Secretariat
Maybe I could clarify why Ron was asking the question.
The strategic IT plan has some enterprise initiatives and it's because it's strategic it is a directional plan for departments. Then there are specific plans that are very operational that every department would have, and Ron has those for Shared Services Canada. We have the IT strategic plan. We've done a lot of consultation with the community, with CIOs across government, and the completion of that document is March 31. We expect at the latest to have that approved and out to the departments for implementation in the spring time frame. Probably a June time frame is what we're looking at.
NDP
David Christopherson NDP Hamilton Centre, ON
Good, okay. You can expect that we'll be incorporating that in our report and looking for some detailed follow-up.
I want to go back to Mr. Parker's opening remarks. He said, and I quote, that Shared Services Canada “was created to modernize information technology infrastructure services to ensure a secure...”. The first word that Mr. Parker used was “secure”. So the services were there to ensure, and I continue the quote, “a secure and reliable platform for the delivery of digital services to Canadians.”
The Auditor General said, even this morning, “In addition, we found that Shared Services Canada rarely established expectations or provided sufficient information to partners on core elements of security. This is important, because Shared Services Canada plays an important role in implementing Government of Canada security policies, directives, standards...”.
My question for Mr. Parker is, if ever there was a buzzword of this era it's “security” and it was used as the first word. So why the deficiency? Why does the Auditor General find out that you weren't in touch and providing sufficient information on the core elements of security?
My second question is for Treasury Board, the ones who are supposed to make sure they do it. Why did they fail in their job in making sure they didn't do it in the first place?
President, Shared Services Canada
I would like to begin by remarking that indeed the IT infrastructure services that Shared Services Canada provides are secure. We have made important progress in securing the IT infrastructure, the perimeter of the IT infrastructure. As I mentioned in my speaking notes, a 24-7-365 security operation centre has been established, providing an overall perspective on the threats to the Government of Canada's IT infrastructure. We monitor the potential threats to the infrastructure services incredibly closely, along with our security agency partners. While there's never any guarantee—there's no immunity against cyber threats—we are very vigilant and have made investments over the last number of years to increase the security of our IT infrastructure.
In terms of information provided to partners, we agreed with the Auditor General's recommendation that there needs to be better communication. We're taking firm steps already to clarify the roles and responsibilities. Those documents have been circulated to our partners and we're engaging in further action to improve communication.
NDP
Conservative
The Chair Conservative Kevin Sorenson
We'll go back to Ms. Zahid.
I'll put it on to your next round.
Ms. Zahid.
Liberal
Salma Zahid Liberal Scarborough Centre, ON
Thank you, Mr. Chair.
My first question is for Mr. Parker.
I was very surprised to learn that no firm service level agreements were included as part of your relationship with partnering departments. It's not just specific business agreements. No private sector company would sign a contract with an IT service provider without firm service level agreements.
Do you have any comment on that?
President, Shared Services Canada
Absolutely. When Shared Services Canada was stood up, it inherited a vast array of different types and qualities of IT services and infrastructure. In most cases, there were no existing service level agreements that came with that IT infrastructure. It's been a big job just to figure out what the IT infrastructure is that was inherited and what is the map to it. We are well on the way to completing that. It is necessary in order to consolidate the networks and the data centres, for example.
We are going to be establishing service level expectations for our clients. You can see in the report on plans and priorities for 2016-17 that we are shifting to a model that is truly business for Shared Services Canada. We are setting targets, for example. They are around the reliability and stability of the desktop functions, the percentage of time that email systems are available, the number of applications migrated, the time that the mission-critical systems are available, and the mean time to restore those systems. All of those indicators are being developed. It's our intent to hold ourselves to account on the targets that we will set for our clients.
We're also intent on measuring customer satisfaction. The Auditor General mentioned this. That as well is an important feedback mechanism for us to understand how we're doing. We've done the first survey and have the results. That's a baseline for us to grow the organization in terms of its maturity.
Liberal
Salma Zahid Liberal Scarborough Centre, ON
Will there be some penalties? Without penalties or consequences for failure, service level agreements are meaningless.
Will you build a penalty or some consequence into your new program for failing to achieve the service level agreements, and what could that penalty be?
President, Shared Services Canada
I'm going to ask Mr. Glowacki to take that question.
John Glowacki Jr. Chief Operating Officer, Shared Services Canada
Thank you.
First of all, I have to say that it's a privilege to be here.
Mr. Chair, it is quite typical in this managed service provider industry that when you go into an engagement such as this, you take on the existing status. The agreements are quite standard to come in and say, as the phrase goes, “your mess for less”. Basically, you run it at the same status. If there are pre-existing measurements, you take on those measurements and you agree to run them at the same status. What we had here was that, in many cases, there were not sufficient systems in place doing the operational metrics that we could take on and say now we have a baseline and we will continue to measure against that baseline. Absent that baseline, it becomes a best effort kind of engagement.
To your question about service credits, if you will, this goes back to some of the previous questions about how things are paid for. We are trying to migrate from what we were created as. Some base had to be established with the appropriations, but as we move forward, we're going into what we call a fee-for-service environment. As demand goes up, additional services are always added. That's just the law of nature. We will have agreements in place that show the level we will provide, the availabilities, the liabilities, etc. We're all in the government, so it is not typical to say that we'll provide some sort of service credit if we miss the mark.
Now, the caveat is that we inherited a hybrid environment where we do go to industry for a certain amount of our services. It's predictable that we'll continue to do some services ourselves. For some it will make perfect business sense to have industry doing those. The benefit we get with industry is that we ensure that we have service credits through them. Take email, for instance; we do have service credits. Those are piling up, and we have a very careful count of those. As we unfold the operation, we will apply those as necessary.
Liberal
Liberal
Joyce Murray Liberal Vancouver Quadra, BC
Thank you.
Thank you for being here to help us understand the situation with IT services.
My background is in British Columbia. When the British Columbia government tackled shared services back in 2003-04, it was broken into chunks. I'm trying to understand the methodology Shared Services has used to deliver on this very ambitious seven-year program. In British Columbia, for example, desktop management was taken as a discrete project. It took probably about two years to fix that. Then there was the separate project of network services. The mission-critical legacy systems and servers were not touched during that period. The departments continued to provide the service. From breaking it into very distinct chunks, it seemed each of them was manageable, and this was a very successful program.
I am not clear on this from the materials we have. Was Shared Services given the mandate to do all of this in a big integrated project that it would be easy to flounder in, as we know from corporate transformation projects as well as government, or did you have a methodical, step-by-step approach where you tackled one piece, succeeded with that, and tackled another piece?
President, Shared Services Canada
Mr. Chair, the transformation is one program with separate components. There's an email component, a data centre component, and a networks component. We are working in parallel on all of those components. I think it's very essential to do that, because there are many interdependencies between all of these. The networks are essential to email, and essential to data centres, and modernizing them along the way is crucial to the success, in fact, of the data centre project as well.
We have a set of separate projects for email, the data centres, and the network. Their interdependencies have been identified, and we are working to manage those projects so that they intersect at the right time and the right place to enable one another.
Conservative
The Chair Conservative Kevin Sorenson
Thank you very much, Mr. Parker.
We'll move into the second round.
Mr. Godin, you have five minutes.