Lessons learned by early cloud service adopters Considerations for CIOs and IT Sourcing Managers when sourcing cloud computing service offerings

Transcription

1 Lessons learned by early cloud service adopters Considerations for CIOs and IT Sourcing Managers when sourcing cloud computing service offerings This paper discusses the top seven challenges that have been encountered by the early adopters of cloud services. In particular, we focus on the mind-shift required by IT and its business customers to realise the value of cloud services. These challenges arose due to the shift from customised IT services to commodity arrangements and the resultant changes for supporting business processes and IT operations. Spending on cloud computing service offerings ( cloud services ) continues to increase with forecast compounded annual growth of 19 per cent for the coming years 1. With the recent release of the Australian Federal Government s guidelines for investing in cloud services, these spending growth estimates may even prove to be conservative. Here are your Service Levels Many cloud services are sold with a small number of, often non-negotiable, service levels. This is a daunting trade-off for organisations used to developing, negotiating and measuring a large number of service levels to provide visibility of how their IT services are provided and performing. Examples of these service levels include incident response times, problem management, disaster recovery and root cause analysis. Conversely, for several cloud services the sole measurement provided is system availability. Their business is based on providing an available service and therefore maintaining this availability is of equal, if not greater, importance to them than it is to their customers. Despite this, the lack of transparency as to how availability is 1 Anderson E., Dharmasthira Y., Eschinger C., Correia J., Wurster L., Eid T., Liu V., Pang C., Sommer D., Swinehart H., Zhang J., Yeates M., Bell W., Petri G. and Contu R., Forecast Overview: Public Cloud Services, Worldwide, 2Q13 Update, web document, Gartner, Inc., viewed 9 September 2013, < 1

2 maintained (formerly assisted by the aforementioned service levels) will cause discomfort for many organisations. So what does this mean? The adoption of cloud services will require organisations to make the mind-shift from monitoring how services are provided, to measuring services outcomes. This focus on outcomes (i.e. system availability) requires that the IT department understands and communicates how resilient IT systems actually need to be. For a bank that requires 24x7 transaction processing, a service level that specifies 100% availability may be the real requirement. For most other organisations however, this level of availability is far beyond what is actually required and the real requirement may only be during business hours (7am to 7pm). The over-specification of the business requirements is not unique to cloud services however, the change in service delivery model presents a generational opportunity to re-examine and more accurately specify the business needs. This mind-shift to focus on outcomes may require difficult conversations with business process owners. In the long run, this will result in a better understanding of the actual IT requirements, reducing the number of gold-plated services and enabling IT to be provisioned using the most appropriate service provider and at the right cost. We recommend: Considering whether you are ready to move to a lower visibility service level model. Review the use and usefulness of existing measurements to help build the argument for (or against) change Determining what the actual requirements are for the IT services that are provided to the business. Then analyse the impact of the actual requirements on the costs to provide the existing IT services, as well as on the anticipated cost of the cloud services. This information should be incorporated into the business case for the cloud services. Emphasis on solution maturity and vendor stability increases Conducting vendor due diligence is a prudent step in any procurement process. In purchasing cloud services however, more intelligent assessments of risk are needed to account for the variability between vendors in the marketplace. For example, when performing due diligence on the products of a software start-up and a software giant, the traditional assessments of organisational stability and financial strength will typically favour the software giant, although this may not be the best procurement outcome. Inclusion and emphasis of factors such as the business objectives and ability to manage risk are necessary to achieve the best procurement process outcomes. Business objectives are the basis of any procurement activity and should be clearly understood. If agility is being sought by the business to test a market opportunity and fail fast and cheaply, then we re not telling you anything new when we say a six month procurement activity is inappropriate. In a similar vein, the acceptable vendor risk profile in this situation is likely to be far greater; in this scenario, a start-up cloud service provider that may not pass a typical vendor due diligence may be the most appropriate. Tailoring vendor due diligence to the business objectives and agreeing with them an acceptable risk profile will therefore result in better procurement outcomes. 2

3 We recommend: The development of due diligence criteria should occur prior to engaging vendors, whilst the procurement team is unencumbered by knowledge of the potential outcomes Ensuring that the evaluation criteria have the required sophistication to support comparison of cloud services to traditionally hosted options, if the organisation is still considering these options Understanding the business desired risk profile for the cloud service being procured. Where a service supports a key business process, typically smaller risk profile is desired. In these cases, set threshold criteria for reference sites and publish these with the procurement documents to ensure appropriate organisations are made available (e.g. reference is industry-compatible and has subscriptions for a similar number of users) The assessment itself should include far greater emphasis on investigating the service s maturity, especially where the vendor has translated a commercial-off-the-shelf application to be delivered as a cloud service. Speak to other customers about the vendor s track-record of delivering roadmap functionality, the cadence of releases/updates for the service and their ability to influence the roadmap. Evergreen IT services blessing or curse? An often touted advantage of transitioning to cloud services is that the service is kept up to date with the latest upgrades and patches. Colloquially known as evergreen IT, this is a boon for a lot of CIOs; today, the maintenance of legacy technology soaks up much of the available IT budget and is a primary barrier to IT responsiveness and overall business agility. These updates are typically pushed out to the cloud service, with notification periods ranging from none (several cloud services specify that no notification will be given for minor patches) to up to twelve months. The consequence of the high-cadence of updates for cloud services is that IT is required to keep all other software that has a dependency/interface with the cloud service up to date as well, to avoid integration and compatibility issues. So what happens when your spiffy new cloud service requires you to implement a newer version of Internet Explorer in the next three months? Do you have time to regression test all of your applications that are impacted by a change in Internet Explorer? Do you even know which applications use Internet Explorer? Do you even have the tools in place to enable a rollout of a new version of Internet Explorer in a three month window, let alone the available funds and resources to complete the work? Although your cloud vendor is likely to advise you of the impending changes, most cloud vendors do not enable you to defer the implementation of upgrades and patches to their solution. 3

4 We recommend: Understanding dependencies and interfaces between applications. This will require understanding and documentation of your enterprise architecture Understanding the cloud service s contract. Determine whether or not you are able to delay upgrades and the maximum possible length of the delay Investigating the use of private clouds. Several vendors offer private clouds that offer many of the advantages of cloud services, with the added flexibility in the contract s terms and conditions for service changes, traded-off against additional cost Revising your technical change management processes and procedures. Ensure that there is an understanding of what is required to push through an urgent environment change. Set aside money in each year s IT budget for un-forecasted changes. Take IT off the treadmill no more sweating your infrastructure The majority of cloud services are sold on a subscription basis, also known as a pay for what you use model. This pricing is more attractive for many organisations than having to defend large, upfront capital expenditure. It is crucial however, to consider the full lifecycle of IT assets to ensure that the business case for investment appropriately calculates the value inherent in having the flexibility to extend the life of traditional IT assets. When faced with budget pressures, IT departments often elect to defer investments in upgrading their IT assets, by operating (or sweating ) these assets for an extra year or two. Whether or not these IT assets are optimally supporting the business needs, the wisdom is to extract as much perceived lifetime value from them as possible. The deferred capital expenditure is able to be allocated to more pressing needs. How much is this worth to the business? Assuming that IT assets are a capital expense that is written off after five years, at the time of purchase the value of sweating an asset for an additional year (i.e. year six) is nearly 5% of the initial cost 2. A seventh year is valued at roughly 9% of the initial cost. For the moment, ignoring the argument on whether or not the business is being best served by the aged IT assets, IT managers have lost the flexibility to extend the life of the assets. Therefore, we argue that there needs to be a value allocated for this flexibility when calculating the business case for whether or not to invest in cloud services. Further, procuring cloud services will change the IT department s on-going budgeting process, thereby increasing the required operating expenditure each year. This may have implications for the both the IT department and the business financing and cash flows. 2 Calculated using the net present value of the investment. Assumptions were that the IT department has a 15% cost of capital and the investments and subsequent upgrades are at the beginning of the relevant year. 4

5 We recommend: When considering the business case for the cloud services against traditional IT assets, assigning a value to the flexibility of sweating the assets. This may account for multiple options, with each option being assigned a weighting dependent on its likelihood Ensuring that the cost of capital for the IT department is known, to calculate the different funding scenarios for IT assets (e.g. operating expenditure versus capital expenditure) Prior to committing to any substantial cloud services contracts, involving your organisation s Finance team to ensure that the implications of increasing the annual operating expenditure are understood. The most likely impacts are to the organisation s financing and taxation. Quick, it s time to dust off the Business Continuity Manual Service availability is a key consideration in any outsourcing arrangement. For example, most commercial-offthe-shelf software includes source code escrow arrangements in the contract, which mitigates the risk of the vendor getting into financial trouble by giving customers access to the source code and all applicable documentation. This clearly does not work for SaaS, as customers are unlikely to be able to use the source code to host their own service and the several weeks of downtime are unacceptable if their cloud services vendor turns off the service due to bankruptcy. Typically, IT departments build resilience between their production environments through failovers and backups. Although most cloud service providers design their service for high availability, businesses buying these services need to be prepared for the worst case scenario where the service becomes unavailable due to, for example, the provider becoming insolvent. Worse than not having access to the cloud service, is the potential for losing all of the organisation s data and therefore not even being able to revert to another system. It is therefore crucial that prior to entering a cloud services arrangement, organisations review their business continuity processes for the affected services. The review of the business continuity process will help inform the risks requiring mitigation. For example, should the organisation make its own backup of its data at regular intervals, what are the fall back options if the service is unavailable? Understanding these options, the organisation can then formulate costs for mitigating the risks and/or make informed decisions about the level of risk it is prepared to accept. We recommend: Ensuring that the cloud service s terms of service are reviewed by your legal representatives. They should check who owns the organisation s data, how the organisation s data can be accessed in the case of the vendor getting into trouble, financial or otherwise. Ensuring that the disaster recovery and business continuity plans are up-to-date and factor in service unavailability. For example, understand if backup systems are required to be identified and what timeframe is required to provision them. Understand if the organisation s data is recoverable and how it can be accessed if the need arises. Making sure the criticality of the business processes impacted by the cloud service are known and that the workaround processes are available if the cloud service becomes unavailable. 5

6 Do I still need a Vendor Management function? Yes, vendor management is still required; however, the vendor management function is likely to evolve over time. There will be a shift towards compliance activities as the overall set of service levels managed by the vendor management areas will reduce inversely to the uptake of cloud services. The focus on a large volume of service levels under management will be replaced by an increased focus on managing capacity, or the number of licenses subscribed to, and preparation for periodic licensing true-ups where actual licence usage is compared to contracted amounts (and payments adjusted accordingly). This reduction in service level management and the increased focus on compliance will result in a need to rethink the skill sets required for the vendor management function as well as its approach. Cloud services have also increased the organisation s risk of procurement leakage. Cloud services can be purchased with relative ease via a corporate credit card, bypassing the perceived delays of corporate IT and procurement policies. The vendor management function can be made responsible for the establishment and monitoring of policies to mitigate this risk. We recommend: Considering the implications for vendor management skills, organisation structure, processes and tools. Establish compliance processes (including tools to monitor usage of the cloud service) early and manage the business throughout. Bringing the business on the cloud journey, understand procurement leakage and tailor sourcing arrangements to bring the cloud to where it is most needed. No one wants to talk about breaking-up but you need to have the conversation early! Due to the relative infancy of the cloud services marketplace, disengagement from cloud services contracts is not yet a tried and tested process. To date, there has been relatively little churn between vendors or transition away from cloud services. Given the lack of precedents for disengagement, organisations must place a much greater emphasis on the process and how they will manage disengagement risk during the sourcing process. Key areas for consideration include data ownership, security and destruction. Buyers are advised to ensure they own their data in the cloud service and to specify the format and medium in which it will be made available to them upon disengagement. Understanding how data will be migrated on disengagement is also an important consideration. As with any outsourcing arrangement, the basics of the project plan will need to be agreed in advance. Focus on when and how migration will occur, incoming service provider accountabilities, testing and back up; additionally, think through the back-out procedures should things not go according to plan. Once data has been migrated, specifying service provider s data destruction requirements is crucial, especially when multi-tenanted environments are in use. It is important to understand how the vendor will delete the organisation s data, ensure that all copies including backups have been destroyed, what standards have been followed during the data destruction process and what audit processes are available to ensure compliance. 6

7 We recommend: The disengagement process is clearly understood and documented. Including the requirements for disengagement during the procurement process will help. These disengagement requirements should include data ownership, in what format and medium will data be returned in, how data will be migrated, how the data will be destroyed as well as, any disengagement costs. Conclusion We have documented many of the lessons learned from early adopters of cloud services; none of these lessons make cloud services prohibitive and we see large potential benefit for those considering the adoption. Greater value may be unlocked from cloud services through the awareness and mitigation of the risks we have discussed, and through the IT department helping the business with the mind-shift required to understand the different focus and outcomes of cloud services. 7

8 Deloitte s Cloud Sourcing Services Deloitte s Cloud Sourcing services cover cloud strategy, cloud sourcing strategy and execution, tax advisory, operating model development, human capital and deal success measurement. Our focus is to help companies maximise the opportunities offered by cloud by setting up for success. Advisory and support services across the entire sourcing lifecycle Strategic Assessment Operating Model and RFP Development Vendor Evaluation and Contract Negotiation Transition and Implementation Management and Measurement Strategic Assessment. A well-crafted strategy is key to driving towards a successful solution. We provide vendor and solution agnostic advice on the suitability of cloud services for your business, as well as working with you to determine the optimal way to source it. Operating Model. Setting up the right organisation to face off with service providers enables savings and efficiencies to be realised. Plus we provide advice on the IT and vendor management organisational changes required to underpin success. RFP Development. Structuring the right deal package for cloud services is critical to identifying the right service provider and solution; along with ensuring the right financial and contracting structures are in place to seek the anticipated benefits. Vendor Evaluation and Contract Negotiation. Our evaluation methodology is tailored towards cloud service provider maturity and solution viability, to assist with identifying and managing risks and help you make an informed decision. We work side-by-side with you and your legal team to ensure that the deal reflects the procurement process and adequately reflects the risk profile that your organisation is prepared to accept. Transition and Implementation. Transition and implementation planning begins well before deal closure to facilitate secure data transfer, sound business continuity planning, service level implementation, change management and putting the right organisation, tools and processes in place to manage it. Management and Measurement. Understanding, managing and measuring deal success factors is key to optimising a cloud sourcing arrangement. With the rapidly evolving cloud landscape, our global industry insights enable you to assess the value that you re achieving. 8

9 Deloitte s Cloud Advisory Services The qualities we bring knowledge, speed, objectivity, experience and the benefit of an integrated full service advisory capability help our clients choose and implement the right solution. Enterprise Architecture. Having a clear architectural direction enables an organisation to understand the value of cloud clearly. Our technology advisory capabilities span: technology strategy and architecture including cloud, enterprise information management, systems integration, IT process effectiveness, data analytics, enterprise applications (e.g. SAP, Oracle) and online services (Deloitte Digital). Our enterprise architecture brings these capabilities to bear across the business landscape to orchestrate wide-ranging solutions. IT Organisation and Operating Model Design. Along with service delivery cost reductions, headcount reductions and process optimisation are common benefits from cloud services. Our specialist technology advisory practitioners will design and assist you with implementing an organisation geared towards realising these benefits. Sourcing. Design and management of the sourcing process will assist you to identify the right solution and service provider whilst keeping you focussed on the required benefits and managing risk. Our dedicated global team of sourcing practitioners is the world s largest (420+ full time practitioners) and is well experienced in sourcing and managing cloud solutions. Cloud Migration. Successful migration of processes, data and skills to your new cloud service is critical to the success of the project. Deloitte s Enterprise Information Management capability is well versed in planning and executing cloud migrations. Business Continuity Planning. Deloitte is recognised globally as a leader in Business Continuity, Crisis Management and IT Disaster recovery. Our team is committed to building on this reputation, developing innovation through use of global standards, thought leadership, tools and templates. Change Management and Communications. Timely and focussed change management and communications assists in embedding the required IT and vendor management organisational changes and in stopping cloud driven procurement leakage. Deloitte is one of the leading Human Capital practices with a global network of practitioners, recognised by senior executives for our ability to transform the performance of an enterprise through its people. 9

10 Ivica Perica Director Business Advisory Services Branimir Pačar Consultant Business Advisory Services This publication contains general information only, and none of Deloitte Touche Tohmatsu Limited, its member firms, or their related entities (collectively the Deloitte Network ) is, by means of this publication, rendering professional advice or services. Before making any decision or taking any action that may affect your finances or your business, you should consult a qualified professional adviser. No entity in the Deloitte Network shall be responsible for any loss whatsoever sustained by any person who relies on this publication. About Deloitte Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee, and its network of member firms, each of which is a legally separate and independent entity. Please see for a detailed description of the legal structure of Deloitte Touche Tohmatsu Limited and its member firms. Deloitte provides audit, tax, consulting, and financial advisory services to public and private clients spanning multiple industries. With a globally connected network of member firms in more than 150 countries, Deloitte brings world-class capabilities and high-quality service to clients, delivering the insights they need to address their most complex business challenges. Deloitte s approximately 200,000 professionals are committed to becoming the standard of excellence. About Deloitte Croatia In Croatia, the services are provided by Deloitte Ltd. and Deloitte Advisory Services Ltd. (jointly referred to as Deloitte Croatia ) which are affiliates of Deloitte Central Europe Holdings Limited. Deloitte Croatia is one of the leading professional services organizations in the country providing services in audit, tax, consulting, risk services and financial advisory services, through over 145 national and specialized expatriate professionals Deloitte Touche Tohmatsu Limited