Cif white-paper-5-2012-cloud-definitions-deployment-considerations-diversity

Cloud UK
Paper five
Cloud Definitions, Deployment
Considerations & Diversity

5

© Cloud Forum IP Ltd 2012
one

Paper five Cloud Definitions, Deployment Considerations & Diversity

Introduction
The furore surrounding the opportunity of Cloud Computing shows no signs of abating in
the near future, at least in the UK. Adoption remains healthy, both in terms of the number
of new user organisations as well as increased penetration by existing users. Furthermore,
the satisfaction of end users with the benefits achieved through adopting Cloud services
appears to be extremely high with 96 per cent of the research base surveyed by the Cloud
Industry Forum confirming satisfaction with their experiences to date.

Equally, there is some passionate commentary on the perceived risks with this latest
evolutionary step for the delivery of IT. Fear, Uncertainty and Doubt (FUD) are regularly
pedalled in regard to perceived issues around the management of IT from a third party
hosted environment. Be they issues of data security, legal jurisdiction or dependence upon
poor internet connectivity, the list of negatives are arguably as numerous and the range of
commentators as voluminous as those in the pro camp.

When looking at Cloud Computing as a disruptive solution though, it is essential that we
see it not as just an issue of pure technology, but one of business process change, supply
chain change, project management and IT delivery change. When you view it this way it is
no surprise that the passions are raised and the camps formed. Cloud services represent
the most significant opportunity to improve the way IT is conceived, built, delivered and
managed, it re-writes the boundaries of how IT is orchestrated to serve an organisations
needs, reshapes the skills needed within consuming organisations and realigns channels for
the delivery of solutions. However, the market is still young, and the level of adoption, whilst
growing quickly is still a fraction of the market that is satisfied on-premise. Throughout 2011
we have seen the barriers to adoption of Cloud services fall dramatically and we have seen Cloud services
the market for supply attempt to reshape itself to meet the future demand that is expected. represent
As the market is arguably still nascent, the number of new entrants moving into the market
is driving a level of divergence as each aims to get its value proposition communicated. the most
This noise is one of the key issues the Cloud Industry Forum is committed to providing significant
guidance on by providing clarity on Best Practice for Cloud service delivery, and by sharing
understanding of the key matters to be considered when adopting Cloud services through opportunity
initiatives like its certified Cloud Service Provider Code of Practice, research activity and to improve
educational White Papers.
the way IT is
In this White Paper we set out to provide clarity on the language of Cloud Computing, to conceived,
offer a practical description and ordering of the key Cloud terminology in use. We also put
forward the basic, but often unspoken, argument that organisations will need to address an
built, delivered
increasingly fragmented notion of how IT is delivered going forward. The constraints of server and managed
rooms, DMZ’s, ownership and dedicated resources are giving way to shared services, scalable
infrastructure, on-demand service and consumption based OpEx costs. Consumerisation
and contextualisation of technology changes the basis of expectation for IT delivery, and
capability and capacity of IT assets are no longer constraints. However, the real world impact
of legacy applications, regulation, levels of customisation/integration of applications etc do
call into check how IT services can be deployed.

This paper does not set out to state that Cloud Computing will replace on-premise
computing, far from it. It sets out to recognise that organisations need to reconsider their
approach to IT strategy, that the benefits afforded from accessing aspects of IT as a Service
are tangible and therefore new skills need to be honed inside organisations to define,
implement, monitor and manage IT in an increasing disparate set of delivery models that will
combine the best of on-premise and Cloud Computing, whether the latter is accessed via
SaaS style applications or through Private or Hybrid Clouds extending the boundaries of the
traditional IT infrastructure and enabling business transformation.

two

Paper five Cloud Definitions, Deployment Considerations & Diversity

Methodology and sampling
In October 2011, Vanson Bourne conducted a second body of research on behalf of the
Cloud Industry Forum to determine the level of Cloud adoption among participants and to
gather attitudes and trends about end user perception and experience.
The
The research polled 300 senior IT and business decision-makers in enterprises, small-to- organisations
medium businesses (SMBs) and public sector organisations. The organisations participating
all had UK based operations, of which 257 were headquartered in the UK, 24 in the US and 12 participating
in Continental Europe. all had
Of the 300 end user organisations questioned, 32 per cent came from the IT and technology UK based
sector, 10 per cent from business and professional services, 8 per cent manufacturing and operations,
financial services and 5 per cent from retail and logistics. A further 33 per cent comprised
of public sector organisations ranging from central and local government, education and of which
healthcare. 257 were
38 per cent of participating organisations were plc’s, 32 per cent public sector, 11 per cent Ltd, headquartered
8 per cent LLC, 6 per cent NFP and 2 per cent partnerships (3 per cent cited other). in the UK, 24 in
This White Paper sets out to define Cloud Computing and explores the factors impacting the US and 12
decision making for IT deployments that subsequently give rise to the diversity of in Continental
deployment and service options in the market. Building upon this baseline the paper sets out
why multiple deployment and/or service models can (and probably will) co-exist in any given Europe
organisation over time.

In which sector does your organisation primarily operate? ■ IT and technology
■ Education
0% ■ Business/professional services
■ Manufacturing
Total 2% 1% ■ Financial services
1%
■ Retail, distribution and transport
5% 6% ■ ocal or central government
L
7%
8% 32% ■ ublic sector: including armed forces
P
and emergency services
8%
■ ublic healthcare and services
P
8% ■ rivate healthcare and services
P
14%
10%94% ■ onstruction and property
C
■ tilities and telecommunications
U
■ harity/not for profit
C
■ ntertainment, media and leisure
E
■ ospitality/catering
H
Sample: 300 ■ ther
O

three

Paper five Cloud Definitions, Deployment Considerations Diversity

1. Cloud defined:
1.1 What is Cloud Computing?
There have been many definitions of Cloud Computing since the phrase was Is virtualisation really Cloud
first coined back in the 1990s and it has to an extent become an umbrella Computing by another name?
phrase for remotely hosted IT services of any type including, but not limited Virtualisation is a technical
to, multi-tenanted services accessed via the internet. However, organisations capability that enables a
like the US National Institute of Standards and Technology (NIST) have taken physical server to act as if it
a more formal and specific approach to define what is unique to the context is several ‘virtual’ servers at
of Cloud Computing (see Special Publication 800-145) and the following the same time; increasing the
definition is put forward by the Cloud Industry Forum as a synopsis of the utilisation of the hardware
manifold definitions offered in the market: and reducing companies need
to invest in hardware and
Cloud Computing is a term that relates to the IT infrastructure associated power and floor
and environment required to develop/host/run IT services and space. Virtualisation is not in
applications, on demand, with consumption based pricing, as a and of itself a Cloud capability
resilient service. Communicating over the internet and requiring as it still works within the
little or no client end components it provides resource and services constraints of the physical
to store data and run applications, from many devices, anytime, hardware in which it operates.
anywhere, as a service. The services can in turn be scaled up and
down as needed to meet a customer’s variable operational needs, Is Grid computing really Cloud
ensuring maximum cost efficiency. Computing by another name?

What are the common capabilities of Cloud Computing that set it apart from Grid computing is the
other IT delivery models? name given to the action of
combining loosely coupled
Availability: Cloud is delivered on-demand: computer resources and
A user can chose to provision computing capabilities, such as storage, applying them to perform a
processing, network and memory, (or an application) as needed substantial common or specific
automatically without requiring human interaction with the service provider. task. It usually relates to a
notion of a distributed system
Flexibility: Cloud is agile and scalable: with non-interactive workloads
The amount of resource consumed by the user can be increased or as opposed to the orchestration
decreased to meet their operational needs. This is often referred to as being of complete IT services.
an elastic service, though many solutions require a human act or contractual
obligation to facilitate the change of state. As such the capabilities available
for provisioning can appear to be unlimited and available in any quantity Is Utility computing just Cloud
and at any time. At a Service Provider level, resources are pooled to meet Computing by another name?
demand and the technology enables applications to span multiple physical Utility computing refers to
and/or virtual assets seamlessly. ability to access elements
of computing such as
Chargeability: Cloud is based on consumption based commercial models: storage, ram and processors
In other words, a user will only pay for the services they use and this can as a consumption based
include the capability to access IT services on a pay-as-you-go model or chargeable service (similar to
to pre-purchase contractual volumes to access more attractive unit rates electricity, phone calls etc). To
(similar to mobile phone voice and data tariffs). Resources used should be an extent the philosophy of
able to be monitored, managed, and reported on via the Service Provider to utility computing is a subset of
validate the costs incurred. This commercial model opens up accessibility to the Cloud Computing model.
users and organisations of all sizes.

Accessibility: Cloud is accessible anywhere (there is internet access):
As services are delivered over the Internet and normally accessed through
standard web based interfaces, Users are typically able to connect to
Cloud services (via fixed or mobile communications) using PC’s, Laptops,
workstations, tablets or mobile phones, thereby increasing the flexibility of Cloud Taxonomy
using IT in new and portable media.
Order: Cloud

1.2 Is there one Cloud? Family/s: Service
Deployment
In short – No! The phrase ‘Cloud’ should be considered in a similar context
to that of a biological taxonomy of an ‘Order’ under which a number of Genus: e.g. SaaS
‘Families’, ‘Genus’ and ‘Species’ exist and continue to evolve. Following this e.g. Public
metaphor there are two key Families that exist in the Cloud ‘Order’, those
that relate to how Cloud is commercially delivered (the Service Delivery Species: e.g. DaaS
Models), and those that relate to how the Cloud is technically deployed (the
Cloud Deployment Models).

four


1.2.1 Cloud Service Delivery Models:
There are three primary business or commercial models (Genus) for the delivery of Cloud
services:
SaaS (software-as-a-service) refers to software or applications that are accessed over the
internet (typically from a public Cloud, multi-tenancy (or shared) environment as a fully
managed service). Unlike desktop applications, SaaS apps require no installation as they
connect via the internet. Salesforce.com, Microsoft Office365 are popular examples of a
service based in the Cloud. Typically solutions are priced per user accessing them and
licensing is the responsibility of the service provider.
Organisations
IaaS (infrastructure-as-a-service) delivers computing infrastructure on-demand – such as
RAM, storage and processors typically as virtual servers along with networking capabilities to will not move
effectively provide a hosted data centre or server on demand upon which business can run their business
their applications. This is computing as a service, rather than businesses having to purchase
and manage their own expensive infrastructure. As with most Cloud services it can be scaled wholly away
up and down and customers usually only pay for what they consume. Applications may be from an on-
licensed via some service providers but the accountability for licensing and management of
the solution remains with the end user unless subcontracted to a partner. premise
PaaS (platfrom-as-a-service) offers a level of abstraction above IaaS where by the
capability,
management of infrastructure is automated and effectively hidden from the user. It especially
often refers to the environment within which developers can build and launch new
applications as it simplifies this activity. Well known Cloud platforms include Microsoft
where they
Azure, Amazon EC2, and Force.com have legacy
Whilst the above relate to the standard Service Delivery models, returning to the notion IT solutions to
of ‘evolution’, a lot of marketing activity has led to the context of there being an accepted
wisdom of XaaS (whereby X may relate to IT elements or solutions such as Database,
manage
Storage, etc). Whilst this is not truly an introduction of new ‘Genus’, the notion of a
Database being a type or ‘species’ of SaaS or IaaS is viable and has become accepted
language in many circles.

1.2.2 loud Deployment Models:
C
Typically organisations will not move their business wholly away from an on-premise
capability, especially where they have legacy IT solutions to manage, complex integrations
and regulatory environments where data sovereignty may be an issue. As such many
organisations select multiple deployment models depending on the application, size and
complexity of business etc. Organisations will combine the following as needed:
Public Cloud:
Public Clouds are intended to be used by multiple parties at once and are designed to
provide maximum value for money through a standardised and hi-scale approach on
shared infrastructure. Public Cloud is the most logical deployment model for delivering
SaaS. Many public Clouds operate internationally for scale or geographic resilience, but this
gives rise to some concerns for some businesses over where their data is being stored at
any particular point in time which may prefer a Private or Hybrid Cloud approach.
Private Cloud:
Private Clouds are intended to be restricted to a single customer or trusted community.
However, dedicated components can vary between providers beyond storage, processing
and RAM to include the network security and hypervisor elements. These are popular
among organisations looking to access the benefits of Cloud Computing but retain higher
control and flexibility of configuration compared to a public Cloud. Private Clouds can be
run inside a company data centre or be hosted by a third party. IaaS is a delivery model
best associated with Private Clouds where data sovereignty is a key issue.
Hybrid Cloud:
A Hybrid Cloud as the name infers is a Cloud capability that joins either private and/or
public Clouds, or on-premise infrastructure to private/public Clouds in order to provide a
customer or community with an appropriate or even bespoke environment to meet their
specific operational needs.
Again there have been a number of market evolutions and naming conventions introduced
to further segment these deployment models such as the UK Government approach to G-
Cloud (the Government Cloud which is still in definition) or Community Clouds that could
arguably both be types or ‘species’ of a Hybrid Cloud genus.

five


2. Internal diversity in IT solution deployment
When approaching the subject of adopting Cloud services, organisations tend to focus
on the primary aspects of both the benefits they can achieve and the risks they seek to
mitigate. This White Paper does not revert back to these subjects as they are adequately
covered in White Papers three and four, rather we focus in this paper on the drivers and
influencers that impact upon how an IT solution should best be deployed. As stated
in section one, there is no singular Cloud, and even beyond the notion of Service and
Deployment Models there are vendor specific flavours of these models to add to the
complexity of choice.

The Cloud Industry Forum advocates adoption of Cloud services and has clearly evidenced Whilst cost
that satisfaction levels with these solutions are running at an unprecedented 96 per cent in savings are
the UK random sample we canvassed. However, it is still important that each and every IT
project is subject to some basic tests to determine pragmatically what is the best or most not the initial
viable option/s for deploying any given solution, and we fully respect that in some cases this driver of Cloud
will be on-premise, in some cases outsourced, some hosted and some in the Cloud.
adoption
When assessing IT projects there are a number of factors that will impact choice of (flexibility and
deployment which we would broadly describe as legacy considerations, commercial matters,
technical requirements and governance or policy constraints. agility are), it is
clearly evident
2.1 Legacy drivers and influencers that most
It will be little surprise that 89 per cent of organisations surveyed had an in-house server organisations
room, although this dropped to 73 per cent for those employing less than 20 people. achieve a
The combination of committed capital and potential of available labour supporting it
has to be assessed to determine if a new solution is most effectively housed on premise. financial
Equally, if an organisation is considering expanding a legacy or bespoke application, or benefit for
creating an integration with such a system from a new application (e.g. a new workflow
service for an existing order management system), then the level of integration or the adopting
nature of the legacy application may restrict choice of deployment options, to being on- Cloud based
premise or hosted in a private Cloud or dedicated infrastructure.
services
One less tangible issue many organisations have to face is how to manage IT in an
increasingly distributed environment. This can lead to a sense of loss of control, based
on inexperience or insufficient tools, but of itself should not be the determinant of
choosing on-premise over Cloud or hosted services.

2.2 Commercial drivers and influencers
Surprisingly, available network bandwidth to access the internet was not as high a
practical issue as we suspected. Indeed 80 per cent of organisations (across all size
ranges) already had sufficient bandwidth for normal business tasks at a contracted rate
of 10Mbit/s or greater. Equally, it was not a practical inhibitor of Cloud adoption. That
said some intensive tasks like CAD are clearly not best suited to Cloud models unless
served in a full remote desktop environment. The service provider industry has made
significant steps forward in overcoming bandwidth constraints by offering bulk data
load services at commencement and end of contracts to restrict the use of the internet
to handling purely delta changes to the data stored.

Whilst cost savings are not the initial driver of Cloud adoption (flexibility and agility
are), it is clearly evident that most organisations achieve a financial benefit for adopting
Cloud based services. As such, and assuming no restrictions arising from sections 2.1, 2.3
and 2.4, public Cloud/SaaS usually offers the best value for money where organisational
needs are not unique. Equally the whole concept of delivering IT as a service enables
organisations to plan costs fairly accurately to ensure they are predictable and avoid
surprises and constraints that can occur with managing on-premise solutions.

Other commercial considerations, organisations have to take into account are matters
such as the urgency of the solution (i.e. Time to Market) where a hosted or Cloud
solution has clear advantages for urgent or temporary projects, balanced against
contributing considerations of available experienced staff in the solution area and/or the
ability to identify a trusted partner for delivery via the Cloud. Building trust is a key issue
in expanding IT operations outside the traditional DMZ and is the primary justification
for the Cloud Industry Forum’s Code of Practice for CSP’s.

six


2.3 Technical drivers and influencers
The technical considerations need to start at the planning and strategy phase. CIF’s
research identified that 85 per cent of organisations now formally include consideration
ofCloud based solutions within their IT strategy, which is very positive as this number
is some 32 per cent above the actual number of organisations that have adopted at
least one Cloud service formally. This level of strategic engagement demonstrates that
there is significant room for growth not just in terms of new Cloud users but increased
penetration within organisations for multiple solutions.

As discussed the technical delivery team inside any organisation is going to have look
at initiatives based on attributes such as their temporality/duration, urgency (time to
market), frequency in changes of scale in operations, skills and manpower requirements
etc in order to determine if a solution can be delivered in-house or should be delivered
as a service. Other criteria will apply when considering issues such as Test or Back-Up/
Disaster Recovery solutions where arguably an off-site presence is more appropriate to
reflect and mitigate the real world risks.

Integration requirements between applications as well as the nature of the application
(data sensitivity) and its degree of customisation are also key considerations as to how
best to deploy. By nature, higher levels of integration, configuration and uniqueness of
applications favour a private or hybrid Cloud environment, hosted servers or on-premise
over a public Cloud or SaaS service where a more generic solution would be provided.

Finally, for smaller organisations where SLA’s are critical, it is possible that an
organisation may need the added assurances of service availability though a hosted or
Cloud service to provide 24x7 cover for the system being used and, therefore, ensure a
higher availability than could practically be achieved (cost effectively at least) in house.

2.4 Policy drivers and influencers
Over-riding all commercial and technical considerations are the Governance, Policy and
Regulatory constraints that the organisation must take into account.

Top of this list will relate to issues of external regulation and notably around matters Integration
such as Data Sovereignty. 42 per cent of organisations participating in the research requirements
stated they were subject to external regulation, 12 per cent were subsidiaries of
organisations that were headquartered internationally. Certain verticals such as Finance, between
Heathcare and Professional Services had a clear focus on this issue relating to certain applications
applications and types of data. Equally there remains considerable legal uncertainty
and a lack of any case law to substantiate some of the fears around data location but as well as the
in any event, companies can still embrace the Cloud though use of IaaS and SaaS in nature of the
typically private or Hybrid Cloud environments where data location can be guaranteed.
Interestingly, a lot of the concerns expressed around data location stem from concerns application and
over security more than regulation and re-emphasise the need for Cloud Service its degree of
Providers demonstrating and establishing trust with their customers and prospects. In
the survey 90 per cent of respondents wanted their data kept on-premise or hosted in customisation
the UK and not held within the wider EEA or other geographies. are also key
considerations
as to how best
to deploy

seven


2.5 One person’s SaaS opportunity is another’s on-premise requirement
There are a number of considerations that when assessed will help shape the options as to
how a new IT project should be deployed. The important thing to remember is that only the
customer can make the assessment (with the help of advisors) as no external company can
adequately know all the legacy, commercial, technical and governance constraints.

Equally, by way of example, where email may be delivered appropriately as a public Cloud
or SaaS solution for one company in one industry, in another vertical, it may have to be
provided in a private Cloud or on-premise capability to meet regulatory requirements. The
table below gives a snapshot of the organisations participating in the research in terms of
how they currently deploy different types of IT solutions, and clearly evidences the diversity.

Application Deployment Model choices

Asked of respondents who use hosting or
Cloud-based services (respondents only saw Hosted Managed
applications that they currently use) SaaS IaaS server server Outsourced In-house

Accounting and Finance Applications 7% 0% 12% 8% 6% 67%
Advertising and Online Marketing Services 13% 4% 27% 10% 10% 35%
IT Asset Management Services 8% 5% 18% 9% 3% 57%
IT Operations Management 7% 1% 13% 23% 5% 51%
Data Backup/Disaster Recovery Services 6% 3% 15% 14% 9% 52%
Data Storage Services 7% 6% 19% 11% 13% 44%
Email Services 6% 4% 19% 21% 10% 39%
Collaboration Services 20% 2% 5% 18% 5% 40%
Unified Communications 7% 5% 23% 16% 2% 48%
Office Automation/Productivity 2% 3% 19% 12% 2% 63%
Portal Services 6% 10% 24% 16% 12% 33%
Workflow Systems 8% 4% 14% 8% 4% 62%
Niche Vertical Applications 0% 0% 25% 0% 0% 75%
Infrastructure-as-a-Service 14% 0% 18% 23% 5% 41%
Managed IT Services 9% 3% 15% 25% 14% 35%
IT Security Services 6% 1% 18% 16% 10% 48%
Service Management/Help Desk Services 6% 2% 15% 20% 2% 56%
eShop Services 18% 6% 29% 18% 18% 12%
Webhosting 9% 2% 26% 27% 19% 17%
Personnel and Payroll 4% 0% 10% 15% 8% 63%
CRM 12% 1% 12% 7% 10% 58%
Partner Relationship Management 14% 7% 21% 0% 7% 50%
Sales Management 16% 0% 13% 6% 6% 58%
Other 0% 0% 0% 0% 0% 100%
Base 160 160 160 160 160 160

This spread of options leads on to the obvious conclusion that in any one organisation
based on the different application areas and operational needs, they are likely, over
time, to have a combination of on-premise, hosted, SaaS and Private/Hybrid Cloud
solutions. In fact, this is likely to become the norm and therefore a key issue in future
IT strategy has got to be in demonstrating good governance of IT across a broad
distributed network and variety of managed and unmanaged deployment options. As
such, controls, end-to-end monitoring, alerting, reporting and transparency are going to
be key to effective IT operations to ensure that in driving up efficiency and driving down
costs, that new risks are not created due to lack of skills or tools to manage the new
order of IT services.

eight


3. Delivering the Cloud on your terms
In an IT market offering both increased choice and flexibility, a key consideration for any
organisation is how best to deploy and deliver any given IT solution or project. Just how
should an organisation approach the subject of adopting Cloud services? What would be
the best fit in terms of a deployment or service model? And, can they achieve that within
the constraints they have to operate? In other words can any organisation truly adopt
Cloud services on the terms that are relevant for them?

Without doubt, Cloud and on-premise solutions will need to co-exist alongside each other
in most organisations over the coming years as there is no practical incarnation of a one-
size-fits-all Cloud solution upon which an organisation would likely base its entire IT strategy.
Cloud services adoption is not standardised or even polarised today, and the wider concept
of IT solution deployment is multi-faceted, driven by practical considerations such as:

● Organisational size and IT maturity – e.g. what skills are in house and what capability to
implement and operate IT services exist?

● Nature of the Application/Solution – e.g. new solution areas and fixed life projects are
far more likely to be hosted /provided as a service.

● Exiting Investment – i.e. organisations wish to maximise the life and value of investments Cloud and
already made in technology (e.g. server rooms) and software licensing. on-premise
● Data Sovereignty – e.g. concerns over regulatory, legal jurisdiction and perceived solutions
security fears restrict the nature of how some organisations adopt Cloud solutions. will need
● C
onnectivity – i.e. accessing high speed internet is still not a given in many parts of the to co-exist
UK and the wider world. Bandwidth constraints can constrain perception of suitability alongside each
for Cloud or hosted services.
other in most
As already commented, it is encouraging to see that 85 per cent of organisations that organisations
participated in the survey already formally include consideration of Cloud services as a viable
option when deciding on delivery of new projects, whether or not they already make use of over the
Cloud based solutions. The fact that this preparedness is ahead of actual Cloud adoption coming years
in the UK (currently 53 per cent) reflects a healthy openness to improve process and
effectiveness of solutions is being established.

One of the biggest challenges organisations face in adopting Cloud or other hosted services
is to determine the appropriate Deployment and/or Service Model. As set out in section two
a balance has to be struck between the level of complexity of the solution and the need for
delivery as a service.

Relationship between complexity and service delivery options

Generic
Public
Cloud/SaaS
complexity

Private
Solution

Cloud/IaaS
Hybrid
Cloud

Hosted

Managed
Co-location Outsourced
On-premise Services
Bespoke
In-house Outsourced
Delivery as a service

Technically enabled options Commercially enabled options

nine


3.1 Mapping key criteria to deployment outcomes
In order to determine which options for deployment of an IT solution are most optimal
for any given organisation/application it is essential that a practical and efficient
assessment of risks or key choice criteria is undertaken to establish a common sense
check on viable deployment options. For example a UK based company operating in the
retail sector may consider projects as follows:

Example of criteria impacting Cloud solution choice

Project Sensitivity Criteria: Accounting System Stock System Admin Productivity Suite

External Regulation Moderate Low Low
Local Jurisdiction High Medium Low
DC Location sensitivity High Medium Medium
Service Level requirement Medium High Medium
Security Level required High Medium Medium
Uniqueness of Application Low High Low
Integration with Other Apps High High Medium
Low Cost Delivery requirement Medium Medium High
Elasticity/Variability Low High Low
Project Length Low Low Low
Legacy Investment impact Low High Low
Skill set required Medium Medium Low
Resource available in-house Low High Low

Private/Hybrid Private/Hybrid SaaS or Public Cloud
or on-premise or on-premise due to generic
in seeking UK service due to levels of needs/low cost
custom/integration

In reality, the degree of sensitivity impacting a company based upon their industry
vertical, international presence, age of organisation and in-house experience will require
more thorough assessment than the rudimentary example given, but the principle here No two
is to demonstrate that no two companies are the same and no two projects inside any companies
given company are the same and as such assessment criteria need to mature to enable
a rational decisions to be made. are the same
and no two
projects inside
any given
company are
the same

ten


3.2 Governance, risk and compliance in the Cloud
Cloud is highly attractive in terms of commercial concept but the underlying
implications require a more comprehensive approach to IT GRC assurance for most
organisations that are primarily operating with an on-premise capability today. A
number of risks need to be reconsidered in light of adoption of Cloud services, and
whilst none are unreasonable or unmanageable, it is essential organisations actively
assess, prepare for and execute changes to IT GRC policy. Of particular note are the
changes that will likely occur in the areas of:

● S
ocio-Technical trends: To what degree is consumerisation and social media policy
relevant and covered effectively in employment policy, Acceptable Use Policy etc?

● Temporality Elasticity: Is appropriate control and management of computing
resources and subsequent retirement of assets or services properly governed in a
virtual and elastic environment?

● Containing IT Sprawl: How is procurement managed and approved in a world where
a credit card can enable new IT application use? How is IT managed as an overall
strategy through multiple deployment models?

● Data Management: What are the organisations obligations in regard to data
security, privacy, protection and sovereignty? Who is accountable and how is policy
assurance achieved in partnership with third parties who deliver elements of the IT
operations?

● Contracting SLA’s: If using a third party, is the agreement covering end-2-end
service delivery, under which legal jurisdiction is it written and with what clarity on
responsibility and liabilities of the relevant parties in regard to the set-up, ongoing
operations and subsequent exit/end?

It is essential
3.3 Monitoring and management of distributed IT
that end user
There is an age old piece of common sense advice which is worthy of reiteration. “If
you can’t monitor it, you can’t manage it”. This is relevant whether you are running
organisations
all your IT operations on-premise, all in the Cloud, or more likely a combination of establish clear
these along with potential use of co-location, hosted or managed services. When
embarking on a third party services arrangement for the delivery of an IT capability it
service level
is essential that end user organisations establish clear service level expectations, define expectations,
appropriate monitoring, set alerting thresholds and agree reporting requirements.
Whilst accountability for delivery of the services may be passed to a third party that
define
does not negate the organisations need to manage service delivery and ensure efficient appropriate
operations and effective issue resolution or Disaster Recovery. This is the subject of
White Paper seven due to be published in the Spring of 2012.
monitoring,
set alerting
thresholds
and agree
reporting
requirements

eleven


Conclusion
Cloud Computing has become established within the vocabulary of the IT profession, but
concerted effort to clarify and educate the wider market on key terms, definitions and
implications are needed to achieve a common understanding of the meaning, opportunities
and the risks associated with this rapidly growing sector of the market.

1. project/solution deployment options are increasingly flexible and diverse creating both a
IT
commercial opportunity and an IT management challenge.

2. Cloud should be considered a complementary solution option in many IT strategies, not a
wholesale replacement for on-premise computing.

3. There is no nirvana Cloud solution that meets all organisational needs today. Rather
organisations will typically find themselves managing a portfolio of deployment options at
any given time from on-premise through to co-location, hosted services, managed services
and Cloud solutions.

4. Cloud Computing should be assessed more in terms of organisational enablement and
impact rather than in terms of technological change.

5. Cloud is best defined in terms of service delivery models (SaaS, PaaS and IaaS) and
technical deployment models (Private, Public and Hybrid).

6. The choice of Service and/or Deployment Models for a specific Cloud solution will be
influenced by a combination of technical, commercial, governance and legacy investment
factors. The choice of Service/Deployment Model for a specific solution in one company
may not be true for an organisation of similar size in another industry. Individuals
accountable
7. Legal and Regulatory factors drive considerable uncertainty especially in regard to matters
relating to Data Sovereignty and Security. Where relevant, this tends to encourage end for IT Strategy
users to seek the lowest risk deployment, which in the case of this research was to prefer should
UK hosted data.
ensure they
8. per cent of organisations actively consider the option of Cloud services to assess viability
85 update their
for new projects. Individuals accountable for IT Strategy should ensure they update their
assessment criteria to enable a practical determination of which deployment options are assessment
valid for any given IT project. criteria to
9. Governance needs to embrace the notion of services delivered on-premise and those
IT enable a
delivered remotely, and where relevant the integration in between. IT departments need to practical
determine the criteria to be complied with for monitoring, alerting and reporting for remote
services. Appropriate tools and responsibilities need to be implemented to enable effective determination
management of the distributed IT operations as a whole. of which
deployment
options are
valid for
any given IT
project

twelve

The Cloud Industry Forum (CIF) was established
in direct response to the evolving supply models for
the delivery of software and IT services. Our aim is
to provide much needed clarity for end users when
assessing and selecting Cloud Service Providers based
upon the clear, consistent and relevant provision of key
information about the organisation/s, their capabilities
and operational commitments.
We achieve this through a process of self-certification
of vendors to a Cloud Service Provider Code of Practice
requiring executive commitment and operational
actions to ensure the provision of critical information
through the contracting process. This Code of Practice,
and the use of the related Certification Mark on
participant’s websites, is intended to provide comfort
and promote trust to businesses and individuals
wishing to leverage the commercial, financial and
agile operations capabilities that the Cloud based and
hosted solutions can cover.

The Cloud Industry Forum
Sword House, Totteridge Road
High Wycombe HP13 6DG
t 0844 583 2521
e info@cloudindustryforum.org
www.cloudindustryforum.org

one

Cif white-paper-5-2012-cloud-definitions-deployment-considerations-diversity

Recommended

Recommended

More Related Content

What's hot

What's hot (18)

Similar to Cif white-paper-5-2012-cloud-definitions-deployment-considerations-diversity

Similar to Cif white-paper-5-2012-cloud-definitions-deployment-considerations-diversity (20)

Cif white-paper-5-2012-cloud-definitions-deployment-considerations-diversity