Notat J.nr. 16-1828285 Questions/Answers in respect of tender procedure - Acquisition of Cloud Services (SaaS, IaaS, PaaS and FaaS) and related support services No. Date of receipt Reference Question Answer 1 3 April 2017 General question What is the detailed roadmap/timeline for roll out of Skat usage of these cloud services? The Ministry of Taxation expects to roll out usage of the Cloud Services summer 2017. 2 3 April 2017 General question When is the plan to deploy the application in to production? The Ministry of Taxation expects to deploy the first application in to production in January 2018. 3 3 April 2017 Annex 1, requirement 3 g) What do you want to achieve with FSM from driven calls and processes? What is the use case? With FSM, the Ministry of Taxation mainly seeks to simplify its FaaS and to maintain state on tasks, which may be interrupted or require user input to complete, cf. requirement 3 g) of Annex 1. 4 3 April 2017 Annex 1, requirement 6 What functionality and services do you require from DDoS protection and mitigation? The Ministry of Taxations refers to requirements 6 g) and 6 h) of the Annex 1. 5 3 April 2017 Annex 1, requirement 13 a) The requirement indicate there is a goal to obtain HA and DR, but what is the exact goals (like minimum latency), and what if the same goals can be obtained in another way? The Ministry of Taxation’s goal in this regard is to obtain high availability using more than one region in case of natural disasters etc. In case of natural disasters etc., the Ministry of Taxation requires data to be available in more than one geographic region. The requirement 13 a) of Annex 1 reflects how the Ministry of Taxation achieves this goal.
6 3 April 2017 1, requirement 13 a) If requirement is not met today, when would be the earliest date you will need full availability of this requirement? The requirement shall be complied with from the date on which the Cloud Services are to be delivered, i.e. on the date of Contract signature. 7 3 April 2017 Annex 1, requirement 13 b) What are you looking to achieve as the [bidder’s] object storage is delivered encrypted and with high security by design, so no additional backup is required to obtain off site mirroring or backup. The Ministry of Taxation is looking to achieve backups for additional redundancy outside the cloud, cf. requirement 13 b) of Annex 1. 8 4 April 2017 Contract, Clause 3, first paragraph In the first paragraph of clause 3 it is set out that the “Supplier provide the Cloud Services in accordance with this Contract and in particular the Standard Terms, cf. Annex 5, and as requested and used by the Customer at any time during the Contract.” [Bidder] assumes that the supplier is only obliged to provide the Services as agreed to and not as unilaterally determined by the customer at any time. Does Skatteministeriet agree with this assumption and, if so, would Skatteministeriet agree to the following clarification of the clause: “Supplier provide the Cloud Services in accordance with this Contract and in particular the Standard Terms, cf. Annex 5, and as agreed to by The intent of the Ministry of Taxation with the wording of Contract Clause 3 is to take into consideration that the of the Cloud services is very much dependent on the Customer’s actual usage of the respective services. If as an example a new service is introduced by the Supplier, this new service is covered by the Contract, but will not be subject to invoicing, before the Customer actively requests and uses the said service. The Ministry of Taxation’s requests and usage of the various services will at all times be in accordance with the Contract. The Ministry of Taxation finds that the current formulation reflects this appropriately and therefore maintains the wording of the first paragraph of Contract Clause 3.
Is it correctly understood that clause 3.4.2 only applies to work performed in Denmark? 11 4 April 2017 Contract, Clause 9, first paragraph Public clouds vendors cannot build their standard operating procedures to accommodate specific requirements from a particular customer. It is e.g. impossible for any public cloud vendor on the market to operate a public cloud, which normally requires several if it would require acceptance from each and any customer to engage sub-suppliers. Would Skatteministeriet, on that basis, accept to change the first paragraph of clause 9 to the following: “The Customer agrees that the Supplier is entitled to engage sub-suppliers. The Supplier will, on request from the Customer, provide a list of subsuppliers including addresses. When engaging sub-suppliers the Supplier conclude agreements with the to bind them to obligations are essentially the same as those set out in this Contract. The Customer may contact The Ministry of Taxation understands the arguments presented. The Ministry of Taxation has therefore decided to amend the wording of Contract Clause 9 to read the following: “The Supplier have the right to engage sub-suppliers, subject however to the condition, that the Supplier notifies the Customer in writing without undue delay in advance to any changes of At the Customer’s request, the Supplier shall provide relevant information about the as a minimum including company name, contact details, name of the person appointed to represent the and a description of the tasks which the sub-supplier is to perform under this Contract. Notwithstanding the Supplier’s use of a specific sub-supplier, the Customer is entitled to contact the Supplier in any and all matters. In addition, the Supplier’s use of sub-suppliers shall not relieve the Supplier of the duty to fulfil its other obligations under the Contract.
12 4 2017 Annex 3, Clause 3.1, fourth paragraph Will Skatteministeriet accept to modify the clause to the following in to specify that the purpose limitation relates to the controller’s instructions? “The Processor may not process personal data for any other purposes than instructed unless the Processor is obliged to do so under EU law or the law of a Member State. If so, the Processor shall notify the Controller of such legal obligation before commencing the processing.” The Ministry of Taxation can accept the alternative wording presented by the bidder and will the fourth paragraph of Clause 3.1 of Annex 3 accordingly. 13 4 April 2017 Annex 3, Clause 5, fourth and fifth paragraph In a cloud environment, data center visits entail operational and security challenges that the cloud vendor needs to minimize in the interest of all customers. If a cloud vendor allowed all customers rights for on-site audits it would be unmanageable and would compromise the security, integrity and confidentiality of the (other) customers. Would Skatteministeriet, on that basis, accept to change the first paragraph of clause 9 to the following: “Upon the Controller’s written request, the Processor will provide the Controller with the most recent certifications and/or summary audit report(s) The Ministry of Taxation acknowledges the concerns of the bidder in this respect. The EU General Data Protection Regulation, art. 28.3 (h), stipulates, that the processing by processor be governed by a contract, which shall stipulate, in particular, that the processor shall make available to the controller all information necessary to demonstrate compliance with the obligations laid down in GDPR art. 28 and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. In this way, the Ministry of Taxation is obligated by law to reserve the right to perform audits.