n n technology n n

Risks Versus Value in Outsourced Cloud Computing

By Ross Tisnovsky
loud computing is one of the most widely discussed technology trends today. But its more than hype its a gamechanger in its ability to deliver value to a business. Cloud computing improves a companys ability to flexibly scale services up and down. It reduces costs; suppliers note that the cloud is an optimized environment, allowing the delivery of information technology services at a lower cost than enterprise set-ups. Cloud infrastructure can save 40 percent to 50 percent in up-front costs. And it allows pricing model flexibility, including paying per use, low or no up-front costs, no minimum spend and no longterm commitment. The IT industry is attempting to woo enterprise buyers to the cloud and, as with other outsourced business functions, financial services firms are among the early adopters. However, financial executives need to be careful when considering a move to the cloud. Although it can bring value, crossing through that gate also puts a company in a danger zone. Everest Research Institute has studied cloud computings value and risks and where it makes significant sense over a traditional enterprise set-up. Findings reveal that it is possible for some cloud adopters to encounter a negative business case and end up with more costly services than their enterprise set-up. One of the clouds risk characteristics is that the IT demand that most often causes many companies to consider the move is the most challenging area to serve from the cloud. Another key factor is that the cloud brings significant incremental risks to a conventional data center set-up. Buyers of cloud computing services need to understand the risks. The cloud brings challenges and some hidden risks that are not normally present in a

traditional outsourcing arrangement. The Cloud Computing Business Case The business case is based on the expected cost savings derived from each of four value levers: Utilization, scale, standardization and labor flexibility. For the most part, from purely a cost perspective, a cloud set-up makes significant business sense over a traditional enterprise set-up Because outsourcing suppliers aggregate the computing demand across their portfolio of customers, they drive higher system usage, reduce software, reduce facilities and their associated rental and power costs and reduce management costs. As illustrated in the exhibit on the next page, better utilization also reduces hardware spend and improves software license management. Buyers of cloud services also realize value from their suppliers economies of scale. Suppliers typically have a 5-percent to 10percent edge over most companies in their ability to procure large volumes of IT hardware and software assets at low rates. Standardization of assets and delivery processes, along with robust best practices, enables suppliers to have a leaner cost structure and be more productive. Use of standardized assets improves system performance by reducing cross-platform issues and enabling business applications to go live quickly, thereby reducing time for development and deployment. Suppliers can leverage offshore labor pools for low-cost application development skills and remote management for more efficient, cost-effective delivery. A suppliers large, geographically spread and diverse employee pool enables flexibility for faster provisioning of the right talent while achieving cost savings. The Risks of Cloud Computing Despite attractive value-creation levers, companies face multiple challenges in

adopting cloud computing. The lack of standards, need to ensure security and fragmented application portfolio have been well documented. But there are other risks, some of them hidden. n Lack of control over suppliers assets. The cloud brings significant incremental risk to a conventional data center set-up due to the buyers lack of control of the suppliers assets. Companies can encounter legal issues in data management or network latency. The cloud also increases risks related to technology lock-in due to the myriad of platforms, tools and software suppliers use to deliver services. n Suppliers incentive for overload. As suppliers use the same infrastructure to manage multiple clients, theres an incentive to overload the hardware platform to achieve higher utilization to improve its margins. They may also use some customers as test beds for innovations, which can impact system performance. In the early-adoption stages, thereve been numerous examples of companies experiencing system crashes in the cloud, with downtime ranging from 44 minutes to 22 hours. n Business continuity. Back-up and restore in the clouds multi-tenant client environment is more complex. Buyers are generally unaware of back-up practices and systems of cloud suppliers and cant control them directly. A risk of the cloud environment is that in times of capacity constraint customers may get lower priority for continuity services based on their cloud fee and usage. Customers need formal contractual clauses to ensure data remains available if the supplier goes out of business or is acquired and for data redundancy across multiple sites. n Regulatory non-compliance. Risks exist around the ability to comply with industry regulations because customers in a cloud environment seldom know the location of fail-safe, redundant data.

64

financial executive | november 2010

www.financialexecutives.org

Ownership of the facility storing the data also may be unclear. Though a significant value of cloud services is cost savings, the considerable risks make it imperative to not base a business case merely on cost savings. Buyers also should consider risk factors such as system downtime/availability, business disruption and regulatory noncompliance as well as demand information from suppliers regarding load balancing, back-up processes and data management policies.

Potential Downside: Virtualization Cloud services have a strong business case compared to a traditional enterprise set-up. But that case is not apparent when Example of Cost Savings from Hardware/software compared to a virtualized Reduction Due to Cloud Computing Model enterprise set-up. When a company has already virtualized its computing before adopting cloud computing, very little of the business case remains. In a pre-virtualized environment the value-creation lever of utilization has already been used. So, it diminishes the financial impact that the cloud derives from virtualization; it also affects the clouds potential value from the suppliers economies of scale, standardization and asset provisioning. Large organizations already running virtual data centers may not find added value from cloud services. The overhead can overwhelm the clouds benefits if a com1. There will be continued hype that fore, both buyers and suppliers need to panys environment is already virtualized. ends up putting a cloud stamp on share risk in the early stages. In addition, However, a cloud set-up may still make most IT services but does not make a real financial executives should experiment sense, from a cost perspective, if the change in service delivery. The hype will with deploying only noncritical, low-risk buyers IT demand is volatile. likely cause the cloud to become synonyapplications and services to the cloud mous with outsourcing. while evaluating their long-term strategy The Clouds Future 2. Industry consensus, in which buyers and approach to cloud computing. Suppliers need to address several issues would adopt the cloud as a main source Ross Tisnovsky (ross.tisnovsky@everest before financial executives can be of computing capacity and it will become grp.com) is vice president, Everest assured of risk mitigation. For one, the a mainstream approach to delivering outResearch Institute and ITO Research and need to address information security for sourced services. Price Assurance. He leads a team of anacloud-computing environments has been 3. Niche adoption, in which companies lysts in developing market trends and much publicized. Establishing standards are likely to eventually decide that the best practices in the IT outsourcing indusis another critical issue. System managecloud model is suited only to niche applitry and assist clients in pricing matters. ment standards are not yet developed to cation or industries or to niche areas

facilitate operations between private and other private, public or hybrid clouds. Currently, the outcome of standardization efforts is uncertain. The foremost standards body for cloud computing would need a minimum of 1 1/2 years to release standards, and adoption is uncertain because public cloud providers are not participating in the standards body. Further, suppliers are just starting to focus their attention on the need for robust cloud management toolsets. Three scenarios for the clouds evolution in the outsourcing industry could emerge:

such as small or mid-size companies. Each scenario has different endgames and likely winners, with the the third scenario niche adoption the most likely path. Industry evolution will depend on the extent of progress along key dimensions of buyer perception: Cloud inter-operability (mitigating the risk of lock-in on the suppliers proprietary platforms), security, migration services and cloud management and monitoring. The cloud is an emerging model for delivering IT services that brings potential for value but also significant risks. There-

www.financialexecutives.org

november 2010 | financial executive

65

Copyright of Financial Executive is the property of Financial Executives International and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use.