Issuing Group Cloud Computing Update January 2012

Project by the Numbers  7 vendors invited to participate in the RFP process (Cisco, Fujitsu, Google, IBM, Merit Network (Zimbra), Mirapoint, Microsoft)  10 participating Universities - “The Issuing Group”(Chicago, Columbia, Cornell, Duke, Georgetown, Iowa, Penn State, Princeton, Stanford, and Virginia)  93 individual participants from The Issuing Group  131 conference calls  292 vendor documents

 Timeline _____________________________________

Actual Percent Timeline

 Contract Overview __________________________________

Google Contract Overview  Google has declined to share the “Issuing Group” contract beyond the original 10 Universities.  Improvements were made to the current Google Edu contract  Possibility of sharing the contract through a FOIA (Freedom of Information Act) request if a public school signs the “Issuing Group” contract.

Microsoft Contract Overview  Contract includes a BAA (Business Associate Agreement) su pporting compliance needs for ePHI  All data to be stored on servers located solely in the US  Negotiated against the Issuing Group Model Contract  Stronger privacy and security language  Updated flexibility on pricing – as of January 2012

 Lessons Learned __________________________________

Lessons Learned  Process was a “first” for both vendors  Engage the legal and technical teams in reviewing FOIA (Freedom of Information Act) requests prior to the issuing of the RFP  Engage Information Security Offices prior to the RFP  Establish timelines and then double  Express willingness to have a longer than normal negotiation period if the expectation is to make large impactful changes to a contract  Identify Public vs. Private school requirements  Research how your potential vendor negotiates – e.g., group vs. individual negotiations  Anticipate the media will find out about the project

Lessons Learned: Accessibility  The project was placed on hold for a period of time due to Office of Civil Rights investigation at NYU and Northwestern  Include all regulatory requirements in the RFP and model contract - the team missed the accessibility requirements  Include University Accessibility team members in the process  Include specific questions in the RFP around web compliance  Request current VPAT and W3C compliance documentation as part of the RFP

Lessons Learned: NDA  The Issuing Group never signed a vendor NDA, which allowed the project team to collaborate freely between team members and legal representatives

Lessons Learned: eRoom  The eRoom was a vital tool in coordinating 7 vendors and 93 individual University participants  Afforded ability to post documents for both vendors and University delegates to view  Vendors were able to post questions and receive responses in one location instead of using (The process was not used with the legal teams)

 Accomplishments/Impact __________________________________

Accomplishments/Impact  Google  Influential in improving two prior versions of Google’s Edu contract  The Issuing Group contract has a number of improvements over the current Google Edu contract. Schools outside of the Issuing Group have already benefited from the new terms.  Additional improvements for the greater Edu community, especially if a public school signs the contract and it can be released under FIOA

Accomplishments/Impact  Microsoft  First ever multi – University contract for Microsoft  Partnered with Microsoft to create a solid Business Associate Agreement (BAA); the BAA is now the company standard  Microsoft used the Issuing Group contract to negotiate from  The Microsoft agreement was shared with all CSG & RUCC members  Aggressive pricing due to group purchase power

Results

 Questions? __________________________________

Thank you  Tracy Futhey – Duke  Project Leaders  Donna Tatro – Princeton  Matthew Ricks – Stanford  Legal Leaders  Henry Cuthbert – Duke  Lauren Schoenthaler – Stanford

CIO Panel & Discussion  Tracy Futhey – Vice President for Information Technology and Chief Information Officer at Duke University  Bill Clebsch - Associate Vice President of IT Services and Chief Information Officer at Stanford University  James Hilton - Vice President and Chief Information Officer at the University of Virginia