The document discusses the evolving landscape of cloud computing, highlighting its characteristics and the significant shift in IT budgets towards cloud services, despite existing concerns around security, reliability, and governance. It emphasizes the need for enterprises to adopt a new operating model and respond competitively amidst these changes, while recommending actions for both enterprises and cloud service providers to enhance trust and clarity. Cloud computing is portrayed as a natural evolution with the potential for growth, although challenges related to maturity and service confidence persist.

1. © Copyright 2009. Yankee Group Research, Inc. All rights reserved. www.yankeegroup.com Pinning Down Cloud Computing Agatha Poon Senior Analyst Camille Mendler Vice President September 29, 2009

2. Agenda What is cloud computing? Who is investing? Why it’s immature How you need to respond

3. Enterprise IT needs a new operating model Capacity management is more challenging than ever. Businesses are striving to execute green initiatives. Distributed enterprises drive a collaborative culture. Line-of-business executives want better control over IT. Speed to market remains a top business priority.

4. Poll 1 To connect the dots of many clouds, what should come first?

5. Cloud computing may provide an answer But make no mistake, cloud services are still evolving.

6. Cloud computing: Key characteristics Characteristics Pay as you go Scalable Instant provisioning Virtualized information Multi-tenanted Service-level agreements Dynamically scalable virtualized information services delivered on-demand over the Internet

7. Cloud computing: Welcome to another stack Software as a Service (SaaS) Platform as a Service (PaaS) Infrastructure as a Service (IaaS) Security and Compliance Virtualization layer Further reading: “Pinning Down Cloud,” Aug. 2009 Pool of computing resources (servers, storage) helps IT and developers to scale computing and storage requirements in real-time on a per-usage basis (e.g., Amazon, GoGrid, AT&T Synaptic Hosting, Verizon Business CaaS, Rackspace) Middle layer provides key management tools to deploy cloud-based apps and facilitates platform integration (e.g., Force.com, Microsoft’s Azure, LongJump, Elastra, rPath, RightScale). Application layer offers productivity, collaboration and business applications on a subscription basis (e.g., Salesforce, NetSuite, IBM LotusLive, Google Apps, Workday, SugarCRM).

8. What’s in it for enterprises? Source: Yankee Group Anywhere Enterprise--Large: 2009 U.S. Transforming Infrastructure and Transforming Applications Survey, Wave 1-6

9. Status check: IT budget is shifting to the cloud Next 12 months Next 24 months A third to a half of IT budget spent on cloud services Source: Yankee Group Anywhere Enterprise: 2009 U.S. Transforming Infrastructure and Transforming Applications Survey, Wave 1-6, Large and SMB 8% of enterprises 8% of SMBs 16% of enterprises 16% of SMBs 91% of enterprises 84% of SMBs 75% of enterprises 67% of SMBs More than half of IT budget spent on cloud services 2% of enterprises 7% of SMBs 9% of enterprises 17% of SMBs Less than a third of IT budget spent on cloud services Note: Numbers are rounded

10. No longer hype – but concerns still exist Top 3 barriers to uptake: Security (39%) Reliability (35%) IT governance (33%) Opinion varies by vertical: Healthcare is very positive about transformational benefits. Manufacturing is most concerned about maturity. Finance is most likely to highlight marketing hype. Source: Yankee Group Anywhere Enterprise--Large: 2009 U.S. Transforming Infrastructure and Transforming Applications Survey, Wave 1-6 Cloud Computing: Enterprise Perceptions

11. Poll 2 From a regulatory standpoint, who do you work with to secure your cloud?

12. The cloud community needs to grow up Common Tendencies Cliquey Squabbles about service definitions and standards Geek-led Focuses on tech, not customers Immature Lacks consistency of process Common Failings Transparency Trust Professionalism Yankee Group’s review of contracts, SLAs and privacy terms of SaaS, IaaS and PaaS providers indicates much work is needed.

13. ‘As is’: Cloud contractual risk is yours to bear GoGrid (IaaS) Offers “10,000% SLA” (e. g., failure of 15 minutes will result in 1,500-minute or 25-hour service credit). The small print: “The maximum credit during a single calendar year, for all Service features combined, is two months' Service fees, regardless of the length of Failure or the number of occurrences.” Risks involved in using cloud services could outweigh their benefits. Salesboom (SaaS) CRM and ERP The small print: “Salesboom.com shall not be liable for […] damages of any kind whatsoever, […] regardless of any party's negligence.” Boomi AtomSphere (PaaS) Scheduled maintenance is excluded from its 99.99% uptime SLA calculation. The small print: “Boomi further reserves the right to schedule additional Scheduled Maintenance on an emergency basis on twelve (12) hours’ notice, for not more than eight hours at a time.”

14. Sweating the details is important By what definition? Instance / app or whole cloud uptime SLA? Compliance to which jurisdiction? Independent or in-house? Live or periodic? Who’s responsible for backups? Clue: It’s probably you. What will it cost? How much time until data is deleted? Excluded from uptime calculation? What notice is given? Cash or credit? Is there a payout cap? Deadline to claim? What limits in scope and payout are asserted? Maintenance Penalties Privacy and data protection Performance monitoring Data backup Cost of migration Limitation of liability Uptime / Availability

15. Governance, compliance and risk issues loom It’s not about obtaining five 9s in cloud services. Not everyone needs this. It’s about verifiable assurance. Enterprises – particularly large ones – require clarity about exposure to risk. Investment will be needed. Cloud service providers need to get wise about ICT procurement practices. Further reading: “Regulation Meets the Cloud,” Sept. 2009

16. Securing and monitoring clouds: Who can assist? A crowded landscape of enabling cloud ecosystem vendors Opportunities exist to secure, test, monitor, federate and orchestrate disparate cloud assets – for enterprises and cloud service providers. Computer Associates IBM Hyperic CloudStatus InfoVista Keynote Systems Nimsoft TrustSaaS Performance Monitoring Blue Coat Cisco Riverbed IT Infrastructure Optimization Digital Fuel Sensible Cloud SLA Management Cloud Computing Interoperability Forum [email_address] Standards Canonical Pink Elephant Red Hat SOASTA Test / Certification

17. Trusted intermediaries are needed, not cloud supermarkets Source: Yankee Group and HP Labs, 2009 Hot swaps between providers using business rules for cost and performance A role for telecom operators to be prime contractors for intercloud services?

18. Poll 3 Which type of provider is best positioned to be the trusted intermediary for cloud services?

19. By default, private clouds may prevail Source: Yankee Group Anywhere Enterprise--Large: 2009 U.S. Transforming Infrastructure and Transforming Applications Survey, Wave 1-6 More than half of large enterprises prefer private clouds. SMBs are not far behind in preferring private clouds (47%). Public clouds attract only 8% of large enterprises, and 20% of SMBs. Cloud intermediary services could shift preferences

20. Conclusions Cloud computing is not hype. It’s a logical evolutionary step. Investment is rising swiftly. But maturity is yet to come.

21. Recommendations To Enterprises Walk away: If unsatisfied on service commitments, go elsewhere. Negotiate: Ask for better service levels, even if a vendor claims not to provide an SLA. Validate: Demand proof, particularly of security, survivability and privacy practices. Monitor: Deploy third-party performance monitoring tools/services. Diversify: Consider a hybrid public/ private cloud configuration. To Cloud Service Providers Educate: Identify the business as well as operational benefits of your service to customers. Be transparent: Reveal processes; focus on security and service levels. Build trust: Improve contractual commitments and get certified.

22. Q&A Did you know? Despite security concerns, 64 percent of large enterprises have already deployed desktop virtualization. Yankee Group’s Attitude & Behavior Surveys track this data and more. Sign up for a complimentary snapshot of our most recent results at http://www.yankeegroup.com/live/survey_data_snapshot.html Has your organization deployed or does it plan to deploy desktop virtualization?

23. Camille Mendler, Vice President, cmendler@yankeegroup.com Agatha Poon, Senior Analyst, apoon@yankeegroup.com Next Yankee Group webinar: The Virtual Desktop Revolution October 27, 2009 Register at www.yankeegroup.com Thank you!