As a leading Australian superannuation fund, QSuper strives to offer quality products, services and advice to help its members reach their retirement goals. Like most regulated funds, QSuper is subject to Commonwealth legislation that governs its business activities.
QSuper had invested in an on-premises environment, managed by an incumbent IT partner. As it neared capacity, the QSuper team was reluctant to further invest in on-premises infrastructure. In response, QSuper decided to investigate whether public cloud was an acceptable mitigating option, and what that option would look like, given the stringent Commonwealth data rules they must follow.
After Brisbane’s floods in 2011 which caused an outage at QSuper’s headquarters, the organisation acted to prevent a recurrence by investing in infrastructure hosted by its incumbent IT Services partner. This decision proved effective for some years, but with fluctuating business demands and the infrastructure near capacity, QSuper Head of IT Architecture, Brendan D’Souza, said that it was time to look at other options before investing in additional on-premises infrastructure.
“Public cloud has matured, and it offers the agility required by our business. We engaged Business Aspect to help us establish a foundational managed public cloud environment. This included managed public cloud service design and contract negotiation, high-level and detailed design, building the tenancy and foundational infrastructure services, establishing connectivity, migration planning and an Infrastructure as a Service (“IaaS”) piloting.
QSuper’s existing managed services contract contained no provision for managed public cloud, therefore service design needed to started from scratch. Business Aspect commenced the engagement by assessing the situation and determining the desired outcomes for a diverse range of QSuper stakeholders. QSuper Technical Architect, Jason Raaschou, said the Business Aspect consultant made this phase look ‘almost effortless’ despite a complex business environment.
“The consultant was able to quickly understand the business context, establish working relationships with our internal and external stakeholders and appreciate the objectives, constraints and challenges we faced. He listened to people, and guided them to a common position. He really took a fresh look at how we work.”
In the early stages of the project, Business Aspect recognised the need to establish a common language among the many parties involved. This was made difficult, said Raaschou, by inconsistencies within the IT industry.
“It was important to get everyone to a common understanding of the terminology, to define what cloud is, and what it means to us at QSuper in terms of IaaS, applications, data and Microsoft Office 365. Sometimes vendors haven’t been as clear as they could be,” explained Raaschou.
Like most established financial institutions, QSuper depends on a combination of modern and legacy applications, and APRA compliance requirements must be considered when deciding where to place each workload.
“We had to consider the complexity, integration requirements and the data processed or stored in each system that was a candidate to migrate and recognise that some workloads are not suitable for the cloud,” said Raaschou.
The calculated and considered approach was endorsed by QSuperHead of Information Security, Jason Anderson, who said that protecting customers is the ‘number one priority’ when it comes to making decisions about data.
“The cloud project involved important considerations around protecting member data and making sure we protect them is vital. We had to think about the sensitivity of data, and make sure that the right security controls were in place. We followed APRA guidelines, and derived standards based from that,” outlined Anderson.
- An enterprise-level hybrid cloud environment based on a secure Microsoft Azure platform
- Pilot workloads transitioned to public cloud
- Ability to transition further workloads and implement Platform as a Service (PaaS)
- Improved understanding of where cloud makes strategic sense
- Avoidance of infrastructure costs
- Ability to make more informed decisions
- Ability to progress business-led projects
- Governance controls established
Business Aspect gave us a wider view of the challenges we should expect from implementing this type of environment, and how we can avoid the pitfalls. We are equipped to make the right decisions in the future”QSuper Head of IT Architecture, Brendan D’Souza
The IT Outcome
Having liaised with both technical and non-technical stakeholders within QSuper, and with the incumbent service provider, Business Aspect was able to develop a comprehensive ‘Tactical IaaS’ project plan. As well as design, testing and migration, it was vital the plan covered all commercial and contractual elements, such as changes to the existing managed services contract. This, said QSuper Manager of Data Centre and Recovery, Ditron Isai, required a rare combination of skills.
“The consultant’s approach was knowledgeable, and he proved he was comfortable providing the level of guidance we needed. He was able to corral all the stakeholders and get a uniform agreement on the deliverables – without this, it would have been a chaotic project.”
The consultant established the necessary project governance, with planning, delivery and communications all clearly outlined. The Tactical IaaS project meant adjustments to the way that QSuper worked, both internally and with its incumbent managed service provider.
“Business Aspect’s approach to managing change was important – they were taking IT on a journey,” said Isai.
“It wasn’t easy, but they were able to unearth a lot of information and pull it together to create the framework we were missing. The Business Aspect consultant has my respect and admiration for taking a concept and turning it into a tangible, deliverable item.”
As with most organisations, some applications and workloads were better suited to cloud than others while others were unsuited entirely, and the migration strategy developed by Business Aspect took this into account. The design for a secure, stable managed cloud environment, based on Microsoft Azure, was accompanied by a testing plan, with detailed processes for migration.
“We appreciated the experience around these types of processes, and I’d rate the consultant’s skill as very high. We now have a number of capabilities set up in terms of connectivity to the cloud and billing processes, and it is working well. In testing, we moved five applications to the cloud, but we moved some back again because of how they performed in the cloud. The work we had done with Business Aspect meant we could understand our migration to the cloud and had processes to test such workloads,” commented D’Souza.
Security, risk and compliance measures were fully integrated into every element of the cloud design and process, ensuring that QSuper adhered to APRA’s stringent guidelines. Anderson said that it is vital that organisations understand the implications of every type of data when considering cloud transitions.
“We are very particular around the types of data we have in place. We are not putting systems of record or transactional data in the public cloud. It definitely made the process easier from our perspective to leverage Business Aspect’s knowledge. We’re relatively new to cloud, and while we have some experience in-house, they were able to bring the benefit of vast industry knowledge and experience from working with other organisations.”
The Business Outcome
The enterprise-level hybrid cloud environment, based on a secure Microsoft Azure platform, gives greater flexibility and choice for hosting, without having to commit to physical infrastructure investment. As the business needs greater capacity, it can be provisioned immediately and for as long as it is needed, while built-in tools and processes prevent over-spend.
“This was probably not the typical consulting project, with a specific deliverable. Rather, it involved managing the project for us and lending cloud expertise, creating a process, and giving sound advice. It required understanding what would be useful for us,” said D’Souza.
“We can now make better decisions for the future about where we put applications. We managed to get an outcome – we were not trying to be 100 percent cloud, but we wanted to understand where it would make sense, to have a clear understanding of cloud versus on-premises costs, and to have the foundation in place.”
Where previously, new business initiatives were subject to lengthy processes relating to planning, procurement, build and commissioning, today’s competitive business environment demands faster IT delivery at reduced cost.
“It used to be difficult to ramp up quickly, and we were hamstrung by procurement timelines and processes. Costs and requirements became more complex, and when you throw in a managed service provider, it became more difficult. Cloud enables capacity when it is needed, so we can respond faster to business demand, which can in turn offer a better service,” said Isai.
Protecting data and reducing risk were elements of the project that Isai prioritised, and he was a strong advocate for moving to cloud with eyes open.
“These changes added a new dimension to backup and recovery. We looked at the new cloud-native toolsets available and considered how we wanted to move forward. Business Aspect opened our eyes up to what was involved in going down this path. We must always be accountable as the owner of data, and the right advice meant we could put mechanisms in place to mitigate risk.”
Although the initial brief was to design and develop a cloud environment and migration process, it became clear that QSuper needed to establish strong and enduring governance around its cloud environment. Business Aspect was further engaged to put in place systems of governance that would ensure that the organisation and its incumbent Microsoft Service Provider were clear on roles and responsibilities, and that QSuper would get the best return on its cloud investment.
“Having an external voice really helped with this, as the consultant was seen as being impartial. He never shied away from challenging conversations, was ready to respectfully challenge views, and make sure our thinking was clear,” said Raaschou.
“We didn’t want it to feel like this just came from one part of the organisation – everyone had a stake and understood the implications. Cloud had to be done right if we were to get the good outcomes.”
While QSuper welcomes its secure, Microsoft Azure cloud platform, the highlight of working with Business Aspect was the increased understanding of how to incorporate cloud into the organisation’s unique operating context.
“The biggest advantage was understanding that cloud is not the be all and end all – we can get the flexibility to deploy the right services and systems in the cloud, without being held back by rigid procurement, but we also know when not to do it. We have an increased knowledge of which environments and platforms are suited to cloud, and when to take a different course of action,” explained Isai.
“Cloud is not necessarily cheaper than on-premises, however, other benefits like agility and cost transparency offset some higher costs.”
While D’Souza cited ‘getting the commercial agreements in place’ as a key highlight, he agreed that the depth of understanding that QSuper gained about cloud has positioned the financial services organisation well for the future.
“Business Aspect gave us a wider view of the challenges we should expect from implementing this type of environment, and how we can avoid the pitfalls. We are equipped to make the right decisions in the future,” he concluded.