Case Study Cloud Computing

Case Study Cloud Computing

Rotterdam | Juli 2013

Robeco | Ton Ligtvoet, Manager IT Contracts and Infra Projects

For institutional investors

Facts and figures Robeco IT

•

Servicing Asset Management, Pension Solutions, Retail and Corporate

Departments;

•

Servicing around 1000 people in the Netherlands;

•

Servicing around people 200 internationally (mainly in 6 sales offices) with

a Wide Area Network and a limited number global applications (such as

Trading, CRM and Office365);

•

IT Strategy around standardization and reduction of complexity;

•

IT Strategy around reducing costs.

Robeco IT – Outsourcing and Cloud

perspective

•

Robeco is an early adopter in the financial services industry regarding IT Sourcing and

Cloud;

•

Robeco has a culture of challenging, opportunistic, entrepreneurial and pragmatic

towards IT Sourcing providers;

•

We have limited ‘own IT’:

 We have completely outsourced our infrastructure (Datacenter, WAN, Desktop, Service Desk);

 We have minimal custom developed software (mainly in Integration and End User Computing);

 We have no mainframes left at the end of 2013;

 We have multiple Cloud based (SaaS) solutions deployed.

•

Our cloud decisions are based on an extensive risk analysis based on ENISA standards,

such as:

 Policy and Organizational risks such as loss over governance, cloud service termination and lock-in;

 Technical risks such as data leakage, DDoS, Deletion of Data, Intercepting data in transit, Encryption;

 Legal risks such as licensing and data protection;

 Others risks such a network breaches and traffic, back-ups, lost of log files.

Decision for Office365

Robeco 4

• The decision for Office365 was based on 3 key strategic drivers:

 Strategic business program called You! (Bricks, Bytes and Behavior) to implement “Knowledge Sharing & Collaboration” and “Working anywhere, anytime and anyplace”;

 IT & Ops Strategy to reduce complexity, increase standardization and reduce costs;  Life Cycle Management necessity.

• The solution we have implemented includes:

 From Lotus Notes to Outlook Online for mail and calendar;

 From Lotus Notes to Sharepoint Online for docslibs and applications;  From Webex to Lync Online;

 From Blackberry to iPhone;

 From a customized intranet to Sharepoint Online ;

 And new features such as Webmail, BYOD (iPad, iPhone and Android Phone).

• As part of the decision to implement a thorough risk analysis was executed. Key

conclusions:

 Right to Audit. Mitigating measures included continued discussions with DNB and Microsoft, Extensive reviews of Microsoft’s Audits & certifications and a fast exit process from the cloud to an on premise solution;

 Deviations in Security Policy. Mitigating measures included 2 factor authentication based on RSA, ADRMS for encryption, Legal Hold features;

 Information and notifications regarding data center location. Mitigating measures included usage of Microsoft Trust Center for notifications, continuation of discussions with Microsoft and a fast exit process from the cloud to an on premise solution.

Implementation of Office365

Robeco 5

• The timeline of implementation:

• DNB Involvement:

 During the project in December 2012 DNB published their vision and guidelines towards Cloud Computing;

 As of that moment we have intensified contacts with Microsoft for contractual enhancements;  At the end of Q1 2012 we have started discussions with DNB and we have been sharing

information;

 In Q4 2012 DNB and Microsoft agreed on a Right to Examine;

 In Q4 2012 Rabobank and Microsoft have signed several contractual enhancements.

• Implementation Approach:

 Strong focus on standardization and reducing complexity. Number of group mailboxes have been reduced with 75%. Number of Lotus Notes Applications have been reduced with 75%;  Agile approach. Work with short iterations as much as possible in an infrastructure environment;  Use of Pilot groups implementing new functionality first;

1/1/2011 31/3/2011 30/06/2011 30/09/2011 31/12/2012 30/03/2012 30/06/1212 30/09/2012 31/12/2012 31/03/2013

Workspace Architecture

Decision O365 & Contracting

Workspace renewal & Infrastructure prerequisites

(AD)

Implementation & Migration Outlook Online

Implementation & Migration

Sharepoint Online Implementation & Migration _{Lync Online} Phase out Lotus Notes

Results of Office365

Robeco 6

• Support of the

Business Strategy

;

•

From an IT perspective:

• Lower costs for infrastructure, storage, licenses and operational management;

• Executed major LCM components;

• Higher availability of the mail infrastructure (including mail on smartphones);

• Better performance of the

(including mail on smartphones);

• Staying in control based on certifications provided by Microsoft;

• New alternatives for Business Continuity Management given the possibilities of

Webmail and Smartphones.

•

From an User perspective:

• Improved user satisfaction because of up to date and better known versions. Easy

to adopt for new joiners;

• Improved user satisfaction because of new and more open corporate Smartphone

support;

• Improved user satisfaction because of new features such as Webmail and Bring

Your Own Device (iPad, iPhone and Android Phone).

Lessons Learned

Robeco 7

• Execute a thorough risk analyses including Microsoft’s Decision Framework;

• Ensure involvement and commitment from Compliance, Risk Management, Legal and

Audit during the risk analysis and continue during implementation;

• Ensure commitment from Senior Management. In our case we have involved the In

Control Board and the Management Board in our decision making process;

• Involve DNB early in the process;

• Work with an external partner with extensive knowledge regarding Office365. In our case

we have worked with Avanade;

• Continue to evaluate Microsoft based on publications in its Trust Center such as ISO and

ISAE audits and certificates;

• Alignment with Rabobank for definition of Workspace architecture, contracting with

Microsoft and with discussions with DNB.