OPEN DATA CENTER ALLIANCE USAGE MODEL: Cloud Maturity Model Rev. 2.0

Transcription

1 OPEN DATA CENTER ALLIANCE USAGE MODEL: Cloud Maturity Model Rev. 2.0

2 Table of Contents Legal Notice...3 Executive Summary...4 Overview of the Cloud Maturity Model...5 Description of the Cloud Maturity Model...5 Terminology...6 Cloud Maturity Model Progression (Overall)...7 Cloud Maturity Model Business Perspective...8 Cloud Maturity Model Technology Perspective...9 Cloud Maturity Model Progression (Service Model-based)...10 Iaas Maturity...10 PaaS Maturity...11 SaaS Maturity...12 Information-as-a-Service Maturity...13 Cloud Adoption Roadmap...14 Conclusion...14 Contributors The following individuals from the Open Data Center Alliance have contributed to the contents of this document: Claude Noshpitz, AT&T Ian Lamont BMW Matt Estes Disney Corporation Catherine Spence Intel Pankaj Fichadia National Australia Bank (NAB) Ryan Skipp T-Systems 2

3 Legal Notice This Open Data Center Alliance SM Usage Model: Cloud Maturity Model document is proprietary to the Open Data Center Alliance (the Alliance ) and/or its successors and assigns. NOTICE TO USERS WHO ARE NOT OPEN DATA CENTER ALLIANCE PARTICIPANTS: Non-Alliance Participants are only granted the right to review, and make reference to or cite this document. Any such references or citations to this document must give the Alliance full attribution and must acknowledge the Alliance s copyright in this document. The proper copyright notice is as follows: Open Data Center Alliance, Inc. ALL RIGHTS RESERVED. Such users are not permitted to revise, alter, modify, make any derivatives of, or otherwise amend this document in any way without the prior express written permission of the Alliance. NOTICE TO USERS WHO ARE OPEN DATA CENTER ALLIANCE PARTICIPANTS: Use of this document by Alliance Participants is subject to the Alliance s bylaws and its other policies and procedures. NOTICE TO USERS GENERALLY: Users of this document should not reference any initial or recommended methodology, metric, requirements, criteria, or other content that may be contained in this document or in any other document distributed by the Alliance ( Initial Models ) in any way that implies the user and/or its products or services are in compliance with, or have undergone any testing or certification to demonstrate compliance with, any of these Initial Models. The contents of this document are intended for informational purposes only. Any proposals, recommendations or other content contained in this document, including, without limitation, the scope or content of any methodology, metric, requirements, or other criteria disclosed in this document (collectively, Criteria ), does not constitute an endorsement or recommendation by Alliance of such Criteria and does not mean that the Alliance will in the future develop any certification or compliance or testing programs to verify any future implementation or compliance with any of the Criteria. LEGAL DISCLAIMER: THIS DOCUMENT AND THE INFORMATION CONTAINED HEREIN IS PROVIDED ON AN AS IS BASIS. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE ALLIANCE (ALONG WITH THE CONTRIBUTORS TO THIS DOCUMENT) HEREBY DISCLAIM ALL REPRESENTATIONS, WARRANTIES AND/OR COVENANTS, EITHER EXPRESS OR IMPLIED, STATUTORY OR AT COMMON LAW, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, VALIDITY, AND/ OR NONINFRINGEMENT. THE INFORMATION CONTAINED IN THIS DOCUMENT IS FOR INFORMATIONAL PURPOSES ONLY AND THE ALLIANCE MAKES NO REPRESENTATIONS, WARRANTIES AND/OR COVENANTS AS TO THE RESULTS THAT MAY BE OBTAINED FROM THE USE OF, OR RELIANCE ON, ANY INFORMATION SET FORTH IN THIS DOCUMENT, OR AS TO THE ACCURACY OR RELIABILITY OF SUCH INFORMATION. EXCEPT AS OTHERWISE EXPRESSLY SET FORTH HEREIN, NOTHING CONTAINED IN THIS DOCUMENT SHALL BE DEEMED AS GRANTING YOU ANY KIND OF LICENSE IN THE DOCUMENT, OR ANY OF ITS CONTENTS, EITHER EXPRESSLY OR IMPLIEDLY, OR TO ANY INTELLECTUAL PROPERTY OWNED OR CONTROLLED BY THE ALLIANCE, INCLUDING, WITHOUT LIMITATION, ANY TRADEMARKS OF THE ALLIANCE. TRADEMARKS: OPEN CENTER DATA ALLIANCE SM, ODCA SM, and the OPEN DATA CENTER ALLIANCE logo are trade names, trademarks, and/or service marks (collectively Marks ) owned by Open Data Center Alliance, Inc. and all rights are reserved therein. Unauthorized use is strictly prohibited. This document does not grant any user of this document any rights to use any of the ODCA s Marks. All other service marks, trademarks and trade names reference herein are those of their respective owners. 3

4 OPEN DATA CENTER ALLIANCE USAGE MODEL: Cloud Maturity Model Rev. 2.0 Executive Summary The Open Data Center Alliance has identified the need for a Cloud Maturity Model (CMM), which organizations can apply in order to: 1. Support the development of a balanced cloud strategy in any organization towards supporting the Business objectives of that organization. 2. Enable the understanding of all dimensions that constitute cloud maturity, from the perspective of both the consumers and the provider 3. Enable the development of focused investment initiatives, to move selected capabilities to target maturity levels 4. Steer inputs and priorities relating to cloud service usage and adoption 5. Update the usage models to identify characteristics and artifacts that enable an organization to increase their cloud maturity and service success through cloud service adoption Since Business Strategy typically leads structure, which then leads business objectives, goals, and action plans, the CMM will need to align to and be used to enable and support identified business goals, as part of the overall IT strategy. In context of the business objectives and IT strategy, it should then help to guide investments, and identify focus development areas, based on defined target maturity and capability states to be achieved for the Cloud facilities, which support service delivery at organizational level. The ODCA Cloud Maturity Model maps cloud maturity from two key perspectives: business capabilities and technology capabilities. It also maps maturity levels for the individual cloud service models: SaaS, PaaS, IaaS, and Info-aaS. The business capabilities perspective of the CMM provides a comprehensive view of the maturity model s stages through the lens of business use of the cloud. This perspective includes a mix of cloud service models, cloud deployment models, and cloud capabilities across four business categories: governance and strategy, organization, project skills, and portfolios and services. The technology capability perspective of the CMM provides a similar comprehensive view of an organization s cloud maturity, but does so through the lens of cloud technology. The cloud service model perspective explores an organization s maturity across each of the individual cloud service models: SaaS, PaaS, IaaS, and Info-aaS. These perspectives on cloud maturity offer a way for each unique organization to plot its maturity across the perspective (or perspectives) that best suits its business needs. Some organizations are staffed and organized (or targeted toward business models) where one or more of the cloud service models are of little value or produce an inverse total cost of ownership. These organizations can assess their maturity across the cloud service model that is applicable to their organization, without the added complexity of the service models that do not apply. In cases where an organization will use two or three cloud service models in combination, the model offers an opportunity to plot maturity across SaaS, PaaS, IaaS, and Info-aaS independently. The ODCA Cloud Maturity Model supports multiple perspectives in order to accommodate the variety of cloud adoption patterns that different organizations will encounter. The CMM identifies five levels of cloud maturity. It is not necessary for an organization to aspire to CMM Level 5 in all cases different levels in the different capability areas may be quite acceptable and may meet that organization s requirements adequately. It is up to each organization to determine for itself where it wants to be, and what actions and enablers will take it there, per capability. 4

5 In addition, a permanent mix of legacy, private and hybrid clouds providing infrastructure as a service (IaaS), platform as a service (PaaS), or software as a service (SaaS) is quite acceptable. The same is true for IaaS, PaaS, and SaaS. CMM 5 does NOT dictate pure public or SaaS-based systems. It describes a managed set of controls, processes, and systems to help to consistently manage cloud services in line with business priorities, with sustained and organizationally aligned processes. As an organization progresses through introspection in regard to the above, it is common to identify islands of excellence, in contrast to other areas that have lower maturity. This is normal and an indication of being at CMM 1. A consolidated, cohesive organizational cloud strategy will enable consistent measurement and rating of the whole organization. Legacy environments will not go away. They add value for many years and should not detract from an organization having a cohesive and effective cloud strategy and strong cloud maturity achievement. Everything does NOT have to be on a federated cloud for an organization to be in the more mature rating levels. Having identified consistent frameworks and controls that enable selected business systems, according to a defined set of categorization, to be run according to a defined strategy in the cloud, representing the characteristics and artifacts identified in the CMM model, could also result in a high CMM rating. Overview of the Cloud Maturity Model The CMM provides an end-to-end visualization for how the use of cloud in the enterprise develops over time (adoption roadmap) and how the enterprise s ability to adopt cloud-based services within defined governance and control parameters increases. As it matures, the use of cloud becomes more sophisticated, comprehensive, and optimized. The CMM plots the progression of structured cloud service integration from a baseline of no cloud use through five progressive levels of maturity, as shown in Figure 1. None N/A Initial Ad Hoc Repeatable Opportunistic Defined Systematic Measured Measurable Figure 1. The cloud maturity model has five progressive levels of maturity. Description of the Cloud Maturity Model Figure 2 gives a summary description of each maturity level. It does not differentiate between the various types of cloud technology, cloud methodologies, or cloud deployment models. Each of these factors will be taken into account as the progressive levels of cloud maturity are explored in detail. CMM 0 None, N/A CMM 1 Initial, Ad Hoc CMM 2 Repeatable, Opportunistic CMM 3 Defined, Systematic CMM 4 Measured, Measurable CMM 5 Legacy Applications on Dedicated Infrastructure There is no cloud approach being taken. No elements of cloud are being implemented. Analysis of Current Environments Cloud Readiness Mapping and analysis of cloud potential for existing systems and services. Awareness of cloud computing is established and some groups are beginning to implement cloud computing elements. There is no cohesive cloud computing plan being followed. Processes for Cloud Adoption Defined An approach has been decided upon and is opportunistically applied. The approach is not widely accepted and redundant or overlapping approaches exist. May be informally defined or if documented, may exist primarily as shelfware. Initial benefits of leveraged infrastructure. CAPABILITY GAINS Tooling and Integration for Automated Cloud Usage The approach has been reviewed and accepted by affected parties. There has been buy-in to the documented approach and the approach is always (or nearly always) followed. EFFICIENCY GAINS Manual Federation Cloud-aware applications are deployed according to business requirements on public, private, and hybrid platforms. The capability is being measured and quantitatively managed via some type of governance structure. Appropriate metrics are being gathered and reported. INCREASES IN VELOCITY AND QUALITY Federated, Interoperable, and Open Cloud Metrics are consistently gathered and used to incrementally improve the capability. Assets are proactively maintained to ensure relevance and correctness. The potential for market mechanisms to be used to leverage inter-cloud operations has been established. PROACTIVELY ENABLES BUSINESS STRATEGY Capability, efficiency, velocity, and quality continually increase as higher levels of implementation are achieved. Figure 2. Descriptions of each level of the cloud maturity model. 5

6 Terminology Table 1 lists the standard terms and corresponding descriptions that are used in this document. Table 1. Terms and descriptions. Term Benefits Description Architecture Classification Federation Identity and Access Management Information as a Service (Info-aaS) Infrastructure as a Service (IaaS) Integrated Orchestration Platform as a Service (PaaS) Policies Processes Risk Management Security Service Delivery Management Software as a Service (SaaS) Transition and Transformation Flexibility Compliance Compliance Flexibility Simplify Flexibility Velocity Velocity Cost Simplified Automated Velocity Compliance Compliance Compliance Risk Compliance Managed Velocity Velocity Cost A defined architecture for public and private clouds, through all layers, including business processes. Data - Defined requirements for handling data throughout its lifecycle according to business value. Applications - Defined requirements for handling data throughout its lifecycle according to business value. Security - Security domain is structured to include public- and private-based infrastructure as a service or platform as a service. Data - Organization s data is distributed in a structured, consistently managed way across multiple clouds. Processes - Organization s data is distributed in a structured, consistently managed way across multiple clouds. Security domain is structured to enable public- and private-based user access in a managed standard way. Metadata and defined access, which enables that data to be used to support business decision making, new product identification, and other important Big Answers for business. Simple - Single standalone virtual machine (VM). Complex - Multi-VM system with network elements; for example, load balancing and firewalls. Core design process and standard for all system elements. A tooling layer for handling service deployments, consisting of workflows and work packages. Simple - Single app on a single VM. Complex - Multi-VM based app with network load balancing, clustering, disaster recovery (DR). A defined set of policies for handling all aspects of cloud usage, including data protection, applications, risks, and requirements. A defined set of processes for handling all aspects of cloud usage, including migrations, data lifecycle, risks, and exceptions. Corporate - Company-specific requirements defined in the context of cloud. Country - Country-specific requirements defined in the context of cloud. Industry - Industry-specific requirements defined in the context of cloud. Security domain is structured to enable public- and private-based service access in a managed standard way. Human interfaces are appointed, with supporting governance and processes, to manage the interface between business users and cloud providers, taking care of translating service detail and other incidents, problems, and reporting between the parties. Simple - Single app on a single VM. Complex - Multi-VM-based app with network load balancing, clustering, DR. Transition - Migration from a legacy platform onto cloud. Transformation - Migration from a legacy design to take advantage of cloud benefits. 6

7 Cloud Maturity Model Progression (Overall) Progression through the various maturity levels is based on the evolution of a number of parallel capabilities, as described in the following figures. The result is represented by an inferred resulting maturity, roughly mapped as follows: CMM 1. The existing environment is analyzed and documented for initial cloud potential. Pockets of virtualized systems exist, for limited systems, without automation tooling, operated under the traditional IT and procurement processes. Most of the landscape still runs on physical infrastructure. The focus is on the private cloud, although the public cloud is used for niche applications. CMM 2. IT and procurement processes and controls are updated specifically to deal with cloud and who may order services and service elements and how. Private cloud is fully embraced with physical-to-virtual movement of apps and the emergence of cloud-aware apps. CMM 3. Tooling is introduced and updated to facilitate the ordering, control, and management of cloud services. Risk and governance controls are integrated into this control layer, ensuring adherence to corporate and country requirements. Complementary service management interfaces are operational. More sophisticated use of SaaS is evident, and private PaaS emerges. CMM 4. Online controls exist to manage federated system landscapes, distributed data and data movement, federated and distributed application transactions, and the cross-boundary transitions and interactions. Defined partners and integration exist, enabling dynamic movement of systems and data, with supporting tool layer integration (for example, service desk, alerting, commercial systems, governances). Cloud-aware apps are the norm and PaaS is pervasive. Hybrid apps develop across cloud delivery models. CMM 5. All service and application deployments are automated, with orchestration systems automatically locating data and applications in the appropriate cloud location and migrating them according to business requirements, transparently (for example, to take advantage of carbon targets, cost opportunities, quality, or functionality). The CMM levels enable the realization of a number of cloud characteristics described below, which in turn translate into the enablement of business functionality and value. These business outcomes are the recommended results of positioning capabilities within the various CMM levels: capability gains, efficiency gains, quality gains, and velocity gains, which ultimately result in powerful business strategy enablement. Federated. Federation refers to the ability of identity and access management software to be able to securely share user identities and profiles. This ability allows users within a specific organization to utilize resources located in multiple clouds without having to generate separate credentials in each cloud individually. IT is able to manage one set of identities, authorizations, and set of security review processes. From the user perspective, this enables seamless integration with systems and applications. Interoperable. There are two key concepts of interoperability: (1) The ability to connect two systems that are concurrently running in cloud environments, and (2) the ability to easily port a system from one cloud to another. Both involve the use of standard mechanisms for service orchestration and management, enabling elastic operation and flexibility for dynamic business models, while minimizing vendor lock-in. Open Standards. The term open refers to both software and standards. Open source software operates at a fast rate of change supported by diverse, vibrant community updates. These frequent update cycles provide access to the latest features and capabilities, including performance and efficiency improvements. The use of common APIs or abstraction layers makes it easier for end users to rapidly consume cloud services from different providers to meet business requirements. Even if the software is not open source, it should adhere to open standards, in order to maximize the benefits of cloud deployment. 7

8 Cloud Maturity Model Business Perspective The business capabilities perspective, shown in Figure 3, plots cloud maturity across the five maturity levels through four business capabilities. Business strategy. Contains capabilities such as business motivation, expected benefits, guiding principles, expected costs, and funding models. Capabilities such as service selection and service-level agreements (SLAs) also gain relevance in cloud initiatives. Organization and skills. Contains capabilities related to the development of organizational competency around cloud computing, including organizational structure and skills development, as well as executive sponsorship and organizational authority. Governance. Contains capabilities related to the governance structures and processes that support and guide the cloud efforts. These capabilities include policy management, risk management, and auditing capabilities. The maturity and adoption of adequate governance is a leading indicator of the overall success of a cloud computing strategy. Projects, portfolios, and services. Contains capabilities related to the planning and building of cloud services, and the management of the portfolio of services. BUSINESS CAPABILITIES CLOUD MATURITY MODEL CMM 1 Initial, Ad Hoc CMM 2 Repeatable, Opportunistic CMM 3 Defined, Systematic CMM 4 Measured, Measurable CMM 5 Business Strategy Organization and Skills Governance Projects, Portfolios, and Services Ad hoc use of cloud services Business context is missing Purchase decisions are ad hoc Low level of skills in cloud services Disparate governance models and practices Cloud projects and changes occur with ad hoc controls and designs Lifecycle of cloud projects do not intersect Departmental cloud strategies applied Opportunistic leverage of cloud services Islands of excellence of cloud skills Departmental principles exist to guide cloud decisions Categorized business applications, data policies Procurement processes and contracts for cloud Ad hoc cloud service management Basic infrastructure service catalog Cloud projects are governed and managed inconsistently Enterprise cloud strategy exists Funding decisions influenced by enterprise priorities Skills improve from operational to strategic Guiding principles are well known and adopted Cloud governance integrated within organizational governance practices Transition and transformation process for cloud Mature project management competencies for cloud Defined orchestration process for cloud Cloud strategy is an integral part of business strategy Generates significant value Sound mix of strategic, business, and operational skills across the enterprise Risk and compliance management adds business value for cloud services Metrics are used for decision making Planning functions for cloud services are mature Build and run competencies for cloud projects and program of work exist Federated, Interoperable, and Open Cloud: Majority of landscape is cloud-aware applications Automated provisioning according to business requirements and controls Managed public, private and hybrid SaaS, PaaS, and IaaS provisioning and integration Dynamic compliance and control Figure 3. The business capabilities perspective of the cloud maturity model. 8

9 Cloud Maturity Model Technology Perspective The technology capabilities perspective, shown in Figure 4, plots cloud maturity across the five maturity levels through four technology capabilities: Operations, administration, and governance. Contains capabilities related to the post-deployment aspects of cloud service: the operations, administration, and management aspects of the cloud environment. This technology capability includes capabilities for the delivery of selfservice functions and change management. Information. Contains capabilities related to the information aspects of cloud, such as metadata management, as well as customer entitlements and data durability. Infrastructure. Contains capabilities related to the service infrastructure and tools that provide the technical foundation for the cloud initiative. Shared services, provisioning, and model packaging are particularly important in cloud infrastructure. Architecture. Contains capabilities related to the definitions of the overall architecture and guidelines for various practitioners to ensure adherence to the architecture. Capabilities fundamental to cloud architectures such as resource pooling, interoperability, and self-service are considered in the model. TECHNOLOGY CAPABILITIES FOR THE CLOUD MATURITY MODEL CMM 1 Initial, Ad Hoc CMM 2 Repeatable, Opportunistic CMM 3 Defined, Systematic CMM 4 Measured, Measurable CMM 5 Operations, Administration, and Governance Scheduled Procurement Processes and Contracts for Cloud Event-Triggered Service Delivery Management Including Cloud Cloud Portal/Interface Automated Service Migration According to Pre-Defined Cases (for example, carbon or cost) Online Risk and Compliance Management Information Architecture Infrastructure Information Pools Simple IaaS Instances Compute, Storage, and Network Categorized Business Applications, Data Policies Virtualized Infrastructure Apps Complex IaaS Simple Federated IaaS Simple IaaS Cloud-Aware Application Development Framework Defined Orchestration Defined Cloud Service Catalog Info-aaS Complex PaaS and SaaS Islands of Identity and Access Management Simple SaaS Standardized PaaS Products Orchestration Tooling with API Interfaces Private SaaS Framework Private PaaS Framework Defined Cloud Architecture Integrated Use Cases for Public, Private, and Hybrid Federated Data Control Systems Integrated Security Management Hybrid SaaS Hybrid PaaS Tooling Including Cloud Brokering Federated Identity and Access Model Architecture for Federated Cloud Control Systems Federated, Interoperable, and Open Cloud: Majority of landscape is cloud-aware applications Automated provisioning according to business requirements and controls Managed public, private and hybrid SaaS, PaaS, and IaaS provisioning and integration Dynamic compliance and control Figure 4. The technology capabilities perspective of the cloud maturity model. 9

10 Cloud Maturity Model Progression (Service Model-based) Iaas Maturity Not all organizations will use IaaS at the same rate of adoption (see Figure 5). There will be organization-centric paths taken to benefit from the cloud service model, depending on business needs, the problems being solved, the organization s maturity level, the regulatory landscape, and strategic considerations. The following defines the CMM progression levels specific to cloud service models. The objective is to support an assessment of cloud adoption maturity for specific service models that may be most relevant to an organization s needs. CMM 1 - Internal organization-based virtualization. CMM 2 - Selected business processes and functions leverage IaaS facilities from service providers, with early and developing focus on managed services. CMM 3 - Deployment of complex IaaS services across managed service providers and internal private clouds providing IaaS services. CMM 4 - Hybrid cloud environments for IaaS are maturing, and business demand drives an effective use of hybrid clouds in a dynamic and seamless fashion. CMM 5 - IaaS services across private clouds and public clouds are leveraged through high maturity within interoperability, federation, and open standards. The focus is on multi-provider SLAs for reliability, meeting business demand, interoperability, and business benefits through selection of the appropriate services based on cost, capacity, need, and control requirements. INFRASTRUCTURE-AS-A-SERVICE (IaaS) CLOUD MATURITY MODEL CMM 1 Initial, Ad Hoc CMM 2 Repeatable, Opportunistic CMM 3 Defined, Systematic CMM 4 Measured, Measurable CMM 5 Enterprise Model Technology Model Simple IaaS Compute, Storage, and Network Departmental Cloud Strategies Simple IaaS Instances Compute, Storage, and Network Complex IaaS Simple Federated IaaS Procurement Processes and Contracts for Cloud Cloud Strategy Consolidation Virtualized Infrastructure Apps Complex IaaS Defined Orchestration Defined Cloud Service Catalog Orchestration Tooling with API Interfaces Defined Cloud Architecture Geo-Distribution Federated Cloud Strategy Event-Triggered Service Delivery Management Including Cloud Portal/Interface Federated Data Control Systems Including Cloud Brokering Integrated Use Cases for Public, Private, and Hybrid Automated Service Migration According to Pre-Defined Cases (for example, carbon or cost) Automated Service Migration According to Pre-Defined Cases (for example, carbon or cost) Federated Identity and Access Model Architecture for Federated Cloud Control Systems Federated, Interoperable, and Open Cloud: Majority of landscape is cloud-aware applications Automated provisioning according to business requirements and controls Managed public, private and hybrid SaaS, PaaS, and IaaS provisioning and integration Dynamic compliance and control Scheduled Islands of Identity and Access Management Online Risk and Compliance Management Figure 5. Infrastructure-as-a-service adoption based on the cloud maturity model. 10

11 PaaS Maturity Not all organizations will use PaaS at the same rate of adoption (see Figure 6). There will be organization-centric paths taken to benefit from the cloud service model, depending on business needs, the problems being solved, the organization s maturity level, the regulatory landscape, and strategic considerations. The following defines the CMM progression levels specific to cloud service models. The objective is to support an assessment of cloud adoption maturity for specific service models that may be most relevant to an organization s needs. CMM 1 - Internal use of simple PaaS services within an organization. CMM 2 - Rapid and deep use of PaaS within the organization, with multiple departments using the services. Standards are developing and maturity. CMM 3 - Complex PaaS within the organization and through the use of PaaS provided by service providers. CMM 4 - Existing applications and architectures are modified and streamlined to leverage the benefits of PaaS models. CMM 5 - All application and service deployments are automated, with orchestration systems automatically locating data and applications in the appropriate cloud location, and migrating them according to business requirements, transparently (for example, to take advantage of carbon targets, cost opportunities, quality or functionality). PLATFORM-AS-A-SERVICE (PaaS) CLOUD MATURITY MODEL CMM 1 Initial, Ad Hoc CMM 2 Repeatable, Opportunistic CMM 3 Defined, Systematic CMM 4 Measured, Measurable CMM 5 Pre-PaaS (Application Features Bundled to IaaS) Simple PaaS Virtualized Infrastructure Apps Private PaaS Framework Complex PaaS Complex PaaS Geo-Distribution Enterprise Model Technology Model Cloud Access Model (Single Pane of Glass) Departmental Cloud Strategies Scheduled Cloud-Aware Application Development Framework Defined Orchestration Cloud Strategy Consolidation Defined Cloud Service Catalog Categorized Business Applications, Data Policies Defined Orchestration Defined Cloud Architecture Standardized PaaS Products Federated Cloud Strategy Service Delivery Management Including Cloud Portal/Interface Cloud Functionality-Based App Development Event-Triggered Info-aaS Integrated Use Cases for Public, Private, and Hybrid Including Cloud Brokering PaaS Orchestration Tooling with API Interfaces Hybrid PaaS Geo-Distribution Automated Service Migration According to Pre-Defined Cases (for example, carbon or cost) Online Risk and Compliance Management Federated, Interoperable, and Open Cloud: Majority of landscape is cloud-aware applications Automated provisioning according to business requirements and controls Managed public, private and hybrid SaaS, PaaS, and IaaS provisioning and integration Dynamic compliance and control Islands of Identity and Access Management Federated Identity and Access Model Figure 6. Platform-as-a-service adoption based on the cloud maturity model. 11

12 SaaS Maturity Not all organizations will use SaaS at the same rate of adoption (see Figure 7). There will be organization-centric paths taken to benefit from the cloud service model, depending on business needs, the problems being solved, the organization s maturity level, the regulatory landscape, and strategic considerations. The following defines the CMM progression levels specific to cloud service models. The objective is to support an assessment of cloud adoption maturity for specific service models that may be most relevant to an organization s needs. CMM 1 - Organization makes opportunistic use of SaaS for tactical needs. The service-oriented architecture is basic and developing. CMM 2 - Depth of SaaS penetration increases, with further business value gained from the use of applications that go across cross-functional roles and departmental boundaries. CMM 3 - Organizations deploy SaaS for mission-critical business, functional value chain across internal needs, and customer-facing business use cases. CMM 4 - Value is derived from the integration between SaaS applications, creating end-to-end business processes that generate value across SaaS applications and functions. CMM 5 - Integration across business partners is based on federated, open, and interoperable cloud environments. All service and application deployments are automated, with orchestration systems automatically locating data and applications in the appropriate cloud location and migrating them according to business requirements, transparently (for example, to take advantage of carbon targets, cost opportunities, quality, or functionality.) The SaaS environment is managed across the lifecycle of selection, provisioning, integration, operation, and decommissioning. SOFTWARE-AS-A-SERVICE (SaaS) CLOUD MATURITY MODEL CMM 1 Initial, Ad Hoc CMM 2 Repeatable, Opportunistic CMM 3 Defined, Systematic CMM 4 Measured, Measurable CMM 5 Use of External SaaS Categorized Business Applications, Data Policies Private SaaS Framework Complex SaaS Online Risk and Compliance Management Enterprise Model Technology Model Departmental Cloud Strategies Scheduled Information Pools Procurement Processes and Contracts for Cloud Cloud Strategy Consolidation Defined Cloud Service Catalog Categorized Business Applications, Data Policies Defined Orchestration Orchestration for SaaS Consumption Defined Cloud Architecture Federated Cloud Strategy Service Delivery Management Including Cloud Portal/Interface Event-Triggered Info-aaS Islands of Identity and Access Management Offer Simple SaaS Hybrid SaaS Federated Data Control Systems Including Cloud Brokering Integrated Use Cases for Public, Private, and Hybrid Automated Service Migration According to Pre-Defined Cases (for example, carbon or cost) Integrated Security Management Federated Identity and Access Model Architecture for Federated Cloud Control Systems Federated, Interoperable, and Open Cloud: Majority of landscape is cloud-aware applications Automated provisioning according to business requirements and controls Managed public, private and hybrid SaaS, PaaS, and IaaS provisioning and integration Dynamic compliance and control Figure 7. Software-as-a-service adoption based on the cloud maturity model. 12

13 Information-as-a-Service Maturity Not all organizations will use Info-aaS at the same rate of adoption (see Figure 8). There will be organization-centric paths taken to benefit from the cloud service model, depending on business needs, the problems being solved, the organization s maturity level, the regulatory landscape, and strategic considerations. The following defines the CMM progression levels specific to cloud service models. The objective is to support an assessment of cloud adoption maturity for specific service models that may be most relevant to an organization s needs. CMM 1 Organization explores information-as-a-service concepts, but remains largely on traditional data and information systems. CMM 2 An information-as-a-service architecture is defined, with a focus on enterprise services and an understanding of data across the enterprise. CMM 3 Enterprise governance plays an increasing role, master data management and data quality are matured, and analytics progress to advanced stages. CMM 4 Interfaces and enterprise collaboration allow federated query capabilities, private internal data supply chains emerge. CMM 5 Organization reaches a state of mature information-as-a-service, with advanced semantic capabilities, internal/external data supply chains, a catalog-driven workload, governance-driven orchestration, and self-healing data processing capabilities. INFORMATION-AS-A-SERVICE (Info-aaS) CLOUD MATURITY MODEL CMM 1 Initial, Ad Hoc CMM 2 Repeatable, Opportunistic CMM 3 Defined, Systematic CMM 4 Measured, Measurable CMM 5 Department Semantic Models Enterprise Semantic Model Semantic Integration with Third-Party Tools Semantic Collaboration Info-aaS Architecture Adopted Info-aaS Architecture Defined Info-aaS Governance Cooperative Information Lifecycle Management Governance Driven Orchestration Enterprise Model Department Data Dictionaries Enterprise Data Dictionary Data Catalog Catalog Integration with Master Data Management Catalog-Driven Workload Self Healing Independent Master Data Management Enterprise Master Data Management Integrated Master Data Management Daily Batch Processing Micro Batch Processing Low-Latency/Near Real-Time Real-Time Processing End-User Experience Driven Independent Information Services Integrated Information Services Internal Data Supply Chain Internal/External Data Supply Chain Technology Model Database/API Data Access Search, Reporting, and BI Data Profiling Virtualized Data Access Mobile Data Access Data Visualization Data Quality (Correction) Federated Query Capabilities Mobile Management Capabilities Advanced Analytics Enterprise Data Quality Services Federated Query Capabilities Mobile Framework Published Natural Language Processing Domain-Specific Augmentation Mobile App Dev SDKs Exposed Integrated Information Consumption Context-Aware Correction Figure 8. Information-as-a-service adoption based on the cloud maturity model. 13

14 Cloud Adoption Roadmap The cloud adoption roadmap provides an end-to-end visualization for how the technical use of cloud technologies in the enterprise develops over time. As technical implementation matures, the use of cloud becomes more sophisticated, comprehensive, and optimized. Based on ODCA industry experience, many large enterprises are progressing using the same overall trajectory but at different rates of adoption. A typical technical adoption roadmap is represented in Figure 9 below. START STAGE 1 STAGE 2 STAGE 3 STAGE 4 STAGE 5 End User Application Developer Application Owner IT Operations Legacy Apps on Dedicated Infrastructure Simple SaaS Enterprise Legacy Apps Simple Compute IaaS Compute, Storage, and Network Simple SaaS Cloud-Aware Apps Enterprise Legacy Apps Complex Compute IaaS Simple Compute IaaS Compute, Storage, and Network Complex SaaS Cloud-Aware Apps Enterprise Legacy Apps Private PaaS Full Private IaaS Hybrid SaaS Cloud-Aware Apps Enterprise Legacy Apps Hybrid PaaS Hybrid IaaS Federated, Interoperable, and Open Cloud Figure 9. A typical technical adoption roadmap. This adoption roadmap gives context to technical planning and assists organizations in quantifying existing deployments and the steps that following from that point. Conclusion When an organization s technology and business strategies align to meet the final cloud maturity level, an organization will achieve a federated, interoperable, and open cloud. This in turn will enable the expected business value that cloud services should represent to that organization: capability gains, efficiency gains, quality gains, and velocity gains, which ultimately result in powerful business strategy enablement. This is the end-state vision of the cloud maturity model. 14