Looking at business yesterday vs. business today, one of the biggest differences is speed. Business moves faster today. Business cycles, market opportunities (and challenges), product lifespans—they have all been compressed. Five-year project plans? Long-term strategies? Yes, we all still prepare them, but they come out laden with more caveats than ever before. Whether you are a bank, a school, a store or a manufacturer, one of your biggest challenges—arguably the biggest one of all—is keeping up with the rapid pace of change.
IT has played a major role in this hyper-acceleration: high-speed networks, faster processors, virtualisation, analytics, mobile communications—they all are part of the big ramp-up. But this IT-led acceleration has a blowback all its own, putting more pressure on IT itself to continually adapt its applications, systems and infrastructures to these ever-changing business realities. Flexibility and agility are the order of the day in IT, and that’s a key reason why cloud services have grown in popularity.
Cloud computing is not a completely new idea—in some form or another, it dates back to the earliest days of computing. However, relying on a cloud provider to activate the IT spigot, rather than on your own internally hosted infrastructure, reverses decades of IT practices. Cloud computing is now an essential part of the IT mainstream. Proven. Here to stay. The question has shifted from “Can cloud enhance my business strategy?” to “Which cloud best fits my business strategy?” and even more importantly, “What cloud provider should I choose to support my strategy?”
Choosing a cloud provider is no easy task. The industry is still in its infancy, and new players constantly appear, offering a full range of XaaS options, i.e., X = S (Software), I (Infrastructure), P (Platform), St (Storage). New industry-use cases are emerging across public, private, hybrid and custom cloud deployments. Performance benchmarks are evolving, as are standards and regulations for compliance and security.
In the end, however, the most important element in choosing a cloud provider can be summed up in one word: you. Very simply, the right cloud provider for your enterprise is the one that can best support your business strategy. That’s why when we put together this overview of 10 key considerations any enterprise should follow when choosing a cloud services provider, that’s exactly where we started—with understanding your needs, goals and expectations as the critical first step. We also looked at how the cloud services industry is structured, as well as shadow IT, the hybrid cloud and other issues that bear on choosing a provider. Ultimately, it is so important to choose a cloud provider with the resources and focus to make your engagement all about you and your company.
INTRODUCTION
While the advantages of the cloud are huge for any IT-centric business, the path each business follows to the cloud is different. In some businesses, it’s a top-down effort. In others, cloud usage bubbles up from below, often through the adoption of consumer-oriented cloud services. Take the time to fully explore where you are in your cloud journey and where you hope to be over the next 18–24 months:
Many organisations are taking a cautious approach to the cloud, implementing relatively few cloud services as they carefully evaluate the cloud’s potential, the impact it will have on their company and the right approach to issues such as data security.
Other organisations have resolved their initial concerns over cloud usage and are intensely focused on using cloud services to obtain efficiencies and cost savings.
Finally, organisations that have long relied on the cloud to improve operational performance and lower capital expenses are moving into a new phase in which the primary role of the cloud is to help them implement innovative, differentiating business strategies.
There is no right or wrong approach. In fact, the road your organisation finds itself on may have as much (or more) to do with your industry and competitive environment than it does with any specific management decision about the value of the cloud. The point is this: Choosing the right cloud service provider starts with you—your needs and your goals.
WHERE ARE YOU IN YOUR CLOUD JOURNEY?
Being honest about where you are and where you are going is an important first step in choosing the right cloud provider. So is being clear about your goals for using the cloud. Typically, the benefits of using cloud services fall into two broad categories:
Cost savings: The primary motivation for any cloud initiative is typically cost-savings. Relying on a cloud provider opens the door to lower hardware acquisition costs along with savings on staff and operations including real estate, power and cooling. It’s the rare company that is not envisioning some or all of these savings. Many of these savings you can estimate accurately on your own, e.g., if you eliminate a data centre, you get rid of those operational costs. But to get a complete ROI analysis, you need information from your cloud provider. The thoroughness of this estimate may be your first indication as to whether this is a provider you want to do business with. Personnel savings are something to look at closely: A provider that offers low-cost cloud services may require that you allocate more internal personnel than you were planning to the administration of those services—upping your costs.
Agility: While saving money is often the initial attraction to the cloud, the cloud’s impact on innovation can be significantly greater than just the cost savings. By shifting the focus of IT from time-consuming operational chores, cloud-based services can free up time for IT innovation and strategic thinking. If you are counting on a cloud provider to give you more agility, it’s important to get a detailed understanding of what services are included in the provider’s offerings and whether or not they will really enhance your operational flexibility. Also, look closely at your skill sets: When you free up resources to focus on innovative, agile strategies, make sure you have the know-how in-house to make it happen.
WHAT’S YOUR GOAL?
Cloud services initially gained market traction as a way to streamline IT. Now they are increasingly seen as a way to help enterprises respond to key business trends, such as the following:
Mobility/Collaboration: With the dramatic spread of mobile technologies, companies are struggling to provide support for flexible work arrangements and enhanced collaboration. Cloud services can play a crucial role in this by providing secure solutions for bring-your-own-device (BYOD), enterprise mobility management (EMM) and virtualised desktops. This trend will continue with advancements in cloud-based collaboration tools, such as Microsoft Office 365.
Connected Devices: Many businesses now rely on a broad array of connected devices for managing their operations, such as connected thermostats in buildings, dashboards in cars and trucks and whiteboards in classrooms. This is what is known as the Internet of Things (IoT), and it is widely considered one of today’s most disruptive and far-reaching technology trends. Gathering, consolidating and compiling all of the data that these devices generate is being done primarily in the cloud.
Analytics: Hand-in-hand with mobility and the IoT is analytics, or “big data.” Real time access to sales, financial, demographic and other data can play a huge role for companies that are adapting strategies to more effectively compete in a fast-paced business world.
Depending on how these trends are playing out in your business, you will want a cloud provider who is up to the task. If mobility is critical, make a careful evaluation of the support a cloud provider can give you for BYOD, virtual desktops or increasingly popular Microsoft Office 365 implementations. If the IoT and/or analytics are high on your agenda, find out how a cloud provider has fared with current clients who have these priorities.
In many enterprises, these and other trends are driving “shadow IT” initiatives, in which business units circumvent IT and contract on their own for cloud services. Over time, many of these shadow efforts end up back in the hands of IT. If that’s the case for you, it’s important to get a cloud provider that has the range of services—and the flexibility—to help you address these challenges.
WHAT’S REALLY IMPACTING YOUR BUSINESS?
At the most basic level, nearly all cloud providers offer something very similar: access over the Internet to a virtualised infrastructure, with usage billed via a metered model. This does not mean that all cloud providers are alike. How cloud providers structure their offerings can vary widely.
The primary business strategy for many cloud providers is to enhance their profitability by maximising the scale of their operations. Their goal is to attract as many customers as possible to leverage these economies of scale. In some ways they could be characterised less as “service providers” and more as “private-label wholesalers of infrastructure.” To achieve that scale, these providers tend to rigorously productise their services, making their engagement more SKU-based, with customers (you) picking SKUs from a menu. Cloud providers who follow this model are incentivised to limit their SKUs, driving scale and reducing costs to achieve healthy margins (they hope) while pricing their offerings competitively.
It’s important to know if this model will sustain your cloud strategy over the long haul. If the SKUs being offered by the provider are well aligned with the way you see your needs today—and tomorrow— this may be the right cloud approach for you. If not, look at other options. A provider that is SKU-based is not going to change its stripes easily. Once you choose a provider, you are going to have to live with this engagement model, which may end up impacting how much you save on resources (people, budgets) and achieve all of the hoped-for agility.
Similar to a highly SKU-based business model, many cloud providers are primarily focused on providing access to self-service cloud resources, making it easy to “spin up” servers quickly and then spin them down just as easily. This capability is well suited to dev/ops, web server farms and similar on-demand use cases. It’s also a critical driver of shadow IT, enabling business units to deploy new capabilities quickly in response to market factors.
A self-service model can be a good approach if you have the right set of internal resources to perform these self-service functions and if your cloud efforts fall neatly into self-service-based initiatives. It’s not a great idea if you lack these resources or if you are one of the many enterprises that are likely to be mixing on-premises and cloud-based resources in hybrid deployments—for example, using a web application’s front end in the cloud and a fully managed, on-premises database running on one or more physical servers on the back end. Many providers that are self-service-oriented are unable to provide the integrated management lens essential to running these kinds of hybrid workloads. NaviSite has put a stake in the ground on this point, providing both managed and self-service options with management capabilities, including the ability to integrate with other NaviCloud® and NaviSite Managed Services.
HOW SELF-SERVICE ARE YOU?
Hybrid cloud implementations—a combination of cloud and on-premises resources—may well become the dominant use case scenario at most enterprises. If you are already leveraging a hybrid approach or see yourself heading down the hybrid cloud road soon, take a close look at how well a provider is set up for delivering on the hybrid promise. While the cloud has always offered the promise of adapting IT infrastructures to specific client needs, going hybrid allows for offloading to the cloud at a much more granular level. To do this successfully, you will likely need a provider who is up to the task of tailoring services to meet specific needs, including traditional compute resources, applications and IT management functions. As one of NaviSite’s hybrid customers, Warren Perlman, CIO of Ceridian, the global human capital management technology company, puts it like this: “Hybrid is all about letting you choose the type of organisation that you are, and focusing in on what you do best.”
Reliability is obviously an important consideration in selecting a cloud provider. No one wants latency and slow response times. A track record that includes repeated instances of these service lapses is a clear red flag. On the other hand, there is no provider with a perfect, unblemished record year after year. Outages are inevitable. How much weight you give to performance issues is likely to be influenced by where you net out on other considerations highlighted in this paper. You may decide that a provider with a less than ideal uptime but greater alignment on specific services is preferable to one that has higher marks on reliability but a less robust service offering. It’s a judgement call that only you can make.
As part of your evaluation of service reliability, key things to look at include the following:
Patterns of outages—times, days, seasons, particular kinds of workloads—these can give you greater insight than just the fact that outages occurred.
Safety nets in place to ensure service availability, such as backup power and cooling, and fire suppression systems.
Details of Service Level Agreements (SLAs).
Reports from existing customers on how the provider dealt with outages.
Outages can be the result of a wide range of factors, from momentary power blips to huge natural disasters. Among the most common culprits is basic human error. In that regard, before signing on with a provider, it’s worth getting to know the qualifications of the staff that will be responsible for your account: experience, certifications, supervision, training, etc.
EVALUATING RELIABILITY
Security is a major consideration in the world of the cloud. When companies report that they are reluctant to embrace the cloud, fear of a data breach is usually cited as a top reason. While the concerns over cloud security are understandable, they may be misplaced. Ultimately, because security is a dollars-and-cents issue, a cloud provider who is spreading security investments across multiple clients will have an edge over an enterprise that wants to implement this same level of security for just one client. The key is to find the provider who is really making the investment.
In evaluating any cloud provider, it’s critical to conduct a thorough review of the provider’s basic security capabilities, starting with perimeter defenses, patch compliance, network configuration, password standards, authentication schemes and encryption. Don’t take anything for granted. Keep in mind that in many of the highly publicised breaches that have taken place in recent years, fundamental controls such as rudimentary anti-virus protection and password requirements were found to be missing.
Look for clues as to how seriously the provider takes security. For example, does the provider take a pro forma approach to security (checking off the requisite boxes) or seek to make security a competitive differentiator? For example, at NaviSite, we let our clients know that we conduct internal audits every three months to remain current with SSAE 16 requirements.
Good security is a shared responsibility. You may well end up creating something like a Responsibility Assignment Matrix that lists key stakeholders both at your organisation and at that of the cloud provider and the major steps in the incident response process. Propose this idea to a potential cloud provider, and evaluate the response that you get in return. Find out if the cloud provider is doing this with other customers.
Don’t forget physical security. In today’s world, data centres can be targets for all kinds of thieves who may not only try cyber-intrusion, but also physical intrusion. When NaviSite recently opened a new data centre, the on-site security capabilities that were installed included 24x7x365 video surveillance, biometric dual authentication capabilities and cage-based T-DAR (Tailgate Detection, Alarm and Recording System) mantraps.
THE SECURITY DECISION
Cost is always a pressing concern in choosing a cloud provider. When factoring in the dollars and cents, make sure you are getting a spend that is both lower and smarter. Your overall objective should be to optimise your financial allocation given your technical and business needs and to keep that spend aligned with your needs as requirements change over time.
You don’t want to wind up spending limited budget dollars on services you no longer need simply because that’s how your provider bundles them. You also don’t want to keep doing things internally that you’d prefer to offload simply because your provider can’t modify your current engagement quickly and easily enough.
Cloud services that are seemingly more expensive at the outset may well become less so over time by providing you with more options for reallocating resources to where they will best meet the changing needs of the business. So if your mobile app goes viral or if you have to quickly pull off a megamerger, your cloud provider should be there to help.
An adage from the early days of computing held that “no one gets fired for buying IBM.” Like all such bromides, it was not to be taken literally. No doubt, plenty of people in IT lost their jobs whether or not they chose IBM.
The advice was really less about choosing one vendor over another and more about reducing risk by choosing a company that had the resources to be truly customer focused. Other companies might promise lower costs and unique products that make for a more attractive purchase, but all that will be forgotten if they lack the resources to deliver on their promises or if the way that they deliver on these promises is to lock you into services that fall short of meeting your needs.
As noted at the outset of this paper, cloud services are new and evolving. All of us— cloud providers and customers alike—are discovering unexpected opportunities to stretch our budgets and offload time-consuming tasks. And there’s no telling what services you will need tomorrow. What if customer demand spikes or troughs? What if you lose some of your technical talent unexpectedly? What if you suddenly acquire applications, people and/ or infrastructure through an unanticipated M&A event? All of these contingencies are your real risks.
To reduce the risks, choose providers that 1) understand the centrality of their services to your business and 2) take a value-centric approach to customer engagement, giving you the ability to continuously and granularly modify your engagement as required. In other words, make sure the cloud provider you choose makes the engagement about you.
