政府採購雲端服務新興模式暨資安一體考量之研析

The Analysis of New Government Procurement Method for Cloud Services and Accompanying Information Security Assurance Mechanism

張乃文

《科技法律透析》 26卷5期 (2014/05) Pp. 52-71

摘要

以「政府採購」作為導引產業升級、轉型的工具，是政府推動新興產業的重要策略之一。因應雲端運算的推動，美國由聯邦供應司採用一籃子採購協議的方式，進行「雲端電子郵件服務」、「雲端基礎架構」等資訊服務之採購，其他機關再依需求向得標廠商訂購，以使整體公部門能迅速導入所需服務。英國則有雲端商城機制，透過多次的徵求而讓多種雲端服務上架，便於機關辦理採購時得以選用。而在採購流程以外，並有配套的資訊安全管控機制，值得觀察。本文詳細介紹美、英兩國在採購新型資訊服務之策略作法，以期能作為我國的參考。

關鍵字

雲端運算 ； 資訊服務產業 ； 政府採購 ； 資訊安全 ； 驗證

並列摘要

＂Government procurement＂ as a tool to improve industry upgrading and transforming is a prominent strategy of the government to promote emerging industry. In an effort to expedite Cloud utilization progress in public sectors, foreign adavanced contries recently have tried out new method to conduct Cloud services procurement, and they would like to let entire public sectors follow the new rules to acquire Cloud services. For example, U.S. General Service Administration utilize precompeted blanket purchase agreements (BPAs) that help others agencies access to Email as a Service (EaaS) and Infrastructure as a Service (IaaS), and achieve efficiencies and savings. UK Government have initiated G-Cloud Programme and implemented ＂framework agreements＂ to request for Cloud services joining on CloudStore plateform which agencies can select Cloud services from. Besides, information security assurance mechanism accompanied is a worthy point to observe. This article introduces above experiences of Cloud procurement methods and submits suggestion for future reference.

並列關鍵字

Cloud Computing ； Information Technology Services Industry ； Government Procurement ； Information Security ； Accreditation

參考文獻

黃慧嫺(2013)。推動政府採購創新之國際實例與法制分析－以芬蘭TAKES「政府採購創新計畫」為例。科技法律透析。25(10)，29。

NIST, Special Publication 800-145 (Sep. 2011), p.2, 3, available at http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf (last visited Dec. 15, 2013).

http://cloud.cio.gov/profile/federal-cloud-computing-initiative-fcci-program-management-office (last visited Dec. 15, 2013).

OMB Guidance on Exhibits 53 and 300: Information Technology and E-Government, available at http://www.whitehouse.gov/sites/default/files/omb/assets/egov_docs/fy14_guidance_on_exhibits_53_and_300.pdf (last visited Dec. 15, 2013)

聯邦採購規則 Federal Acquisition Regulation (FAR) 8.405-3, 8.405-2(d)