Transport Canada (TC) Infrastructure Modernization - Cloud / DR / Workload Migration

Transport Canada (TC) IT Infrastructure Modernization

The goal of this project is to deliver a complete modern infrastructure environment for TC applications in the Cloud. This requires building a foundational Cloud environment, planning and executing a workload migration plan, as well as creating and implementing a Disaster Recovery Management Program. In conjunction with SSC, a secure network to Cloud and authentication services will be established.

The Cloud will provide TC with a modern, scalable, and resilient infrastructure which offers disaster recovery and rapid time to market to support the promotion of a safe and secure, efficient and environmentally responsible transportation system in Canada.

This project is meant to address the business needs and opportunities of:

• Providing recovery services for IT in the event of a disaster. This will ensure that the delivery of critical services affecting the safety, security, and economic viability of Canadian citizens continues in a normal operations mode in the event of a disaster;
• Responding to the Cloud First principle and direction from TBS for delivery of Digital Services;
• Responding to demands for increased IT capabilities and increased IT capacity to support department’s programs;
• Adoption of DevSecOps and modern development methodologies that are enhanced by Cloud services – working in Agile, Open, Collaboration; and,
• Implementing a Disaster Recovery Management program in response to the TBS Policy on Government Security to provide IT service continuity in a timely and efficient manner.

The key deliverables are:

• Modernized TC IT environment using Cloud solutions;
• A migration of all applications/systems within the Workload Migration (WLM) initiative to the Cloud;
• Application development and support model modernization to enable Cloud solutions providing efficiencies in delivery time and cost; and,
• A validated and maintained Disaster Recovery Management framework in place.

Secure Cloud Enablement and Defence (SCED)

As workloads are migrated to the Cloud, the GC perimeter shifts outside of the on-premise environment, and measures must be put in place to monitor and protect these Cloud-based environments, and respond to cyber threats quickly. The establishment of private, dedicated connections to GC approved Cloud Service Providers (CSP) will enable a hybrid IT environment, and ensure that the GC can continue to have secure access to information systems and solutions hosted in the Cloud.

Secure Cloud Enablement and Defence (SCED) is secure connectivity from Cloud to Ground that is being implemented for applications and platforms that handle Protected B data. TC is working with SSC to implement SCED as a pilot project for two applications: Enterprise BI and Data Analytics (eBIDA) and Policy on Government Security (PGS), with a targeted completion date of November/December 2020.

Cloud Service Operation Model (CSOM)

The Cloud Service Operation Model (CSOM) is a framework used to assess current levels of organizational maturity in the operation, management, and governance of Cloud services. The CSOM framework and methodology is iterative and can be used for existing and new Cloud services. Microsoft is leading the CSOM effort for TC and will be delivering a digital capabilities assessment and maturity roadmap.

Project Status

This project is using Agile methodology and is in Phase 3, Launch/Execution & Control, of the TC Project Management Framework 4 Gate Model. TC's Azure Cloud Foundational Environment has been granted Authority to Operate (ATO) up to Protected-B for applications not requiring secure network connectivity.

Overall, the project was impacted by the delayed SSC delivery of SCED (Secure Cloud Enablement & Defence), required for applications that need secure connectivity, but is now moving forward with a SCED pilot for two COVID-19 related applications: PGS and eBIDA. Applications related to the COVID-19 response have been given top priority for migration, so more resources will be put on these, and other activities may be impacted. For PGS and eBIDA, resources from Solutions Centre and Microsoft have been secured for Cloud migration work.

Disaster Recovery (DR) plans are implemented for each application that moves to the Cloud, if required. The full DR program is expected to be set up and operational by the end of the calendar year 2022. All applications are expected to be in the Cloud, with DR plans if required, by March 2023.

Milestones	Initial Target Date	Forecast Date	Completion Date	Comments
Project Start Date	2017-10-26	2017-10-26
Discovery & Analysis for Disaster Recovery (DR)	2018-10-05	2018-10-05	2018-10-05	Complete: Initial research for establishing a Disaster Recovery Program for TC
Gate 0 Phase 1: Discovery and Initial Cloud Foundation	2019-04-29	2019-04-01	2019-04-01	Complete: Task awarded to Microsoft to collect information for Cloud environment, assess the TC landscape, and create the initial working environment for TC applications.
Gate 1 Phase 2: Application Target State Assessment	2019-09-20	2019-09-20	2019-09-20	Complete: All business systems assessed and assigned a Cloud target state.
GC EARB Prioritization for Secure Cloud Enablement Defence (SCED)	2018-07-16	2020-06-30		TC requested a target date of July 2018 for SCED but delivery was delayed. Until SCED is available, TC cannot put into production any Cloud applications that require secure connectivity.
Cloud Foundation Build	2019-04-01	2019-10-18	2019-10-18	Complete (except for SCED secure connectivity). This is the Cloud working environment for TC applications.
Sprint #1 Migration of Applications to Cloud	2020-01-31	2020-01-31	2020-01-31	Sprint #1 complete. The following apps were worked on: CUMULUS, SAP-BI, TSCA. CUMULUS progressed into a Non-Production environment.
Gate 2 Project Execution Approval (under the PMF 4 Gate Model)	2020-03-01	2020-03-01	2020-01-30
Sprint #2 Migration of Applications to Cloud	2020-02-28	2020-02-28	2020-02-28	Sprint #2 complete. The following apps were worked on: CUMULUS, SAP-BI, TSCA, LDPS, TeamMate Suite, TC WWW, ASD.
Sprint #3 Migration of Applications to Cloud	2020-03-15	2020-04-30	2020-04-30	Sprint #3 complete. The EGIS app was worked on.
Sprint #4 Migration of Applications to Cloud	2020-05-04	2020-05-20		Sprint #4 in progress. The following apps are being worked on: MEDV, SRF, iServer.
Migration of Business Systems to the Cloud	2023-03-31	2023-03-31		Remainder of systems migrated to the Cloud.
Disaster Recovery Plans for all applications completed	2023-03-31	2023-03-31
DR initial Exercise	2022-03-30	2022-03-30		First full scale exercise
Gate 3 Phase 4 - Project Completion Date - Approval for Project close	2023-03-31	2023-03-31		TC signoff of delivery of all services
Gate 4 - Project Close	2023-04-15	2023-04-15

Key Accomplishments

• The following applications have been migrated to the Cloud: Open Data, Alexa Recalls, TC Search, Navigable Waters Act Registry, eGIS, TC WWW, MEDV, and NWAR-ESS.
• TC-SSC ADM Cloud Steering Committee created to address issues and risks associated with this project.
• SCED pilot in progress for two applications: PGS and eBIDA.
• Applications related to COVID-19 response were prioritized and work is underway.
• Identified and prioritized next 8 non-COVID-19 applications for migration to the Cloud.
• Upgraded the Microsoft Multi-Factor Authentication (MFA) and Self-Service Password Reset (SSPR) features to use a centralized portal.
• Created a Cloud Migration Checklist for teams to use for migrating their apps to the Cloud.
• Created a Cloud Workload Prioritization framework to establish a priority order for applications moving to the Cloud.
• Created an Application Gateway script that dramatically reduces the amount of time required to create and configure subdomains on the network. As a manual process, creating and configuring subdomains takes about 30 minutes for each one, but with the new script it takes only 2 minutes. The script contains all the accurate settings for the subdomains, which removes any chance of configuration errors, and therefore saves the team potential troubleshooting time. The script is shared in the GCAccelerators github.
• Launched an Education Initiative as a way to create and distribute content to educate other teams in TC about Cloud migration and operations. As one of the first steps in this initiative, an onboarding checklist was created to help teams understand the steps involved in their journey to the Cloud.
• Created an Assessment Scorecard as a way to assess the criticality of moving applications to the Cloud and create a priority order. This scorecard will assist ARB with a technical understanding of the applications in the migration pipeline so they can make a decision about the migration priority order.
• All active TC employees (7,079) have been on-boarded to MS Teams.
• Active Directory Federation Services (ADFS) is now available for Cloud-based applications at TC. ADFS provides users with single sign-on capabilities by establishing a link between TC’s Azure Active Directory and the on-premise Active Directory. This reduces the amount of usernames and passwords required to log on to Cloud-based applications.
• TC and TBS have signed a Memorandum of Understanding (MoU) to fund Cloud Migration activities.
• Completed implementation of security controls required for Protected-B Cloud environment.
• Completed assessment of TC's applications for readiness to be migrated to the Cloud.
• Contracted industry Cloud expertise to assist to create, configure, and train TC FTE staff.
• Established the foundational Cloud environment, Hybrid Cloud Management (HCM), to start accepting workloads.
• As part of Culture change to adopt Cloud, 37 (formal and informal) Training sessions, 11 Technical Talks, 33 Awareness building roadshows, and four TC-wide Cloud engagement sessions have been completed.
• TC is sharing with other GC Agencies and Departments the Azure Network Template Generator via the GitHub repository.
• Began implementing DevSecOps methodology for this project.
• Dedicated TC Cloud Centre of Excellence (#TC3OE) has been established.          

Overview of Transport Canada’s Cloud Centre of Excellence (#TC3OE)

TC3OE is Transport Canada’s Cloud Centre of Excellence. The TC3oE team is enabling the delivery of modern digital solutions by leveraging the Agility, Flexibility, Elasticity, and Disaster Recovery features of Cloud technologies. The team supports and maintains the Cloud foundational infrastructure, and aids designers in the planning, procurement, configuration and integration of Cloud services, so that TC clients can quickly address their rapidly changing business needs.

#TC3OE can be contacted via email at: TC.Cloud-Infonuagique.TC@tc.gc.ca

Here is a photo of our outstanding team!

Challenges: Risks and Issues

RISK	If the SCED pilot for PGS and eBIDA takes longer than expected, then SCED implementation for 370+ other applications/platforms by March 2023 may be delayed. This would cause a delay to the overall project schedule, which means that not all applications/platforms would be migrated to the Cloud by the time MacDonald Cartier Data Centre (MCDC) closes in March 2023.
Impact	High
Probability	Medium
Mitigation	Ongoing assessment of project schedule as SCED implementation develops, and continue to migrate non-SCED dependent apps. If the overall project schedule is delayed, some applications/platforms may not be accessible for a certain amount of time and/or an on-premise interim solution will need to be built for them, until they can move to the Cloud.

RISK	If the overall project schedule is delayed due to SCED, then delivery of the 27 capital projects that have a dependency on this project for Cloud foundation infrastructure, workload migration, and SCED, may be delayed as well. This would mean that TC will not be able to meet service, regulatory, policy, and legal requirements for the respective projects, which will impact the safety and security of the Canadian public.
Impact	High
Probability	High
Mitigation	Create on-premise implementations for the 27 capital projects that can be easily migrated to the Cloud when SCED becomes available. If the overall project schedule is delayed, we will work with the capital project teams to produce mitigation plans.

RISK	Future years' funding not confirmed: If TC does not receive the required funding from the TBS App Modernization program, then the migration activities will be negatively impacted, leading to schedule pressure, and TC's inability to proceed with the GC Cloud-first strategy.
Impact	High
Probability	Medium
Escalation	Migration of workloads to the Cloud results in cost savings for the GC and SSC in particular. Negotiations with SSC will need to be held to fund the operation of workloads that are migrated to the Cloud.

ISSUE	Lack of resources and a constrained schedule may cause the project to extend past the current timeframe, which would require more funding and may impact the GC strategy to shut down the MacDonald Cartier Data Centre (MCDC) by March 2023.
Impact	Medium
Resolution Plan	The 67H3 project manager is actively prioritizing the workload, working with strategic partners to ensure the availability of skilled people, and the TC3oE team is taking on some of the workload from the teams that are moving their apps to the Cloud.

ISSUE	Limited Cloud expertise in the areas of network infrastructure, security, and server configuration. TC is having to build Cloud operations teams to support workloads in the Cloud, and SSC teams manage the on-premise infrastructure, so there is an opportunity to leverage their expertise.
Impact	Medium
Resolution Plan	The adoption of DevSecOps is expected to alleviate this issue because expertise from SSC and the rest of TC can be leveraged. Digital Services management is equipping the team with the necessary tools, and ensuring the team is trained in Cloud technology, including Q&A sessions and training with the vendor.

ISSUE	There are currently two funding issues: TC is responsible for migrated workloads. Workloads in the Cloud represent savings for the GC (SSC) but represent costs for TC. GC EARB approved partial funding for 20/21 fiscal year and the amount is insufficient for the planned work.
Impact	High
Resolution Plan	A funding strategy will be created and planned work will be adjusted according to the level of funding and/or additional funding will be sought from within TC.

Guidance and Documentation

• Frequently Asked Questions  
• GC Cloud Adoption Strategy
• Journey to the Cloud
• TC Cloud Corner
• Azure Network Template Generator on GitHub

Workload Migration Categorizations (Business Applications in Scope)

Data was sourced from the previous Microsoft Assessment.

Security Classification	No Active Directory Dependency	No Connectivity	Requires Active Directory	Requires Connectivity with EDC	SQL Database	Total
Unclassified	84	21	40	103	7	124
Protected A	87	9	60	138	5	147
Protected B	46	8	9	47	4	55
Total	217	38	109	288	16	326

Application Workload Migration via Agile Sprints

This project is following an iterative Agile process to migrate applications to the Cloud.

The following applications have already been migrated to the Cloud: Open Data, Alexa Recalls, TC Search, Navigable Waters Act Registry, TC WWW, MEDV, iServer, and NWAR-ESS.

App/Platform State	Description
Not Started	Work has not yet started on migrating the app/platform to Cloud.
Planning	Initial planning underway to determine timeframe for migrating app/platform to Cloud.
DEV	Development work in progress.
UAT	User Acceptance Testing. App is undergoing testing to prepare for moving to PROD.
PROD/DR	Production and Disaster Recovery testing. App is in the PROD environment and ready for review, testing, and cutover to Cloud.
Blocked	Blocking issue is impeding further progress.

Apps/Platforms In Progress	Current State	Notes
ASD	NPRD	Confirming if ATO has been received and if the application can move to PROD.
CARTES	DEV	Development work in progress.
CCM	DEV	Development work in progress.
eBIDA	PROD	Related to COVID-19 response. Part of SCED pilot.
ECATS	DEV	Related to COVID-19 response.
EGIS	PROD
GC Docs	DEV	Development work in progress.
MISS	DEV	Development work in progress.
MMERS	DEV	Development work in progress.
PGS	DEV	Related to COVID-19 response. Part of SCED pilot.
PRET	DEV	Development work in progress.
PWS (BC)	DEV	Development work in progress.
RPA CoE	DEV	Related to COVID-19 response. Dependent on SCED.
SAP-BI	DEV/UAT	Dependent on SCED.
SRF	DEV	Development work in progress.
Tachyon and ActiveEfficiency	DEV	Development work in progress.
TCLR API	DEV	Development work in progress.
TCOMS	DEV	Related to COVID-19 response. Migration plan in progress.
TEAMMATE	NPRD	Performance testing in progress.
TO_LAND	DEV	Development work in progress.
Vessel Registry	Planning	Initial planning underway.
ZAMMAD	DEV	Development work in progress.

Blocked Apps/Platforms	Current State	Notes
LDPS	Blocked	Lowest priority for business unit.
myTC	Blocked	Dev resources required elsewhere.
CUMULUS	Blocked	Looking for a replacement, plan to use CUMULUS until this is found. Decision needed on effort and value to complete Cloud migration.

Upcoming Apps/Platforms	Current State	Notes
BALLAST INTERVENTIONS	Not Started
BASE NAVIRES	Not Started
CVSA	Not Started
Digital Signatures	Not Started	Related to COVID-19 response. SaaS app (DocuSign), will not migrate.
FORMATION	Not Started
FORMATION_WEB	Not Started
INC_POLL 2014	Not Started
MTCO-SMTC	Not Started
PROFIL-FORMNAX	Not Started
PROJETCERTI	Not Started
QAIMS	Not Started
SIVP-VISP	Not Started
TRAVERSES	Not Started
TSCM	Not Started	Related to COVID-19 response.

Business Drivers and Timeline for TC's Journey to the Cloud