When IT Leaders Should Select Private Over Public Cloud Services

G00273092 When IT Leaders Should Select Private Over Public Cloud Services Published: 17 September 2015 Analyst(s): Donna Scott Many enterprises are taking a cloud-first strategy, opting for the speed and agility of cloud computing for infrastructure, platforms and application services. This research will help I&O leaders, cloud architects and brokers determine when to choose a private over public cloud computing model. Key Challenges IT organizations lack a decision-making framework for building, deploying and operating workloads on public and private cloud services. IT organizations do not know the costs of service delivery on the private cloud, and therefore cannot optimize their implementation or compare alternatives for placement. Surveys of infrastructure and operations (I&O) leaders point to an overwhelming desire for hybrid cloud computing, yet many are uncertain of how best to implement a hybrid environment. Recommendations Choose private cloud where you have stringent SLA delivery or for application performance requirements. Choose private cloud where you require greater transparency and auditability than the public cloud offers for compliance and regulatory requirements. Choose private cloud where there is a cost advantage, or where you have recently invested in data centers or infrastructure and you desire a return on your investment. Choose private cloud for Mode 1 applications with the need for more frequent releases. Table of Contents Introduction... 2

Analysis...3 Use Private Cloud Services for High Application Performance and Stringent SLAs... 3 Use the Private Cloud for Regulatory Compliance, or Applications Requiring Control, or Where Risk Tolerance Is Low...4 Use Private Cloud Services If IT Is Your Business...5 Use Private Cloud Services Where They Are Less Costly Than Public Cloud Services...5 Use Private Cloud Services for Mode 1 Applications Requiring Greater Agility and Frequency of Releases...7 Gartner Recommended Reading... 8 List of Figures Figure 1. Polling Question: How Much of Your Enterprise's Cloud Service Aggregate Capacity Will Operate in the Public Cloud Versus the Private Cloud in 2018?... 3 Introduction Enterprises are increasingly turning to public cloud computing to enable faster, frictionless services, which increase business agility and spur innovation. Public cloud computing fills a key role for innovation, and as a result, is forecast to grow at 15.2% through 2019. 1 Private cloud computing has the attributes of public cloud computing (see Note 1), except that the services are not shared with other enterprises; they are for the use of a single enterprise's business units (or shared only with its partners). The preponderance of Gartner's survey data points to significant use and investment in private cloud computing both now and in the future, and to the desire by nearly all enterprises to have a hybrid model of IT with both private and public cloud in use. Figure 1 presents a recent survey showing most respondents intend to be hybrid, with a weighted average of 64% private and 36% public (see Note 2). Page 2 of 10 Gartner, Inc. G00273092

Figure 1. Polling Question: How Much of Your Enterprise's Cloud Service Aggregate Capacity Will Operate in the Public Cloud Versus the Private Cloud in 2018? Source: Gartner (September 2015) The purpose of this research is to help enterprises understand when to choose private cloud over public cloud services. Numerous private cloud models, including self-managed and managed by a service provider, should be evaluated by enterprises that decide private cloud services are a requirement for them. Moreover, we recommend that enterprises reassess their decision framework for use of private or public cloud services annually (or more often, as needed) to account for changes in business strategy or priorities, changes in demand, and cloud service capabilities, as well as cloud provider performance against SLAs and expected costs. Analysis Use Private Cloud Services for High Application Performance and Stringent SLAs Some applications require configuration control of the underlying infrastructure and/or its specific locality to get the desired speed and performance. A minority of applications are for highly custom mission-critical applications, where speed and latency are critical to revenue or business performance. These may require physical systems, which may not be available in public cloud providers, but are available in the private cloud. For example, trading systems are highly customized for execution speed in both the configuration of the application and infrastructure, but also put in the geographic location where latency is least. Gartner, Inc. G00273092 Page 3 of 10

Moreover, many mission-critical applications have extreme SLAs at or near 100% availability and with end-to-end performance requirements. Most cloud providers will not contractually commit to these requirements, and IT organizations responsible for achieving the SLA will implement the applications themselves or with partners adhering to the stringent SLAs. These types of applications may operate in a private cloud, but may require their own dedicated infrastructure to achieve those SLAs in production. However, development and test environments will benefit from shared resources and greater business agility. Recommended Actions: Use the private cloud to operate applications that require highly customized infrastructure and configurability, including specific geographic location, to drive required performance. Operate applications with stringent SLAs in the private cloud, allocating dedicated resources where necessary for production, but sharing resources for development and test. Use the Private Cloud for Regulatory Compliance, or Applications Requiring Control, or Where Risk Tolerance Is Low Regulatory or compliance concerns often steer enterprises to prefer the use of private cloud, especially where personally identifiable information (PII) is at stake. One SaaS provider shared with us that it operates its own dedicated data centers with private cloud infrastructure in order to control the PII and to instill confidence in its customers, as well as to meet their need for business agility. Because most cloud service providers do not offer substantive guarantees, SLAs or penalties regarding data privacy and security, enterprise interest in private cloud is typically to have full control of the outcome. In addition, data sovereignty issues may require a data center in a particular geographic location, which may favor private cloud implementations (where public cloud offerings are not available). Moreover, flexibility and control in data movement may result in a preference for private cloud or on-premises implementations, as restrictions in replication or extraction may exist on data movement in the public cloud. Other regulatory or compliance issues involve transparency (or lack thereof) of cloud provider facilities and processes, which result in preference for the private cloud. For example, certain regulated industries must document the details of production all the way down to the physical infrastructure used. This also includes all the changes made to the infrastructure and by whom (list of names). Example industries include pharmaceuticals and medical device manufacturing. As a result, they choose private cloud over public cloud services for these applications. Enterprises with a risk-averse culture typically prefer private over public cloud services; however, they may be forgoing innovation in public cloud services as a result. Sometimes there is truly a low risk tolerance, and in other cases the aversion is more the challenge of getting educated and experienced on public cloud services and capabilities, including security (which is much more automated in the public cloud versus the private cloud, and requires a different set of skills and processes). Recommended Actions: Page 4 of 10 Gartner, Inc. G00273092

Use private cloud services if your business is regulated and requires greater transparency than public cloud service providers offer, or requires auditing and documentation down to the physical infrastructure level. Consider using private cloud services or placing your data on-premises (or in a colocation facility) for PII or data sovereignty, or if you are a risk-averse organization, or where public cloud services place onerous data movement restrictions. Use Private Cloud Services If IT Is Your Business This best practice is controversial and not universal. Enterprises with high IT spend (at a percentage of revenue of 6% to 10% or higher) are dependent on an engineering culture and IT innovation, as business and IT are singular and interdependent, not separate and isolated. There are many examples of enterprises whose business is IT and that rely tremendously on the public cloud for delivery of their services, such as Netflix, Zynga and many SaaS providers (that use third-party IaaS providers). Often, these companies are born in the public cloud, write cloud-native Mode 2 applications, and see their use of the public cloud as a means of focusing more on their business domain without being detracted from the skills and expertise required for data centers and infrastructure. Yet many others see data center and infrastructure engineering as core to their business and their products and services. Such businesses include service providers that offer IT services as their business model, as well as many IT, hyperscale and Type A enterprises (such as in the banking and telecommunications industries) whose business depends on engineering and IT agility. These companies typically prefer leveraging the private cloud for the cloud-native Mode 2 applications that differentiate their business. For example, one CIO of an IT company shared the company's strategy with Gartner to keep all intellectual property (IP) in creating their products and services in-house, in a private cloud, and over time, to move all corporate applications to the public cloud. The thinking behind this strategy is to protect theft of IP (from shared access in the public cloud) while also focusing their scarce resources on what matters most the competitiveness of their products and services. Recommended Actions: Use private cloud services (nonshared) for intellectual property, i.e., for engineering of products and services where use of public cloud services (and potential IP theft) could be a threat to your business. Use private cloud if IT is your business, and there is a real or perceived competitive advantage in doing so. Use Private Cloud Services Where They Are Less Costly Than Public Cloud Services Often, the costs of private cloud computing (including operating your own data centers and infrastructure) are moderately to significantly less than that of using public cloud services (when calculated over a three- to five-year period). This is especially true for production services that run 24 hours per day, seven days a week (24/7). The reason for this is that the rental model of IT works Gartner, Inc. G00273092 Page 5 of 10

really well for things that operate in a bursty manner for example, development and test that operate during the day but not at night. But when you run 24/7, you can compare using the public cloud to renting a car for 365 days (say, for $100 per day) versus buying and operating a vehicle. For those living in cities with high parking fees and requiring a rare use of a car, it is much better to rent, whereas those living in suburbia with the need for a daily use of a car will prefer to own. Similarly, investing in the capital expense of IT with annual depreciation can make it less expensive for private cloud services than public cloud services. IT leaders need to understand the difference between capital expenditure (capex) and operating expenditure (opex) some CFOs prefer capex over opex, as their accounting practices are built on that model. In such a case, investment in private cloud computing would be beneficial, too. Furthermore, IT organizations that have made recent investments in data centers or infrastructure will want a return on the investment and will prefer private cloud as a result. Sadly, however, many enterprises do not know the cost of service delivery. Understanding costs is requisite to making an informed business decision of public versus private cloud computing. In addition, understanding costs enables IT leaders to assess current service delivery methods and optimize them to improve cost, competitiveness and bring more to the bottom line, while still meeting service levels. It is encouraging that some enterprises are adding the role of the cloud service broker, with explicit responsibility for assessing when to use public versus private cloud services. Examples of companies making informed business decisions based on the cost of public versus private cloud computing include: A new business unit at a financial services company initially found that their internal costs of compute were roughly double the cost of public cloud services. After rearchitecting for Webscale IT, including the use of OpenStack and commodity infrastructure, their compute pricing became roughly 50% of public cloud pricing, with the savings going to its bottom line. A large software company has used Amazon Web Services (AWS) for infrastructure and data center capacity since 2007, in response to business need for agility. When it implemented its private cloud services, and changed its architecture and service/chargeback granularity, it found that internal services became significantly less expensive than external services. The company uses business analytics such as demand, cost, capacity, geolocation and compliance/security as factors in determining where to place workloads, and whether to build or lease data center space and infrastructure. Tapjoy makes heavy use of AWS in its delivery of marketing services. However, when it assessed the need for big data/analytics services (Hadoop), it found AWS to be significantly more expensive than an on-premises private cloud. In a three-year period, it acquired and operated a private cloud with five to 10 times more capacity than AWS for the same price. Many businesses find their costs of service to be near or on par with the public cloud compute costs. But many may also find that the data egress costs (for example) to move or replicate data out of the cloud provider, or between cloud provider regions, are excessive. Consequently, these enterprises will tend to operate data in a private cloud (on-premises or in a colocation facility) but may operate the application (such as Web and application services) in the public cloud. Recommended Actions: Page 6 of 10 Gartner, Inc. G00273092

If you do not know the costs of delivering IT services, commence a cost accounting initiative (with the help of the CFO and IT finance). Once application and services costs are known, compare them to alternative architectures and alternative providers to make informed business decisions to optimize costs either internally or through a service provider. When assessing public cloud costs, make apples-to-apples comparisons of all costs, including compute, storage, network bandwidth, data ingress or egress charges, exit costs, software licensing, and service and support costs, as well as on going supplier management and optimization. Some enterprises have a propensity for capital expenditures, and others for operating expenses. Find out if your enterprise has a preference, and use it to influence your decision on whether to use public (more operating expense) or private cloud computing (more capital expense). Use Private Cloud Services for Mode 1 Applications Requiring Greater Agility and Frequency of Releases Mode 1 applications are typically the most mission-critical enterprise applications including systems of record that cripple the business if they are not operating. Mode 1 applications are often monolithic in nature and are enhanced infrequently in major project initiatives where the focus is to upgrade without downtime. However, even Mode 1 applications benefit from agility to increase the frequency of releases (for example, for patches and new enhancements) and to enable Mode 2 application integration, to test them more quickly. Mode 1 applications requiring greater agility should be onboarded to the enterprise private cloud. While consideration should also be made for onboarding to the public cloud, often these legacy applications have deep integration with other on-premises applications and data, and a requirement to coexist together in the same place for performance reasons. Cost is also a factor, because many of these applications are persistent, run 24/7, and have a lot of data movement and storage that is typically less expensive to operate in the private cloud. Benefits of private cloud for legacy applications are twofold. First, development organizations can get their environments through self-service, to test their changes to applications faster and ultimately release them to production faster. In addition, organizations moving to continuous integration and continuous delivery will benefit from even greater automation and use of programmable infrastructure, and speed in development through release to production. Second, by moving legacy applications to the private cloud, the operations processes can be completely revamped to a more automated approach with fewer error-prone manual operations. This can be tricky, because these applications are often mission-critical, and there may be resistance in making changes that can cause disruptions or stability issues. Therefore, enterprises should choose initial applications for onboarding that are a little less critical in nature (that is, choose applications that will not stop your business if they are down) so that changes can be made, and new processes and automation tested and applied in a less risky environment. As practices are trialed and refined, and value gained, the overall culture will transform, and operations staff will gain confidence in the new approach and be able to take on the more critical applications. Gartner, Inc. G00273092 Page 7 of 10

Recommended Actions: Evaluate your Mode 1 applications, and target for onboarding to the private cloud the ones that would benefit from increased speed of testing and releases. Choose private cloud for Mode 1 applications that are persistent, run 24/7 and have significant integration with other on-premises applications and data (which need to coexist for performance purposes). Avoid the most mission-critical applications for initial onboarding to the cloud; rather, select those lower on the spectrum of mission-criticality (such as those in recovery Tier 2) that will better withstand unplanned downtime. Gartner Recommended Reading Some documents may not be available as part of your current Gartner subscription. "Survey Analysis: Cloud Adoption Across Vertical Industries Exhibits More Similarities Than Differences" "Assessing OpenStack's Viability for Top Use Cases" "Government CIOs See Expected Cloud Cost Savings Evaporate" "Cloud Computing and Its Impact on IT Economics, Finances and Planning Assumptions" "How to Use TCO and ROI Effectively to Justify Projects and Technologies" "Technology Building Blocks for a Successful Private Cloud Deployment" "Decision Point for Choosing a Private Cloud Implementation Model" "Decision Point for Application Placement: Cloud, Managed, Colocation or Do It Yourself" Evidence Gartner has conducted over 1,400 client interactions on private cloud computing in the past year. 1 See "Forecast: Public Cloud Services, Worldwide, 2013-2019, 2Q15 Update" Note 1 Attributes of Cloud Computing The key attributes of cloud computing are: service-oriented use Internet technologies share resources Page 8 of 10 Gartner, Inc. G00273092

metered by use elastic and scalable enabled via self-service (which democratizes innovation, by giving anyone access to create and innovate) Note 2 Hybrid IT Model Preference The survey was taken as an electronic audience poll at the Gartner Operations Strategies and Solutions Summit in June 2015 during a keynote session. As this was a conference that focused on infrastructure and operations leaders, the results of the poll may be somewhat skewed toward private cloud services; however, the results clearly point to hybrid cloud services as dominant. Gartner, Inc. G00273092 Page 9 of 10

GARTNER HEADQUARTERS Corporate Headquarters 56 Top Gallant Road Stamford, CT 06902-7700 USA +1 203 964 0096 Regional Headquarters AUSTRALIA BRAZIL JAPAN UNITED KINGDOM For a complete list of worldwide locations, visit http://www.gartner.com/technology/about.jsp 2015 Gartner, Inc. and/or its affiliates. All rights reserved. Gartner is a registered trademark of Gartner, Inc. or its affiliates. This publication may not be reproduced or distributed in any form without Gartner s prior written permission. If you are authorized to access this publication, your use of it is subject to the Usage Guidelines for Gartner Services posted on gartner.com. The information contained in this publication has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information and shall have no liability for errors, omissions or inadequacies in such information. This publication consists of the opinions of Gartner s research organization and should not be construed as statements of fact. The opinions expressed herein are subject to change without notice. Although Gartner research may include a discussion of related legal issues, Gartner does not provide legal advice or services and its research should not be construed or used as such. Gartner is a public company, and its shareholders may include firms and funds that have financial interests in entities covered in Gartner research. Gartner s Board of Directors may include senior managers of these firms or funds. Gartner research is produced independently by its research organization without input or influence from these firms, funds or their managers. For further information on the independence and integrity of Gartner research, see Guiding Principles on Independence and Objectivity. Page 10 of 10 Gartner, Inc. G00273092