Ascent to the Cloud Four Focus Areas for a Successful Enterprise Migration by Michael Farber farber_michael@bah.com Kevin Winter winter_kevin@bah.com Munjeet Singh singh_munjeet@bah.com
Ascent to the Cloud Four Focus Areas for a Successful Enterprise Migration The trend toward cloud solutions is one that all Chief Information Officers (CIOs) must acknowledge and embrace, but the cloud is rarely as straightforward to utilize as they would hope. Moving any government or commercial enterprise to the cloud requires planning, support, and dedication. In many cases, technology is the simplest component with the real hurdles appearing in the enterprise s processes, operations, and organization. Booz Allen Hamilton, a leading strategy and technology consulting firm, experienced challenges, opportunities, and lessons learned during our own cloud journey. Through this endeavor, we identified four focus areas that are essential to the success of any cloud migration: (1) Vision, (2) Process, (3) Security, and (4) Governance. Each focus area has critical implications for the effectiveness and impact of the cloud technologies on an enterprise. Focus Area: Vision Booz Allen found that a clear vision from executive leadership must drive migration to the cloud and include organizational change management planned from the start. Though the first advocates of cloud technologies are often the boots on the ground who see the cloud as a way to operate faster and with fewer hurdles, this rarely leads to a successful grassroots campaign for enterprise cloud adoption. The reason is that enterprise IT consumption and individual IT consumption are very different things. Enterprises have networks, organizational units, policies, and processes that are affected by changes in technology, and require guidance and, more important, funding to evolve. The latter requires buy-in across the enterprise, while the former does not. The first step to enterprise cloud adoption is defining the key strategic motivators pushing you toward the cloud while recognizing that immediate financial motivations must be kept in check. An effective enterprise cloud migration actually costs money up-front for design, licensing, network configuration changes, professional services, and staff to implement. Any expectation for immediate financial savings without a willingness to make an investment in such a change is likely to derail the entire initiative. For Booz Allen, we envisioned a transition to a cloud-based IT infrastructure that would allow us to be an early adopter and present opportunities for innovating and transforming the business. Another critical step for the success of an enterprise cloud migration is the identification of one or more executive sponsors. These individuals must act as champions for the cause while listening and responding to the needs of the business. Executive sponsors should guide the enterprise toward cloud vendors and solutions that address those needs and inform decisions concerning when and how to move forward with these technologies. It is important to note that, although creating a mandate to shift IT resources to the cloud might be an effective way to achieve quick adoption, it may not achieve the universal buy-in that will lead to long-term success. Once the vision and executive support is in place, the enterprise can begin to address other organizational change management issues. Cloud concepts break traditional IT methodologies and ideologies in many ways. New operating principles, such as on-demand consumption and self-service provisioning, force an enterprise to redefine how it interacts with IT consumers. Likewise, scalability and elasticity make it possible to extend an enterprise into mobile and social domains that it may never have considered before. These changing paradigms will impact the structure and operations of an organization, but can be viewed as an opportunity for the enterprise that plans for these changes ahead of the adoption. Booz Allen, for example, used cloud adoption as the catalyst 1
to become a more service-oriented firm, moving away from a monolithic IT black box that consumers neither understand nor trust. Focus Area: Process Consuming off-the-shelf cloud technologies is easy, but making sure they fit the enterprise (or vice versa) is far from it. One enterprise unit where the adoption of cloud services will heavily impact processes is finance. This team may struggle with discussions about cloud services that operate on variable rates and shrink-and-grow pricing models because, historically, IT costs have been capital expenses with depreciating costs known in advance. In addition, where chargeback for cloud services is an enterprise requirement, there is significant effort required to develop repeatable and compliant processes for billing consumers for their usage. Compliance requirements complicate financial processes even further, especially when expensing costs to the government. In some cases, financial processes also involve legal aspects such as modification to enterprise disclosure statements, or defining licensing agreements with cloud providers. To manage this complexity, enterprises must proactively tackle these processes. Booz Allen did just that. First, we worked with our legal and sourcing teams to develop agreements with cloud service providers that allowed us to offer brokered cloud services through the same channels that staff were used to consuming legacy enterprise IT. Next, we developed estimation capabilities that enabled consumers to anticipate their cloud service usage costs, and we leveraged our legacy IT procurement and financial spend authorization models (by simply replacing known costs with estimates that establish not-to-exceed thresholds for cloud service consumption). Finally, we stood up processes to receive consolidated bills from cloud providers, and reconcile charges from consumers accounts according to their usage. This last step also enabled Booz Allen to benefit from volume discounts for its enterprise-wide consumption of cloud services. Manual solutions to enterprise process challenges are not sufficient. Processes must be automated to be scalable and allow for many consumers, many providers, and full adoption of cloud services. This is a maturity issue. Early on, as processes are being analyzed and understood, it may be possible to operate without complete automation, but this must be addressed for an enterprise to realize the fullest benefits of the cloud. Focus Area: Security Cloud services inherently bring uncertainty to users around security concepts that used to be very tangible. The lack of control over physical IT assets may appear to be a drawback, but the reality is that most, if not all, security capabilities an enterprise has historically expected can be deployed in the cloud. Sometimes these capabilities may look or feel different than what the enterprise has seen in the past, yet the end result is often the same. Deciding when and how to secure cloud services leads to questions of risk versus reward that must be made to determine the added value of these capabilities against the cost, the level of time investment required, and the impact their deployment will have on the enterprise. For most organizations, these decisions are driven by the level of risk tolerance of the enterprise. Regardless of where they fall on that scale, all enterprises should keep in mind that cloud service providers are aware of enterprise risk concerns and are actively working to achieve compliance with security standards (e.g., National Institute of Standards and Technology [NIST], Federal Information Processing Standards [FIPS], Federal Risk and Authorization Management Program [FedRAMP], and others). As a result, the future of cloud security will continue to improve. One of the biggest challenges regarding cloud services is that their usage is often unknown. Enterprises are already familiar with the concept of Shadow IT, but some cloud services are so invisible to the enterprise that they may not cast a shadow at all. Consumers can go directly to cloud service providers using non-enterprise devices or networks, making 2
it nearly impossible for the enterprise to know that services were even being consumed. This creates an inherent risk that makes it nearly impossible for the enterprise to determine where or when data breaches or malicious attacks occur, let alone understand their impact. One solution is to get cloud service consumers to voluntarily choose enterprise-approved and trusted cloud service providers whose services are verified to be secure. However, this may only work if the process is as simple and cost-effective for the consumer as it would have been to go directly to the cloud service provider. At Booz Allen, we worked to reshape how risk is identified, assessed, discussed, managed, and accepted with regard to cloud services. The legacy models of how to secure environments and the types of data they could entail had to be revisited so that they could leverage cloud capabilities such as creating virtual isolation barriers for cloud environments, building network peering points with cloud service providers to monitor and control cloud services network traffic, and deploying security capabilities alongside cloud workloads rather than in the enterprise. These have to be communicated to the consumers of the cloud services so that they understand the risks, responsibilities, and capabilities of these new technology tools. To achieve this, the buy-in and participation of many parties within the enterprise, not just the network operations staff, is required. Focus Area: Governance Working through the vision, process, and security challenges of the cloud are all important steps for successful cloud adoption. However, for an enterprise to maintain relevant, business-driven cloud services, it must also enact an effective cloud governance model. Important decisions relating to risk, impact, and the direction of future cloud services must be made through a collaborative, multi-tiered body that drives the clear communication of these decisions to the organization. This governance body should include business leaders, senior enterprise executives, operational and program leadership, and service delivery specialists. Standing up this kind of governance is not easy, since it requires coordination among a diverse set of staff who represent varying interests across the enterprise. Without effective governance, cloud services are likely to lose focus and relevance regarding the true business needs of the organization. This erodes one of the cloud s greatest differentiators: its flexibility. To address this need for cloud governance, we established a new cloud steering committee, supported by a cloud service management team and cloud delivery-focused teams. This model enables our firm to collect and respond to the demands and direct feedback of our cloud consumers while ensuring that our cloud program remains focused on the overall vision and business value. It also helped us establish a cloud framework that allows the firm to add and remove cloud service providers and their services without impacting the firm s IT service continuity. Key Takeaways for an Effective Move to the Cloud Enterprise adoption of cloud services is a challenging task. Utilizing the focus areas of vision, process, security, and governance to guide the journey will increase the potential for a successful migration that supports enterprise needs. Certainly, there are many other aspects of an enterprise cloud migration that should be considered when launching such a program, including how success is measured. However, these four represent the most significant areas where hurdles can arise and derail or increase the difficulty of the effort. With planning, support, and dedication, these hurdles can be addressed effectively, rewarding the enterprise with the many benefits that cloud solutions provide. 3
About the Authors Michael Farber is a Booz Allen Hamilton Executive Vice President who leads the Performance Advantage initiative within the firm s Strategic Innovation Group. Previously, he led Booz Allen s Strategic Technology and Innovation group, which focused on commercial markets, providing in-depth analysis and advice to corporate executives across the financial services, health, and energy and utilities markets who seek to maximize the business return on their investments in information technology. Kevin Winter is a Booz Allen Hamilton Vice President and Chief Information Officer (CIO) and is responsible for executing the firm s IT infrastructure strategy, which that includes migrating the firm to the cloud, leveraging virtual and mobile technologies to achieve greater effectiveness and efficiency, improving and optimizing the performance and security of our networks and systems, and ensuring our IT Infrastructure enables the delivery of services to our clients. In addition, Winter is aligned with Booz Allen s technology capability, specifically in the area of enterprise operations. Munjeet Singh is a Booz Allen Hamilton Principal, and currently manages the Dynamic Infrastructure practice within the firm's Strategic Innovations Group. Singh and his team specialize in deploying on-premise and public cloud computing solutions and have migrated thousands of systems and applications to cloud-based solutions for clients in the US Army, US Air Force, NASA, and Civil and Financial Services markets. Recently, the team integrated open source Business Rules Management Systems (BRMS) into the Army s cloud engine to develop automated dynamic scalability, and won the 2013 Red Hat Innovation Award in the Optimized Systems category. They are also working on deploying the first fully automated, end-to-end cloud brokering solution for the Veterans Affairs Department. We would like to acknowledge the writing contributions of Senior Associate Blair Miller and Associate John Winzeler that made this piece possible. Contact Information: Michael Farber Kevin Winter Munjeet Singh Executive Vice President Vice President Principal farber_michael@bah.com winter_kevin@bah.com singh_munjeet@bah.com 240-314-5671 571-346-4176 703-984-1320 4
About Booz Allen Booz Allen Hamilton has been at the forefront of strategy and technology consulting for nearly a century. Today, Booz Allen is a leading provider of management consulting, technology, and engineering services to the US government in defense, intelligence, and civil markets, and to major corporations, institutions, and not-for-profit organizations. In the commercial sector, the firm focuses on leveraging its existing expertise for clients in the financial services, healthcare, and energy markets, and to international clients in the Middle East. Booz Allen offers clients deep functional knowledge spanning consulting, mission operations, technology, and engineering which it combines with specialized expertise in clients mission and domain areas to help solve their toughest problems. The firm s management consulting heritage is the basis for its unique collaborative culture and operating model, enabling Booz Allen to anticipate needs and opportunities, rapidly deploy talent and resources, and deliver enduring results. By combining a consultant s problem-solving orientation with deep technical knowledge and strong execution, Booz Allen helps clients achieve success in their most critical missions as evidenced by the firm s many client relationships that span decades. Booz Allen helps shape thinking and prepare for future developments in areas of national importance, including cybersecurity, homeland security, healthcare, and information technology. Booz Allen is headquartered in McLean, Virginia, employs more than 23,000 people, and had revenue of $5.76 billion for the 12 months ended March 31, 2013. For over a decade, Booz Allen s high standing as a business and an employer has been recognized by dozens of organizations and publications, including Fortune, Working Mother, G.I. Jobs, and DiversityInc. More information is available at www.boozallen.com. (NYSE: BAH) To learn more about the firm and to download digital versions of this article and other Booz Allen Hamilton publications, visit www.boozallen.com. 5
Principal Offices Huntsville, Alabama Montgomery, Alabama Sierra Vista, Arizona Los Angeles, California San Diego, California San Francisco, California Colorado Springs, Colorado Denver, Colorado District of Columbia Pensacola, Florida Sarasota, Florida Tampa, Florida Atlanta, Georgia Honolulu, Hawaii O Fallon, Illinois Indianapolis, Indiana Leavenworth, Kansas Radcliff, Kentucky Aberdeen, Maryland Annapolis Junction, Maryland Lexington Park, Maryland Linthicum, Maryland Rockville, Maryland Troy, Michigan Kansas City, Missouri Omaha, Nebraska Red Bank, New Jersey New York, New York Rome, New York Fayetteville, North Carolina Cleveland, Ohio Dayton, Ohio Philadelphia, Pennsylvania Charleston, South Carolina Houston, Texas San Antonio, Texas Abu Dhabi, United Arab Emirates Alexandria, Virginia Arlington, Virginia Chantilly, Virginia Charlottesville, Virginia Falls Church, Virginia Herndon, Virginia McLean, Virginia Norfolk, Virginia Stafford, Virginia Seattle, Washington The most complete, recent list of offices and their addresses and telephone numbers can be found on www.boozallen.com www.boozallen.com 2013 Booz Allen Hamilton Inc. BA13-176