Cloud Computing in France

Mastère Spécialisé –
Management des Systèmes d’Information et des Technologies

Specialized Master –
Information System and Technology Management
Cloud Computing in France,

A model that will transform companies:
decision mechanisms and impacts
Thesis presented by
Cédric MORA
cedric.mora@gmail.com
Tutor: Gilles MAUFFREY
Perimeter: Platform / Infrastructure as a Service, December 2009

SMB & Early Adopters, France.
Cloud Computing in France – A model that will transform companies
Contents
Context of the study
Thanks
I would like to thank all the persons that have helped me in the process of writing this professional
thesis.
My colleagues who provided me with valuable feedback all along the thesis:
• Lionel Pelletier, with all its experience as a CIO;

• Béatrice Rollet, a great marketing tutor; and
• Isabelle Issert de Braux, for all the legal information.
My family and friends for supporting me:
• André Farand, english proof reader;

• My family; and
• My friends.
My employer for offering me the possibility to work on Cloud Computing and letting me work on this
thesis during the internship:
• Francis Weill.
My tutor from HEC for giving precious feedback and helping prepare this thesis:
• Gilles Mauffrey.
The directors of this HEC/Mines Specialized Master:
• Marie-Hélène Delmond; and

• Robert Mahl.
And, of course all the other persons that I had the occasion to interview:
• Guillaume Plouin, from Octo Technology;
• Henry Peyret, from Forrester; and
• Shirish Srivastava, from HEC.
Cédric Mora
2 December 2009
Contents
Executive Summary
Cédric Mora
3 December 2009
Contents
Cloud Computing offers a new economic model to the IT department: there is a shift from a model
where an organization have to invest a large sum of money for limited resources that are managed
internally, to a model where the organization can rent resources that are managed by a provider and
pay them “for the use”. Platform-as-a-Service and Infrastructure-as-a-Service are two types of
services that enable an organization to outsource resources for the purpose of hosting specific
applications. A structured approach provides an occasion to the reader to look beyond the marketing
speeches, with some insight on the Return on Experience of French organizations:
• PaaS and IaaS can reduce cost but only if the application benefit from the economics
(temporal needs, burst);
• PaaS and IaaS can offer operational benefits for some organizations (SMES for example) but
it is also a way to choose the appropriate service levels and, thus, differentiate the level of
services;
• PaaS and IaaS offer specific new possibilities for the organization, and, for example
accelerate innovation;
• PaaS and IaaS raises issues on operational and strategic levels but the maturity of the
organization is never questioned, while it should be;
• Some French organization may not be interested in the model as it exists now; or
• Private Cloud does not reproduce a real Cloud environment and it is much more
complicated to create than Public Cloud (especially for SMEs).
Those findings are supplemented by decision mechanisms that will help French organizations by
creating the right framework for outsourcing. An organization will be able to determine:
• Whether an application can be outsourced or not with an eligibility matrix (according to the
Cloud strategy, the technical feasibility, the maturity, the risks, the ROI, the criticality, and
the governance);
• What are the needs to be taken into account when calculating the Return on Investment
(which also includes the risks, the type of project and the model of billing) what are the
other possibilities (Managed Service, Colocation, Private Cloud);
• For what usage a PaaS or IaaS service is best suited for (differentiation between new
projects and existing applications);
• How to choose the relationship model with a provider and how to choose this provider
(some providers are not in contact with their customer when other focus on a strategic
partnership); and
• How to take into account the existing environment when making this choice (internal and
external factors could ease or complicate the choice).
French early adopters that will use PaaS and IaaS services will be impacted in all sorts of ways on
their organization. When pushing the scenario a little further, we can see that the shift from the
“controlling an infrastructure” to “controlling a process” have consequences on the strategy,
systems, structure, shared values, style, staff and skills of the organization. This document identify
more specifically:
• How the processes of the IT department are impacted (control of provider services,
automated management);
• What happens to the projects in Cloud Computing;
• The solution given by the IT department to the Business units;
Cédric Mora
4 December 2009
Contents
• The consideration of IT to the strategy;

• The model for contracting with the provider, with Click-wrap contracts or custom-made
contracts;
• The potential new organizational model (Network-centric organization); and
• The new skills and values that must be developed by the employees (control of a process,
collaboration)
French SMEs and early adopters will be able to obtain information that will be very useful on the
processes to implement and consequences of the adoption of Cloud Computing.
Cédric Mora
5 December 2009
Contents
CONTENTS
CONTENTS ........................................................................................................ 6
I. Introduction ............................................................................................. 9
I.1. Context of the study .................................................................................................. 10
I.2. Terminology and perimeter of the study .................................................................. 11
I.3. SMEs (Small and Medium Enterprises) versus Large organizations.......................... 19
I.4. Objectives and construction of the thesis ................................................................. 21
I.5. Methodology of the study ......................................................................................... 24
II. Part 1 - Understanding why organizations need decision mechanisms ....26
II.1. Communication – “Everyone is talking about it” ...................................................... 28
II.2. Cost – “Toward a new economic model” .................................................................. 31
II.2.a. A complicated comparison ............................................................................................ 33
II.2.b. Comparison ................................................................................................................... 35
II.2.c. Platform-as-a-Service .................................................................................................... 37
II.3. Commodity/Product – “What are these services? Operational benefits and new
usages”.................................................................................................................................. 40
II.3.a. Benefits for the infrastructure ...................................................................................... 40
II.3.b. New usages.................................................................................................................... 43
II.3.c. Internal/Private Cloud Computing ................................................................................ 46
II.4. Consumer – “What companies are or could be interested in this new model?” ..... 51
II.4.b. Will SMEs use IaaS and PaaS services? .......................................................................... 51
II.4.c. Concerns regarding Cloud Computing for companies .................................................. 52
II.4.d. Cloud Computing: only for mature companies? ........................................................... 66
II.4.e. SWOT analysis of Cloud Computing for organization interested in the model............. 71
II.4.f. Early adopters................................................................................................................ 71
II.5. Corporation – "Why is it relevant to the strategy of the organization?" .................. 73
II.5.a. Balanced Scorecard ....................................................................................................... 73
II.5.b. Make or buy? ................................................................................................................. 74
II.5.c. Choice of the applications to outsource........................................................................ 77
II.5.d. Cloud Strategy ............................................................................................................... 83
II.6. Channel – “Provider: who, why and how?” .............................................................. 87
II.6.a. Different relations possible ........................................................................................... 88
II.6.b. Choosing the model....................................................................................................... 89
Cédric Mora
6 December 2009
Contents
II.6.c. Benefits and drawbacks of the models ......................................................................... 91

II.6.d. The providers ................................................................................................................. 92
II.6.e. Choosing the right provider........................................................................................... 96
II.6.f. Conclusion ..................................................................................................................... 99
II.7. Circumstances – “The environment” ...................................................................... 100
III. Part 2 – Impact on the organization....................................................... 102
III.1. Strategy .................................................................................................................... 103
III.1.a. Outsourcing is, by definition, a strategic decision ...................................................... 103
III.1.b. No longer restrict customers’ demands ...................................................................... 104
III.1.c. The IT Strategy ............................................................................................................. 104
III.1.d. IT, to influence the Business strategy.......................................................................... 104
III.1.e. Strategy maps .............................................................................................................. 105
III.2. Systems .................................................................................................................... 108
III.2.a. Internal reorganization of the IT department’s processes and management ............ 109
III.2.b. Realization of an application VS Migration of an application ..................................... 115
III.2.c. New Tools .................................................................................................................... 123
III.2.d. Impact of the new billing ............................................................................................. 124
III.2.e. Contracting .................................................................................................................. 125
III.3. Structure .................................................................................................................. 130
III.3.a. A important alignment for the IT department ............................................................ 130
III.3.b. A new organization? .................................................................................................... 132
III.3.c. Impacts on the decision making .................................................................................. 134
III.4. Shared values........................................................................................................... 136
III.5. Style ......................................................................................................................... 137
III.6. Staff .......................................................................................................................... 138
III.7. Skills ......................................................................................................................... 139
IV. Conclusion............................................................................................. 140
V. Bibliography .......................................................................................... 143
VI. Annexes ................................................................................................ 150
I. A growing interest for Cloud Computing – Google Trends ..................................... 151
II. Layers of Cloud Computing services ........................................................................ 152
III. Taxonomy of Cloud Computing ............................................................................... 153
Cédric Mora
7 December 2009
Contents
IV. Nicholas G. Carr’s electricity metaphor ................................................................... 154

V. ITIL - Information Technology Infrastructure Library .............................................. 156
VI. Some Cloud Computing Providers and Consulting Firms ........................................ 157
Infrastructure-as-a-Service providers.......................................................................................... 157
Platform-as-a-Service providers .................................................................................................. 158
Private Cloud Constructors and software firms .......................................................................... 158
Consulting Services ...................................................................................................................... 159
VII. Cloud Software ........................................................................................................ 160
Cédric Mora
8 December 2009
Introduction
I. Introduction
Cédric Mora
9 December 2009
Introduction
I.1. Context of the study

Without a doubt, the biggest IT subject this year 2009 in the media, on the Internet, or with the
professionals, was Cloud Computing [Annex I]. Behind this expression, being adopted by all actors in
this market (vendors or consulting firms), would lie promises of a new economic model to consume
IT resources, and a new technological model which was made possible through the underlying
technologies gaining maturity.
A first definition, proposed by the consulting firm Gartner is:
“A style of computing where scalable and elastic IT-related capabilities are

provided “as-a-service” using internet technologies to multiple external
customers.” (Plummer, et al., 2009)
Another one, submitted by the National Institute of Standards and Technology, has been largely
referred to by all the actors:
“Cloud computing is a model for enabling convenient, on-demand network access to a

shared pool of configurable computing resources (e.g., networks, servers, storage,
applications, and services) that can be rapidly provisioned and released with minimal
management effort or service provider interaction. This cloud model promotes
availability and is composed of five essential characteristics, three service models, and
four deployment models.” (Mell, et al., 2009)
Before detailing those characteristics and models, we will try to identify who is creating this trend.
Numerous articles have been published on this subject, in all types of press (economic, specialized or
generalist) and, every day, we see press releases of companies launching new services related to
Cloud Computing. Below are a number of examples of statements that we can read to get an idea of
the phenomenon:
• « Cloud Computing will be as influential as e-business » (Plummer, et al., 2008)

• « Not only it is faster and more flexible, it is cheaper. […] The emergence of cloud models
radically alters the cost benefit decision » (Financial Times, 2009)
• « IT departments will have little left to do once the bulk of business computing shifts out of
private data centers and into the cloud » (Carr, 2008)
The different players in the Cloud Computing sectors are:
• New entrants: Terremark (USA), Rackspace, GoGrid (USA), LinkByNet (France), Ghandi
(France), etc.
• Major IT Companies: Microsoft, IBM, SUN, etc.
• Telecommunications companies: Orange Business Services (France), COLT Telecom (Europe),
British Telecom, etc.
Cédric Mora
10 December 2009
Introduction
Terminology and perimeter of the study
• Constructors and software providers: VMWare, EMC, Citrix, etc.

• Internet companies: Google (USA), Amazon Web Services (USA), Salesforce (USA), etc.
• Consulting firms: Cap Gemini, Gartner, Forrester, IDC, etc.
Figure 1 - Actors of the Cloud Computing market
These companies are closely monitoring the different studies from all the IT professionals with a view
to getting a grasp of the trends in the market and respond to the client’s needs. Cloud Computing
services market should increase from 46.4 billion in 2008 to 150.1 billion dollars in 2013 (Pring, et al.,
2009 ). Inside these Cloud Computing services can be found different types of offers, and therefore
different types of usage. We will explain later those following concepts that one always encounter
with Cloud Computing: Software-as-a-Service / Platform-as-a-Service / Infrastructure-as-a-Service,
internal / external Cloud (Public / Private / Hybrid Cloud), virtualization, etc. It is important to
underline that the cloud computing market is segmented in different categories; the impact of the
above-mentioned concepts on the companies will differ depending of these categories.
I.2. Terminology and perimeter of the study

The objective of this thesis is not to cover all the questions raised by Cloud Computing services but to
focus on a specific and narrower perimeter. Before explaining what is the chosen perimeter and why
we decided to focus on this one, it is necessary to explain the different underlying notions.
First, we have to come back on the expression “new model transforming companies” and not only a
“new technology”. This is not one new technology called Cloud Computing but multiple existing
technologies which have gained maturity. In a first place, we can refer to three technologies
presented by Nicholas G. Carr (Carr, 2005):
Cédric Mora
11 December 2009
Introduction
• Virtualization, which enables the operation of several logical servers on a single physical
server;
• Grid Computing, which enables the utilization of an infrastructure acting as a single device
composed of shared, distributed, heterogeneous, remote and autonomous hardware
resources; and
• Web Services which enable a communication and data transfer between different
applications and heterogeneous environment using standards. The applications are turned
into modules that can be assembled and disassembled easily (Service-Oriented
Architectures).
We can add other technological factors rendering possible the Cloud Computing model:
• Optic fiber which offers a larger bandwidth limiting latency issues two zones far apart; and
• Consolidation (the average utilization rate of physical servers is very low in every companies
but these servers are still using nearly the same amount of energy and cooling; virtualization
improves these rates because resources are shared) and new machines that are created to
use less energy and need less cooling. This is linked to another big subject: Green IT.
Cloud Computing model emphasizes 5 key characteristics, existing thanks to these technologies, and
explained by the Gartner (Plummer, et al., 2009) and the National Institute of Standards and
Technologies (Mell, et al., 2009):
• A service-oriented technology, where consumer concerns are abstracted from provider

concerns, and that is ready-to-use SERVICE BASED;
• Services scale on-demand to add or remove resources as needed RAPID ELASTICITY AND
SCALABILITY;
• Services share a pool of resources to build economies of scale SHARED RESOURCES;
• Services are tracked with usage metrics to enable the “pay-as-you-go model” PAY PER
USE;
• Services are delivered through use of Web identifiers, standards, formats and protocols and
with an identical access UBIQUITOUS NETWORK ACCESS;
Cloud Computing professionals also agrees on three types of services [annexes II & III]:
Cédric Mora
12 December 2009
Introduction
Figure 2 - Cloud Computing layers (SaaS / PaaS / IaaS)
• Software as a Service (SaaS): The service provided makes use of the provider’s applications
accessible through a client interface, such as a web browser (ex: Gmail). The consumer
doesn’t manage or control the infrastructure, the network, the servers, the operating
system, the storage and cannot add specific development (even if there are limited user-
specific application configuration settings).
o Offers: Billing, Financials, Legal, Sales, Desktop productivity, Human Resources,

Content Management, Backup & Recovery, CRM (Customer Relationship
Management), Document Management, Collaboration Tools, Social Networks.
• Platform as a Service (PaaS): The service provided consists in the deployment of consumer-
created applications on the provider’s infrastructure and the use of programming languages
and tools supported by the platform (ex: Java or Python available on Google App Engine).
The consumer doesn’t manage or control the infrastructure, the network, the servers, the
operating system and the storage but he has control over the deployed applications, and
occasionally application hosting environment configurations.
o Offers: General purpose, Business intelligence, Integration, Development & Testing,

Database.
• Infrastructure as a Service (IaaS): The service provided gives the possibility to rent resources,
such as processing, storage or bandwidth, and allows the consumer to deploy and run any
software (operating systems and/or applications). The consumer doesn’t manage and control
the infrastructure but he controls the operating system, the storage, the deployed
applications, and occasionally networking components (firewall, load balancing). Some
providers offer to manage the application if the latter is not too specific and is compatible
wit the perimeter of their offer.
o Offers: Storage, Compute, Services Management.
Cédric Mora
13 December 2009
Introduction
These different Cloud Computing services have been presented in the configuration called « Public
Cloud » but it is possible to try to recreate some advantages of Cloud Computing on-premises,
creating a Private Cloud to share internal resources. Thus, we are seeing different types of
deployment models in the studies or articles being published by Forrester (Staten, 2009), the NIST
(Mell, et al., 2009) or the Cloud Security Alliance (Hoff, 2009):
• Public Cloud: Infrastructures are shared with a “Pay-as-you-go” model. This off-premise
virtualized infrastructure is easily accessible and can be managed through a portal of the
provider. The provider can make economies of scale: the homogeneous infrastructures are
shared with all the consumers and managed and updated by the Cloud provider. Consumer
can choose the infrastructure they need, and choose all the security elements and the
uptime (SLA). The first Public Cloud, and the most popular one, is Amazon Web Services EC2
(Elastic Compute Cloud) that is linked to other offers, such as Amazon Simple Storage. We
are also seeing an increase number of External Private Clouds offerings (off-premises): this
provides a way for companies to create a logically separated set of virtual machines, a secure
VPN connection to their own networks (Virtual Private Network is a secure tunnel through
the Internet from a corporate network to provider’s servers). It also enables the use of
existing security and management policies. Amazon Virtual Private Cloud is the best-known
offering of External Private Cloud.
Figure 3 - Public Cloud (Open Cloud Manifesto, 2009)
• Private Cloud: internal pool of resources inside the Date Centers of a company. Internal
Private Clouds are sometimes seen as a simple evolution of the classic Information System of
an organization but have some characteristics of Public Clouds (they use the virtualization
and dynamic provisioning). Private Clouds are companies who only want to use services that
are hosted in-house and do not want to share their infrastructure. This type of Cloud respect
the standard process and security policy of the company but doesn’t not offer as much
benefits and flexibility to the CIO: he always have to invest in the hardware and software.
IBM is one of the manufacturers that offer these types of solution for companies who want
to create an Internal Private Cloud.
Cédric Mora
14 December 2009
Introduction
Figure 4 - Private Cloud (Open Cloud Manifesto, 2009)
• Hybrid Cloud: combination of different clouds (for example Public and Private Clouds) that
allow for transitive information exchange and possibly application compatibility and
portability across disparate Cloud service offerings and providers utilizing standard or
proprietary methodologies regardless of ownership or location.
Figure 5 - Hybrid Cloud (Open Cloud Manifesto, 2009)
• Community Cloud: infrastructures, shared by several organizations, support a specific

community that has shared concerns (e.g., mission, security requirements, policy, and
compliance considerations). The US Government and NASA created a community cloud for
all US government agencies. This type of cloud combines two worlds: Public Cloud (different
entities sharing their infrastructure) and Private Cloud (specific organizations use their own
Data Centers and know with whom they share their infrastructure).
Cédric Mora
15 December 2009
Introduction
Figure 6 - Community Cloud (Open Cloud Manifesto, 2009)
The Thesis:
This thesis will discuss of changes and impacts on the Customer (IT departments, organizations) of
Infrastructure-as-a-Service, Platform-as-a-Service and the following types of deployments: Public,
Private and Hybrid.
We didn’t want to include Software-as-a-Service in the perimeter of the thesis because several
studies have been done on the subject in recent years since it is a well-known concept. The global
market of SaaS was 5.04 billion dollars in 2008 and should be 20.2 billion in 2013, which represents
an annual increase of 32% (Plummer, et al., 2009). We can see that a growing number of French
companies are already using, or will soon use, this type of service (Markess International, 2009):
communication (mail, calendar, web meeting, project management, …), human resources (human
resources, finance, e-learning, …), CRM and marketing, etc.
The Platform-as-a-Service market should represent “only” 2.26 billion dollars in 2013 with an annual
increase of 8.3% but the subcategory called “Platform Infrastructure” by Gartner should increase by
50.1% every year.
The most interesting market is the Infrastructure-as-a-Service market which should have an increase
of 53.8% every year, going from 0.96 billion to 8.37 billion dollars. This market creates a significant
amount of discussion and major companies are planning to sell this type of service: the electricity
metaphor is based on this (Carr, 2005). Like electricity, companies may consume IT resources as a
commodity: you pay for what you need every hour to a provider [Annex IV]. The term “Utility
Computing” is often used to define this possibility.
A look at Forrester’s TechRadar confirms that PaaS and IaaS still are in the creation phase but will
certainly bring medium or high value to the organizations.
Cédric Mora
16 December 2009
Introduction
Figure 7 - Forrester's TechRadar for Cloud Computing (Staten, et al., 2009)
Infrastructure-as-a-Service is the only component that will reach its next phase, according to
Forrester, and this will be possible because of the major investments that providers are doing.
Platform-as-a-Service is still interesting because it offers an alternative to IaaS, but that still let an
organization to develop specific applications. These subjects and their impacts in the companies will
be discussed in this thesis.
I could have only referred to the Public deployment model, which raises different questions and
issues of interest. But numerous companies may choose instead to create a Private Cloud and an
examination of this approach will tell us why some companies prefer that their infrastructure stay
on-premises rather than using Public Cloud services.
Outsourced applications have not been, so far, critical applications (even if all applications of a
company tend to be more and more critical) or specific ones (all companies need the same mail or
CRM applications: there is no added value). Outsourcing can be considered for all types of
organization, but some companies will find it easier to use Cloud Computing services than other
companies might. For example, SMEs uses more SaaS than other types of companies (Markess
International, 2009). They have an Information System that is rather young and/or simple and it is
easier for them to migrate to Cloud Computing services such as SaaS (Forrest, et al., 2009). The first
Cédric Mora
17 December 2009
Introduction
hypothesis could be that SMEs will tend, more than larger enterprises, to use all types of services but
we will see that they may not be the largest user of Platform and Infrastructure services. We will try
to identify which companies could be the “Innovators” and “Early Adopters” of the innovation
adoption curve (Rogers, 1962).
SUMMARRY:
The perimeter of the thesis is:
Perimeter
Entities observed Customers of Cloud Computing service
Services model Infrastructure as a Service, Platform as a Service
Deployment model Public Cloud, Private Cloud, Hybrid Cloud
Geographic perimeter France
Companies SMEs and Early Adopters
Focus in the organization IT Department and the relationship with the other
departments
We will not discuss:
• Software-as-a-Service, Green IT, Web 2.0, SOA, Data Center constructions, detailed
explanation on Virtualization;
• Countries outside of France (USA in particular where organization are more advanced);
• Impacts on and strategy of the providers, consulting firms, integrators, constructors and
globally, the IT ecosystem; and
• Advanced Change Management that must be implemented in the organization.
Cédric Mora
18 December 2009
Introduction
SMEs (Small and Medium Enterprises) versus Large organizations
I.3. SMEs (Small and Medium Enterprises) versus

Large organizations
Before detailing how will be constructed the reasoning of the thesis, we will look at the typology of
organizations.
In France, SMEs are organizations that have between 10 and 250 employees (IDATE, 2008). “It
represents a total potential market of more than 3 million businesses and 13 millions of active
workers. These SMEs are not a homogeneous population but consist instead of very varied economic
units. […] [They have] ICT integration logics and digital practices in IT and telecom procurement [that
replicates] this diversity.”
We can identify two types of SMEs:
• Independent SMEs: they only have their internal resources.

• SMEs that belong to a group: they have access to the resources of the parent company.
That occasionally translates into the IT department being more developed and linked to its
parent company IT department.
Large organizations have more than 250 employees.
All these organizations can be divided in two groups:
• Organizations where IT is the core business: Independent Software Vendors, eBusiness
websites;
• Organizations that uses IT to support the business.
These organizations consume IT services as follows (Jacod, 2008):

• IT and telecommunication services represent 5% of SMEs’ purchasing costs and 8% of large
organizations’;
• IT investment of SMEs are divided in services (50%), hardware (34%), and software (16%)
(Nassah, 2006); and
• 65% of large organizations use IT consulting and engineering services, where 42% of SMEs
in a group and 35% of independent SMEs do so.
The document shows that the arbitration between internal and external use depends heavily on the
status of companies. Independent businesses are moving more frequently to an internal solution,
while those who belong to a group are more likely to meet their needs both internally and externally.
In the latter case, the claimant may belong to the same group: 10% of services procurement, made
by companies belonging to a group, are done within the group itself.
The above also illustrates the fact that providing internal solutions for some services may be more
cost effective for smaller SMEs because of fixed transaction costs associated with outsourcing
(covering for example the search for a provider and the costs for the contracts).
Cédric Mora
19 December 2009
Introduction
SMEs (Small and Medium Enterprises) versus Large organizations
Figure 8 - Motivations for IT investment (Nassah, 2006)
We see on the above figure that IT investments for SMEs focus more on compliance than on the
consistency with its environment, which may indicate that IT could be perceived more as cost than
value.
This information will be very helpful for us to understand the environment in which the organizations
work and how Cloud Computing can be consumed by these 3 types of organizations.
Cédric Mora
20 December 2009
Introduction
Objectives and construction of the thesis
I.4. Objectives and construction of the thesis

The main objective of this thesis is to assist organizations in a better understanding of Cloud
Computing services. This “big Cloud” offers the possibility for the organizations to create and host
specific applications, using IT resources that will be managed by a provider, something which appears
both very interesting and dangerous at the same time. I attended numerous conferences from
December 2008 to December 2009 (9 events to be exact) and the reactions of the attendees were
quite simple and complex at the same time. They wanted to understand why this new services could
be interesting for them and how their use could affect them in any manner.
Only a small number of French organizations have already used these services; consequently they are
not completely understood overall.
The objective of this thesis is, essentially, to answer two questions:
• “How will the future organizations will be able to decide if Infrastructure-as-a-Service and
Platform-as-a-Service will be relevant for them, and if so in what will be the Cloud strategy?”
• “What is happening on a day-to-day basis for the organizations and their management?”
To answer these questions, we will divide the thesis in two parts:
(1) Understanding why organizations need decision mechanisms
The understanding is an important phase because organizations are facing something new, and like
for every novelty, some basics questions are raised. Knowing the new environments will help the
organizations establishing the right policies and processes. To globally understand these services, and
see at the same time where organizations will need decision mechanisms, we will use an approach
that is usually implemented in marketing: Marketing Mix. This approach, proposed by Jerome
McCarthy in 1960, is designed to take the right decision when an organization wants to launch a new
product or service. This first version is supplier-focused and has two important characteristics: it
gives an overview of the complete environment for such new services like Cloud Computing and is
very simple to understand, i.e. it only takes a few seconds to do so. A more customer-focused
approach of Marketing Mix was recently proposed by Koichi Shimizu in 2003 (Shimizu, 2003) and
2009 (Shimizu, 2009) and called 7Cs compass model.
The seven Cs are for:
• Communication (or Promotion): a lot of communication is done by multiple actors of Cloud

Computing and customers can be lost.
• Cost (or Price): Why is Cloud Computing an evolution of the way companies consume IT?
What are the principles and benefits of using such a model?
• Commodity (or Product): What are the services and operational benefits of these services?
Why Cloud Computing allows organization to do new things? We will see some Return on
Experience from Early Adopters and that organizations will have to differentiate two
scenarios: the launch of a new project and the migration of an existing application.
Cédric Mora
21 December 2009
Introduction
• Consumer: What are the companies which are, or could be, interested by this model? SMEs
and large organizations are not interested in every service offered by cloud providers
because of the risks entailed by their adoption. We will focus on companies that may find
some benefits from deploying custom applications in the Cloud. The question of the maturity
will be essential.
• Corporation: The choice and definition of the strategy of Cloud Computing services will be
one of the most important parts of the thesis, as it defines what is the global strategy for
using such services in coherence with the organization’s strategy. It also addresses what are
the applications that can be deployed in Public Cloud and what should you keep on-
premises: in other words, how can organization make the right choices?
• Channel (or Place): The choice of the provider is possibly the toughest one: it could be a
partner that will be responsible for some of your applications, potentially critical ones.
Should a company use multiple providers? What will be the role of the provider in the new
organization? What providers should be trusted for what type of customer and/or
applications? Answering these questions is essential to understand the place of the most
important player in this new organization.
• Circumstances: this part will allow us to conclude why and how an organization could use
Cloud Computing services with all the lessons learned, regarding its environment.
Figure 9 - 7Cs compass model
This “retro-marketing” allows me to have a structured approach of what and how organizations will
see the arrival of IaaS and PaaS services.
Cédric Mora
22 December 2009
Introduction
(2) Impacts on the organizations
Some fundamental impacts will happen in a company that uses Cloud Computing services. This part
presents these impacts on day-to-day activities and responsibilities of the IT Department and its
organization. So, what will change and what could be the best practices?
To present the impacts on the organization, I will structure the reasoning 7-S model framework used
by McKinsey because it is a good tool to understand how a company operates. Knowing how a
company operates will help me define the impacts on each factor. I will concentrate more
particularly on the Strategy, Systems and Structure parts, the “hard” elements, because they will
profoundly impact the other parts.
Figure 10 - 7S of McKinsey (Pacale, et al., 1981)
The 7S are for:
• Strategy: What are the impacts on the strategy when it goes from controlling an
infrastructure to controlling a process? What new strategies are possible now?
• Systems: What happen to the processes of the IT department? (ITIL, Build versus Run,
contract management)
• Structure: How can the IT department be aligned with the business strategy? Does a
company need a new organization? What happens to the CIO and the decision making?
• Shared values: Can an organization be still working in silos? A key element will be developed
in the corporation culture
• Style: Does the managers have to behave differently?
• Staff: What happens to the actual employees? New jobs created?
• Skills: What skills does the employees need in this new model?
Cédric Mora
23 December 2009
Introduction
Methodology of the study
I.5. Methodology of the study

Before making the choice of the subject of this thesis, I have consulted several articles and attended
some conferences where Cloud Computing was the main subject. Numerous books and reports have
been published on the subject but few talk about the decision and impacts linked to the choice of
Cloud Computing, and more precisely PaaS and IaaS.
Knowing that I wanted to focus on these aspects, it wasn’t easy to find valuable articles. Cloud
Computing is the most discussed subject of this year and it seems that everybody has something to
say about it. Gartner, Forrester or IDC provides companies with valuable information but it is not
easy to differentiate the reality and the message they want to convey to sell consulting services. I
needed to take factual information with data probing the message. Working for a provider, I was also
able to understand better what a customer can really expect for such types of Cloud services.
In the meantime, I have interviewed experts in different fields as I gained maturity on this subject,
and I also attended a number of conferences, and webinars covering the mater where I had the
occasion to ask various questions:
Interviewee - Organization Position
Henry Peyret – Forrester • Principal Analyst
Lionel Pelletier – COLT • Senior Executive advisor in the consulting team

“Professional Services”
• Ex CIO of PriceWaterhouseCoopers France, Sterling
Software INTL and SemaSchlumberger
• Participated in the adoption of eSCM in France
creating the French association aeSCM and ITIL
certified
Isabelle Issert de Braux - COLT • Lawyer, Head of Legal office, France
Shirish Srivastava - HEC • Teacher on Information Systems and Techology,

specialized in offshoring
Guillaume Plouin – OCTO • Director of the Cloud Computing offering

Technology (Information Systems Consulting firm)
• Author of the book “Cloud Computing et SaaS”, Dunod
2009
• Blogger of “Tendances.IT”, www.tendances.it
Béatrice Rollet - COLT • Head of Marketing of COLT Managed Services France
Cédric Mora
24 December 2009
Introduction
Speaker - Organization Conference Position
Christophe Baroux - Amazon Web Services – “Paris • Regional Sales Manager

Amazon Web Services Amazon Web Services User Southern Europe
Group" - 09/07/09
Laurent Letourmy – Amazon Web Services – “Paris • CTO

Cafe.com Amazon Web Services User
Group" - 09/07/09
Philippe Honigman - Amazon Web Services – “Paris • CEO

FTOPIA Amazon Web Services User
Group" - 09/07/09
Fabrice de Biasio – IDC – “Infrastructure IT & • CIO

Europe Airpost Cloud Computing” – 09/24/09
Karim Bahloul – IDC IDC – “Infrastructure IT & • Senior Consultant

Cloud Computing” – 09/24/09
Régis Mauger – BMC IDC – “Infrastructure IT & • CTO

Software Cloud Computing” – 09/24/09
Laurent Dupuytout – IT Management Partners – • CEO

AVS Consulting “Petit Déjeuner Cloud
Computing” – 12/15/09
Cédric Mora
25 December 2009
II. Part 1 - Understanding why

organizations need decision
mechanisms
Cédric Mora
26 December 2009
Part 1 - Understanding why organizations need decision mechanisms
Before explaining why Cloud Computing is a new consumption model, it is important to explain what
was Information Technology 40 years ago, what it is now and why there is a transformation. We can
roughly split this history in four phases.
The first phase begins in the mid-1950s with what we call “Mainframe Computing”. Mainframes are
in fact computers that were used by large companies for critical applications such as Enterprise
Resource Planning or financial applications (Wikipedia, 2009). A user would login to a simple
terminal, carry out his work remotely on the mainframe, and then logout. The work was saved on the
mainframe and the user could resume his work later from any terminal accessing that mainframe. All
the resources where centralized in large Data Centers.
This centralized architecture phase has been followed by a phase called “Personal Computing” in the
mid-1970s: the Personal Computer was accessible at home. All the computing power and storage
was in the local machine and not distant like it was the case for mainframes. Of course, it was
possible to work anywhere with this computer but it was impossible to access to organization’s data
from anywhere.
Figure 11 - IT investment in the years (Gillett, 2008)
The IT investment to GDP (i) ratio has been constantly growing since the 1950s. Each phase described
is split in two parts: the first one that experienced an increase of the CAGR (ii) in IT investment to
GDP ratio because of innovative technologies or models, and a second one that sees a lower or a
decrease of the CAGR.
A third phase began at the beginning of the 1990s, with the coming of enterprise applications and
internet, which is called “Networked computing”. During that phase were introduced key
technologies and standards that will define the future models.
Since 2008, everybody speaks of a new phase that we will obviously call “Cloud Computing”. We are
seeing again centralized architectures where enterprise servers, applications and data are not hosted
locally but in distant Data Centers. People can once again use and access those applications and data,
Cédric Mora
27 December 2009
Communication – “Everyone is talking about it”
wherever they are, using any type of devices: computers, laptops or mobile telephones. Like Scott
McNealy, founder and CEO of Sun Microsystems, said in the late 1980s “the network is the
computer”. In other words, all the intelligence is not anymore in the local computer.
That is not to say that nothing has changed between mainframes and cloud computing (Atos Origin,
2008). The cost is different: a mainframe belonged and was used by a single large company when a
Cloud Data Center can be used by multiple companies. Cloud Computing is a shared service:
companies can quickly access to cloud services without having to invest in large Data Centers to get a
world class infrastructure. Failure management is also different because hardware used to crash
even with redundant high quality components, whereas cloud computing is built around the
possibility that servers can crash. Failure of one or more servers doesn’t stop the global service:
thanks to virtualization, logical simple servers are launched dynamically and enable business
continuity. Interoperability is becoming possible with web standards (TCP/IP, HTTP, SOAP, REST, etc.)
when mainframes did not offer any possible interoperability. We will talk later of this subject that will
be a key success factor for Cloud Computing adoption. We can add the fact that Rich Interface
Applications are much more user-friendly than were green screen: an organization can easily access
and manage its resources with a user-friendly tool.
II.1. Communication – “Everyone is talking about it”

The previous figure shows that the new “Cloud Computing” phase knows a new growth in IT
investment. Does that mean that a lot of companies are investing or will invest in this new model?
Well, Cloud Computing providers are a key success factor because they invest massively in cloud
services, trying to create new offers and innovating. Every day, companies launch new services that
attract media and customer attention on this subject. We see some providers or consulting firms
organizing conferences, webinars and workshops, and try to give answers to the question: “how
organizations can benefit from these services?” This communication has met the interest of a large
number of SMEs and large organizations. The key success factors that are announced for an early
adoption are:
• The economic crisis: some studies shows that due to the recession, companies needs to
reduce costs and might have an interest in using Cloud Computing services (IDC, 2008).
When a company loose staff and reduce budgets, there are not plenty of solutions to
provide the same level of service to business units and still plan innovation. The cloud model
seems to offer a cheaper way to acquire and use IT and we will explain this new economic
model in the next paragraph.
• The quick wins of Cloud Computing (Linthicum, 2009). In theory, it is possible to quickly
access a service and thus, end-user can also quickly use new services. This simplicity offers
new ways to innovate: organizations can rapidly move from the idea to the implementation
and then stop if it doesn’t work.
CIOs are very attentive to these new services and what they can provide them. CIOs have different
stakes but one of their primary goals is the control of IT expenses (graphic 2). They need to reduce
their budget or allocate it in a different way and this is what the global communication targets.
Cédric Mora
28 December 2009
Graphic 1 - Cost structure of the IT/IS department (Gruau, 2009)
French organizations will have, in their majority, a How will you budget evolve in the
global budget that will decrease (Krawczyk, 2009). next six months?
Moreover, IT is the second department in terms of
budget reduction so French CIOs need to find ways
to spend less money. If we look at the previous
graphic, we can identify some actions that will
enable a CIO to reduce his budget (renegotiate
contracts, stop new projects, use hardware for a
longer period, …) and for a few years, virtualization
technology has been a real solution for a growing
number of organizations. This technology was and
still is massively presented as a good solution by the
media.
First of all, virtualization allows consolidation which

means that average utilization rate of the servers
will be better. It also means that IT departments
reduce their energy consumption because the Graphic 2 - Evolution of the IT budget (Krawczyk,
number of servers decreases. Secondly, the time 2009)
needed to install servers is substantially reduced so that there is a better use of the time by the
teams. But virtualization is much more than that: it creates flexibility, a higher availability and real
solutions to respond quickly to change. Approximately 50% of French companies have already
adopted virtualization. But even if it can procure a good Return on Investment, the upfront payment
for physical servers and the virtualization layer can be rather high. That’s why only 26% of SMEs are
using virtualization when, for large companies, it represents 80% (Bahloul, 2009). Internal Clouds,
created through consolidation of the Data Centre and virtualization, may be difficult to build because
of the requirement in terms of investment.
External Cloud Computing uses virtualization and offers a solution for organization to access to these
benefits (and more) without paying upfront, as we will discuss later in the economic model
Cédric Mora
29 December 2009
paragraph. Thus, Cloud Computing may be an economic response not only to solve some CIO’s issues
but also to be more reactive and innovative. The evolution of the IT infrastructure offers more
possibilities:
Graphic 3 - Maturity of the Infrastructure (Gruau, 2009)
This trend coincides with the evolution of the role of the CIO from a technological perspective, to a
manager that delivers value to the business units. The CIO who was a technical manager and handled
only administrative tasks is of a disappearing sort. Today the CIO shall be aware of the needs of the
organization, whether IT is viewed as a strategic asset or not. The communication around Cloud
Computing incorporates this idea that an organization needs to be more aligned with the business.
Cloud Computing could be a way to focus more on the level of services internal customers need and
how quickly they will get access to it, and not how it works or what are the technical difficulties due
to flexibility issues. Of course, one of the goals is to spend less money on recurrent - “Run the
business” – and more on innovation – “Change the business”. Organizations currently spend 20% of
their IT budget on innovation; the spending level could reach 40% in 2012 with this adoption (Gruau,
2009).
From what I have seen during the preparation of the thesis, all the companies communicating on
Infrastructure-as-a-Service and Platform-as-a-Service are, in their vast majority, presenting primarily
the benefits and only mentioning a few risks. It is becoming difficult to understand what are the real
differences between two services, offered by two different companies, and how either set of services
could be relevant for an organization. Some are using this trend to sell services which are already
being used, with the word “Cloud" labeled on it. In the next parts, we will try to understand exactly
what companies can expect from Cloud services and if it is possible to get the benefits presented.
Cédric Mora
30 December 2009
Cost – “Toward a new economic model”
II.2. Cost – “Toward a new economic model”

Cloud Computing brings a new economic model that attracts different types of directors in an
organization (CIOs, CFOs and CEOs). We will try to establish if it is something that may lead to Cloud
Computing adoption.
With External Cloud Computing, you pay for a service. It means you pay for an ensemble of
operations that you don’t have to do anymore in-house. Usually, when you run an application in-
house, you need: a Data Centre, where you will have a managed infrastructure, the operating system
and its monitoring, and all the people supervising the ensemble and doing the upgrades. Then, you
have the application running on top with all the maintenance, and you need to deploy the system
across your organization and train all the users in the organization. In other words, organizations
have to pay for everything that makes the ensemble works. In this classic model, organizations need
specialized resources in-house that have a lot of knowledge in different areas of IT.
Outsourcing and maintenance has been around for years in software development and companies
have learned to pay for this type of service. Cloud model goes beyond by outsourcing the entire
infrastructure and its management. In an Infrastructure-as-a-Service model, a customer pays for all
the management of its infrastructure (there is only one invoice), letting him handle only the
applicative layer, maybe his only business value (sometimes, the provider can also manage some of
those specific applications). With Platform-as-a-Service, the organization pays at the same for
middleware and other architectural applications. For the information, in a Software-as-a-Service
model, a customer pays for the entire application: he only takes care of the deployment and the
training in his organization.
Figure 12 - Customers pay for a service (Rollet, 2009)
Cédric Mora
31 December 2009
We can understand why this type of service could be easier to manage for a CIO. When Small and
Medium Businesses, that do not have a high amount of IT skills in-house, only need to pay for a
service, this translates in higher benefits, something we will explain later. This is one of the three
business benefits underlined by Forrester (Schadler, 2008): “Focus: Outsource non-core
competencies to a service provider. Using a cloud-based service provider can free up your IT staff to
focus on things that drive the business: customer service application; Web site service innovation, not
just another software upgrade.” The more you go down in the layers (from Saas to IaaS), the more
you need non-core competencies.
We will address more precisely below the concept of Infrastructure-as-a-Service.
The second difference with a more traditional model is that it is a “pay-as-you-go” service. What it
means, is that you don’t need an initial investment (CAPEX – for CAPital EXpenditure) but you only
pay monthly for what you use month after month (OPEX – for OPerational EXpenditure).
When you want to use a new application, the first thing you do is try to scale the infrastructure up to
the predicted demand (whether it is a business application that you sell to a customer or an
application that is for internal use).
With a traditional infrastructure, you need to do an analysis and which shall be very precise: if you
don’t have enough resources, your customers (business directions or customers) won’t be able to
use the service, whereas, if you over-provision, you will spend a lot of money on hardware you won’t
need. Very often, the solution is that you foresee the infrastructure you will need in a few months,
hoping that you made a good estimation and that you will have time then to scale it up if needed.
With an elastic infrastructure, you don’t need to predict the demand: you just scale up or down
every time you need to do so, which means that you pay for your actual use instead of provisionning
for peak.
Figure 13 - The infrastructure follows the actual demand

Cédric Mora
32 December 2009
We can see the 4 decisive steps on figure 2. The first step (1) shows that with elastic infrastructure,
the CAPEX disappears: you use a service, you don’t make an investment. This is the second benefits
that underline Forrester: “Funding: Pay as you go rather than spend upfront. Instead of paying
upfront for hardware, software, and consultants to set up and run your [service], you pay a [service
provider as you go]. This lowers the cost of launching new IT projects, which speeds innovation and
increases the number of projects that can be funded.” The main idea behind this is that it is easier to
speak with a CFO when he won’t have to make a huge investment and that he can quickly stop the
service in case of failure.
The second step (2) shows that when you have a growth in your activity, you must follow the
predicted demand if you have a traditional infrastructure. If it was a temporary increase (example :
before a crisis), you may have just made a re-investment for no practical purpose. As we saw before,
with an elastic infrastructure, it is still possible to scale your infrastructure down (3).
The fourth step (4) is a more threatening one: you lose customers or you don’t answer to business
needs because you didn’t rescale your infrastructure.
This scalability, created by Cloud Computing, offers significant financial benefits and reduces the
risks. Before Cloud Computing was available, the financial risk was taken upfront with no guarantee
on the return; now, financial risk is taken monthly and matches the return. Forrester’s third benefit is
more focused on delivery: ”Speed: Accelerate a project rollout. In one project, a financial services
company moved its employee portal to a cloud-based service provider and launched it in 60 days.
After 18 months, another firm is still building the employee portal in the corporate data center. The
difference? The cloud-based solution started with a prebuilt foundation.”
II.2.a. A complicated comparison

This difference between two models doesn’t really reflect the reality, as companies do not have only
two choices (in-house or cloud) but more. For several years, companies have already been using
different types of offers to manage their infrastructure. Between on-premise installation and Cloud
Computing, you can identify two more types:
• Colocation services: a company can put its own infrastructure in a provider’s datacenter that
authorizes colocation hosting. The company pays for the physical space, a basic supervision
and/or limited activities like backup but still have physical access to the hardware for the
management with its own employees. The benefit is that the company gets access to a
business class services without actually paying the expensive bandwidth and infrastructure
costs of developing its own datacenter.
• Traditional outsourcing (managed services): these IT providers offer defined set of services
to their clients: they monitor their client's IT infrastructure (shared or dedicated) and basic
applications and resolve any issues that arise within it. The main benefit for a customer is
that costs are known for management (provider’s employees manage the infrastructure)
with fixed price contracts. These providers may offer leasing solution, thus proposing a
service for which a customer doesn’t have to pay upfront all the hardware.
Cédric Mora
33 December 2009
Colocation services offer an economy of scale by sharing a Data Center, whereas traditional
outsourcing offers an economy of skill by outsourcing the management of client’s platforms. Cloud
Computing combines best of both solutions, as shown in the following matrix:
Figure 14 - Economies of scale and skill drive cloud computing (Schadler, 2008)
Considering these different solutions, some questions are raised: does a customer pay less when he
chooses a Cloud Computing service? Can he make a real Return On Investment (ROI)?
A first answer was given in a study called “Above the Clouds: A Berkeley view of Cloud Computing”
(Armbrust, et al., 2009) which propose an equation comparing a Cloud Computing solution to a fixed-
capacity Data Center solution (hypothesis: customer’s revenue is proportional to the total number of
users-hours):

#
.
!"
The left-hand side represents the Cloud Computing model (a usage-based pricing, by the hour): it
multiplies the number of users-hours by the net revenue realized per user-hour minus the cost of
paying Cloud Computing per user-hour. The right-hand side performs the same calculation for a
fixed-capacity datacenter by factoring in the average utilization including so nonpeak workloads (it
corresponds to the three other types: colocation, on-premise and traditional outsourcing). The
usable capacity of a datacenter is between 0.6 and 0.8, and it always needs overprovisioning when a
cloud vendor factor it in . The study says that “whichever side is greater represents the
opportunity for higher profit”.
This equation, rather simple, doesn’t really reflect the complexity of the question “Should I move to
the cloud?” It shows that, with the average utilization rate being lower than 1.0, the cost of your
infrastructure deployed in the cloud should be less.
Cédric Mora
34 December 2009
II.2.b. Comparison
Chris Fleck, conference speaker on Cloud Computing, compared the reality of infrastructure cost of
different solutions (Fleck, 2008):
Purchase – on Premise Purchase – at Colo Amazon Cloud
Type Price ($) Type Price ($) 1 year 24/7 - 1 year 24/7 - 1 month – 24%
100% 24% use use
• 5 Quad-Core • 15,000 • Quad-Core • 15,000 24x365x5 40 hours x 52 40 hours x 4.3

Servers Servers Amazon EC2 weeks weeks
(5x3,000 each) (5x3,000 ($.80 per high
• 1/2 Rack + each) CPU Server
• 750 • 750 instance hour)
Gigabit Switch • 1/2 Rack +
Gigabit
Switch
Total 15,750 Total 15,750
Hardware cost Hardware
cost
• Annual • 5,800 • Annual • 5,800

amortized cost, amortized
5% over 3 cost
years
• 0
• Assuming no • Colo fee's;
incremental 1/2 Rack +
• 8,000
real estate cost power +
• Annual power bandwidth
& AC cost • 2,000
Total annual cost 7,800 Total annual 13,800 35,040 8,320 688
on premise cost at Colo
Table 1 – Comparing costs
One may think that the use of Amazon Cloud Services is quite expensive. But it misses an important
cost for the first two types: the management cost of the servers. I believe that calculating the ROI of
an application will be very difficult because the management for the different types of the service is
not the same:
• On premises, you may not have employees monitoring the servers during the night, the
weekend or during holydays;
• At colocation, the servers only have a basic supervision, so employees may have to go to the
facilities to handle a problem; and
• With a Cloud solution, your servers are fully managed and you have inherent redundancy.
But, you must also have employees that regularly monitor and manage your cloud servers.
It must be emphasized that it is rather difficult to compare these costs, not only because the service
provided is not the same, but the underlying risks are also very different. A realistic comparison must
take into account:
Cédric Mora
35 December 2009
• The cost of the infrastructure: hardware and all infrastructure elements;

• The cost of the software: licenses, trainings, new tools;
• The cost of all the employees that are working on these infrastructures and applications:
from operation to monitoring, and from design to quality management, etc.;
• The cost of risk: what are the potential risks and cost associated (risk to do / risk to not do)?;
• The type of project: is it a new project, is it a migration? How will it work with the existing
infrastructure;
• The model of billing.
Any Return on Investment that does not integrate those parameters will be biased.
In any case, if an organization has a temporary increased activity, the only solution, where an
organization do not have to pay for a definitive additional server, is IaaS.
From another perspective, a customer must try to plan the number of servers that will be used
during the year even if it is difficult because of the new economic model itself: “You pay for what you
use” and do not forecast.
Karim Bahloul, senior consultant for IDC, talks about the new issue regarding
infrastructure management.
“With virtualization [and Infrastructure as a Service], it is easier to access to new servers. But
when you can quickly add new servers, the lifecycle may easily be not respected. You may pay for
more servers than what you really need (and the licenses that you may use on these servers) and
if there isn’t a real management with more automation tools, the price that companies pay may
be difficult to predict. The pay-as-you-go model can create some surprises.”
Chris Fleck has selected the provider Amazon Web Services (Elastic Compute Cloud – EC2) for his
comparison, and obviously the result would have been different with any other provider. Depending
on the provider, you may have to pay more for the storage, or the bandwidth (data in / data out).
Also the Quality of Service is not the same: every one of the providers has specificities so that it
becomes difficult to make a quick comparison to determine whether you will pay more - or less - at
the end with any of the solutions being offered (on-premise, colocation, managed services, all cloud
providers, …), except if you realize a real case-study on a specific application.
This complexity in the offers shows that it goes beyond a simple calculation and there are a number
of hidden costs in Cloud Computing: for migration, monitoring, having new tools to manage the new
virtualized environment (with trainings), growth of costs over time, etc.
But when a company wants to grow its IT infrastructure from zero, it has 2 options:
• Build it on-premise and own or lease the equipment; or

• Outsource the infrastructure (colocation, managed services, cloud services).
Cédric Mora
36 December 2009
New SMEs will find it difficult to build an IT infrastructure on-premise and, an up-front for a
colocation/managed services approach comes with a heavy burden in the current economic
environment. Even if the company can secure the necessary credit, the cost of the loan makes it
much more expensive over three years. SMEs will prefer to pay for resources they really use, and not
put up with the inherent complexity of the management of the infrastructure.
Existing companies that already have a complex IT infrastructure may have more hesitations if they
only look at the financial Return on Investment. But, as mentioned before, Forrester presents other
financial advantages for the CFO (Schadler, 2008) such as: “the balance sheet doesn’t carry an ever-
depreciating capital asset of hardware and software” or “financial risk is taken monthly and is
matched to return”.
Companies will have more benefits if their activities are seasonal (meaning that, very often, a
company needs more resources because of a temporary growth in the activity, for example during
promotion periods) or if they have an average utilization rate of their servers that is low. But what
happens if it is not the case? Even Amazon Web Services is beginning to offer services for a flat
monthly fee as opposed to a utility billing basis.
The fact that you may pay less with Cloud Computing services (ROI) is only one factor which has to be
weighed against all other benefits: pay-as-you-go (which also means stop-when-you-want), begin
simple and get flexibility. We will see the other benefits in the next part.
Laurent Letourmy, CTO of the French company Cafe.com, uses Amazon Web Services
to host the Facebook game called “IsCool” (5.5 million users) on 40 servers.
“I do not have a Data Center and certainly do not have employees that could manage the servers.
I had 2 solutions: use Cloud Computing services or Managed Services. I choose Amazon Web
Services because of its flexibility and the hardware abstraction: I can easily add or decrease the
number of servers. But the monthly price would have been nearly the same…”
II.2.c. Platform-as-a-Service
Some recent case studies show that Platform-as-a-Service may offer more savings and a better
Return on Investment than IaaS, under precise circumstances. In particular, staff-related savings
could be important during the application development period if an organization develops a new
application/system. This white paper, published by IDC (Perry, et al., 2009) details the costs of
application development for companies that uses traditional application development and
companies that uses SalesForce’s Force.com (a PaaS service). At every step of the application
development (design, model, coding, configure, assembly and integration, unit and system testing
and deployment), the 10 companies considered realized substantial benefits, thus decreasing the
overall application development cost savings by 76%.
Cédric Mora
37 December 2009
Laurent Dupuytout, CEO of the French consulting firm AVS Consulting, expert in
Cloud Computing solutions and realized integrations on PaaS platforms.
“A tender was done early this summer by a French group with international dimension. The
goal was to create a specific application to strengthen the IT governance process:
- Have the possibility to link each IT applications to one of the 20 countries where the
organization is located, link it to a domain or a function, and map it in the Information
System. Describe what are the areas of intervention, the subdomain, the providers who
manage the applications, the costs of maintenance, the criticality and the number of users,
and compare the results with those obtained in other countries. Being able to link projects
and make them evolve. Validate that the projects are consistent with the business strategy.
Compare the projects with the trends and other projects, etc.
- Creation of good ergonomics for users and administrators (i.e. user-friendly).
Ei Technologies responded to this tender with two solutions from its subsidiaries:
- AVS Consulting, with Salesforce’s Force.com PaaS service:
- Technologies: Force.com technologies (configurable data model, configurable user
interface, workflow models, models of reporting, do specific developments and integration);
- Implementation duration (consulting, analysis, integration): 1.5 months, 81 man
days.
- 1Genia, with a traditional solution:

- Technologies: J2EE development, BIRT Java reporting tool framework, Linux OS,
Tomcat servers, any DB;
- Implementation duration (consulting, analysis, integration): 4 months, 230 man days.
For the Total Cost of Ownership, the results where the following:
- Less than 3 years: advantage for the PaaS solution because the licenses are paid on a
subscription basis, and therefore there is no significant CAPEX, whereas the second solution
needs 230 man days to start;
- More than 3 years: balance between the two solutions (if we do not take into account the
ease of scalability).
An integrator will necessarily be more attracted by the second solution (occupation of the
teams) but, of course, the first solution was chosen.”
When dealing with the costs of Cloud Computing, we understand that these are different depending
on the scenarios:
• Is it a new project?
o The development of this application might cost less using PaaS services because
some tools are already integrated, making it easier to test, develop, deploy, etc. Staff
costs regarding the creation of a new application from the design to the deployment
Cédric Mora
38 December 2009
of the project are reduced because it is designed to work in the environment. We can
imagine that the experience curve effects might play a big role in reducing the costs
after the trainings. Development/Test, using IaaS services, has a main impact: the
resources needed for these steps are paid for a short period of time.
o Does the management of the infrastructure and platforms underlying the
applications will cost less on this environment (activity peaks, etc.)?
o Does the addition of new features will be simpler and, thus, less expensive?
• Is it an existing application that we want to migrate in the Cloud?
o What is the cost of the migration? Migration to PaaS services indicates major
developments because there are specific frameworks whereas the use of IaaS will
less impact the application.
o Will the application benefit from the new economics?
Figure 15 - Costs: New Project vs Existing Application; PaaS vs IaaS vs Internal IT
The main idea behind this new economic model is that companies can now consume IT infrastructure
more like a utility service, gaining new advantages. It doesn’t mean that everything is better with this
solution, and companies must create case studies and benchmark all the solutions before using these
types of services whether they are SMEs or large organizations.
Cédric Mora
39 December 2009
Commodity/Product – “What are these services? Operational benefits and new usages”
II.3. Commodity/Product – “What are these

services? Operational benefits and new usages”
We have seen that the new economic model, offering “pay-as-you-go” solutions, may provide
financial benefits for some organizations. We will develop below what are those services, and more
precisely what are the operational benefits that organizations can expect.
II.3.a. Benefits for the infrastructure

As we mentioned already, External Cloud Computing may offer access to a massively redundant
infrastructure and this, from the time of first payment. An organization that does not have sufficient
financial or human resources and, moreover, has not yet installed the processes to manage such an
infrastructure will be able to access a better and clearer uptime and availability - for example:
Amazon EC2 offers a 99.95% uptime (Amazon Web Services, 2009). That organization will also be
able to obtain different services, such as prebuilt foundation, provisioning or upgrades, and also have
access to a 24/7 customer support providing an immediate response to emergency situations.
Obviously, the latter is very difficult to create, either in SMEs or large enterprises. Depending on the
SLA needed for an application, the organization will have to choose whether Cloud services are
suitable or not.
The fact that companies do not own the infrastructure offers other benefits, such as space for
additional servers or the management of electricity and air-conditioning. Virtually, they can access
an infinite amount of resources.
I will present more extensively the three major benefits with a Return on Experience from various
organizations.
Figure 16 - 3 major benefits for the organization on an operational level
Cédric Mora
40 December 2009
Stop planning and doing tasks that does not create value with “Storage-as-a-
Service”
The best example for this is storage and archiving which, as Infrastructure services, can now be also
consumed with a “pay-as-you-go-model”. In a study carried out by Forrester on the growth of data
volume (Yuhanna, 2007), the 150 senior IT executives being surveyed worldwide indicated that:
• The volume of enterprise data is growing at 50% per annum, driven by a new-generation of
applications;
• There is a strong demand to retain data for business analytics, and trend analysis; and
• Data retention for legal requirements had increased (Winter, 2008).
This growth is causing serious performance and storage challenges. With 85% of the data production
comprised of inactive records, and 64% of the respondents saying that their enterprises have over
half of their databases residing on tier one storage solutions (iii), the costs of holding inactive data in
an environment are significant and unnecessary. A storage solution in the cloud could offer a way for
organizations to store non-critical data. Here also, companies get a clear SLA that they can match
with different types of use (legal archiving, data accessed on a more frequent basis, etc.). They don’t
need to order, and wait for, hardware storage to be accessible: the thin provisioning can be done
easily with cloud storage solutions and the installation and configuration tasks are now done by the
provider.
We do not find many organizations that publicly acknowledge that they use cloud services, but some
case studies of internet-based companies have been released. For example, 37Signals, a company
that is a developer and provider of business and personal productivity web applications, hosts its
data on Amazon Simple Storage Service (Amazon Web Services, 2009). More than for the cost
reduction entailed by the service, 37Signals has been attracted by such a service because of its ability
to deliver on a complicated task: “the […] time associated with maintaining a 1 terabyte file server
with full backups and zero downtime are significant when you’re living off managed hosting”. This
organization was facing the challenge of managing a booming issue, and storage-as-a-service
allowed them not to focus on non-core activities: “[…] turning up our storage offerings no longer
involves planning how to extend our cluster or deal with huge backups”.
Get access to enterprise class services with Infrastructure-as-a-Service

SMEs do not always have the resources to pay for an infrastructure that offer security, higher
availability and 24/7 management capability. One of the operational benefits of Cloud Computing is
to enable SMEs to obtain a higher level of operations service than the one they could normally
afford.
A French B2B company called Ftopia offers a secured and easy way to share documents on the web
between professionals. It offers an alternative to documents shared by mail or accessible by FTP, that
users may not find user-friendly. That company has already one hundred customers, including HEC
that uses the service to host the documents of students that create companies in the “Incubateur
HEC”.
Cédric Mora
41 December 2009
Philippe Honigman, CEO of the French company FTOPIA.
“I needed a secure infrastructure to host this service. We do not own the infrastructure: the
servers are in Ireland and managed by Amazon Web Services. Without such a service, it would
have been difficult to find resources to manage the infrastructure and offer a service suited for
companies. We let a professional operate on the infrastructure.”
Speed development with Platform-as-a-Service

IDC identified the operational benefits of the use of a PaaS solution on 10 companies - SE, medium
and large companies - in the world, compared to traditional in-house developments (Perry, et al.,
2009). The result of their study showed three key operational benefits:
Benefits Details
Faster to market Custom applications developed and deployed in 76% less time and
required 76 to 85% fewer developers hours
Higher quality Reduced Annual Downtime by 97% and 60% less time dealing with
the service desk
Accelerated pace of Tripled their output of custom applications and doubled annual
innovation enhancements from 1 to 2
Table 2 - Three key operational benefits of a PaaS solution
Key operational benefits are truly those which organizations are searching for, along with a new
economic model. With Platform-as-a-Service, developers from small, medium or large organizations
have an easier access to the services they really need, and their productivity is enhanced because all
areas of modeling, development, deployment or integration are already integrated. They don’t have
to focus on infrastructures and software, since those are managed by the service provider. No longer
does the IT personnel need to worry about keeping software up to date: this management is
automated.
The essential goal for organizations is to become more reactive by delivering an innovative
application quickly (for example, before a peak season), something which will contribute to a high
customer satisfaction (gain new customers, reduce churn, etc.).
I would have liked to see a study comparing multiple platforms, other than one tested (Salesforce’s
Force.com) because these types of service are really new and we don’t see a lot of Return on
Experience.
Cédric Mora
42 December 2009
II.3.b. New usages

Cloud Computing offer the possibility to do things that organizations would not do usually, or enable
the user to do things in a more efficient or easy way. In a word, these services enable them to do
new things with IT.
Temporal needs
The most well-publicized new use of Cloud Computing is the one done from The New York Times. As
Nicholas Carr says, “What does the cloud allow us to do that we couldn't do before?” (Carr, 2008).
The New York Times wanted to offer a website presenting all its archives. After scanning all
newspapers (11 million articles) in a format not suitable for online viewing and articles cut in multiple
documents, the NYT decided to translate four Terabytes of documents in a PDF format. After
uploading their documents on Amazon, they simply paid for 100 virtual servers for 24 hours to
convert them in this new format. What would have been impossible to do in-house (use several NYT
servers for a long period of time, or pay for servers they won’t need after their initiation use), is now
possible. In this case, an organization decided to create a temporary architecture to make a
calculation (like we can see with Grid Computing), a usage now accessible for any company.
Self-service for a punctual utilization

A more impressive use comes from a European company, The Server Labs, which was contracted out
by a client, the European Space Agency, which needed to carry out a set of calculation during two
weeks every six months, for a science project called Gaia. That project is a global space astrometry
mission with a goal of making the largest, most precise three-dimensional map of our Galaxy by
surveying more than one billion stars (Amazon Web Services, 2009). What that client is looking for is
essentially data processing. The fact that the clients don’t intend to use the servers all the time
makes them good candidates for Cloud Computing: when they need servers, they pay for it, and they
stop using them at the end of the calculation. The above-mentioned client was able to benefit from
the new economic model that transformed a 1.5 million euros in-house project (cost of servers
during several years to get the result in the same amount of time, management, electricity, etc.) in a
343.000 euros cloud project spent “as-you-go”. Also, a characteristic of the cloud made the situation
possible: the self-service aspect.
Cédric Mora
43 December 2009
350 Number of servers over the next 6 years

300
250
200
Number of servers
150
100
50
0
0 10,5 20,5 30,5 Months
40,5 50,5 60,5 70,5
In-house Cloud
Table 3 - Using Cloud Services offers a way to pay for an infrastructure only when the organization
needs to make a calculation
Quickly access the service to support an impressive growth

French companies have been created around such new possibilities. Below is a study case from
Laurent Letourmy, CTO of the French company Cafe.com that was presented in July 2009. This
company created a game on Facebook called IsCool where the goal is to give points to friends that
are cool. The one that has the most points is the coolest person on Facebook. Behind this simple
game, hides the most played game of Facebook in France and in the Top 10 in the world. Already, 5.5
million persons have played this game once in 229 countries in the world. What is impressive is that
the number of active users went from 1 to more than 800 000 every day in 8 months.
An impressive growth
1000000
750000
Number of
500000 unique users
250000 everyday
0
0 1 2 3 4 5 6 7 8
Mois
Table 4 - IsCool has been able to repond to an impressive growth
To understand better, if it was a website, IsCool would be the 25th most-viewed website in France
and the 2nd most played game website. The website faces a number of challenges, very similar to
those faced other organizations such as banks: an activity peak of 160 pages seen/sec, translating
into 10 000 transactions every second! The business model is also simple: online advertising and
selling of IsCool images.
Cédric Mora
44 December 2009
Laurent Letourmy, CTO of the French company Cafe.com, uses Amazon Web Services
to host the Facebook game called “IsCool” (5.5 million users) on 40 servers.
“This growth would not have been possible if we had hosted the servers in-house or through
classic managed services providers that do not offer such reactivity. There is a very long process
around hardware provisioning: purchase, negotiate, deliver, install, renew. In our case, we no
longer need to forecast or anticipate equipment orders and have virtual access to infinite
resources: the infrastructure, the network or the storage can be very easily scaled up and down.
Rapidity is a key element in the service but the largest benefit is flexibility, which is also good for
the team. An infrastructure that does not change frequently is a dangerous infrastructure.
Our project is now to officially launch IsCool in the United States and if we have the same
success, we could face two million unique visitors every day.”
Like the New York Times, IsCool uses the Amazon Web Services to host its platform. IsCool went from
a few virtual servers at first, adding 10 other servers after a few months, to approximately 40 servers
in order to serve efficiently a million users. The global service only stopped for around 20 minutes to
transfer data on these new servers.
Cafe.com was able to absorb the peak without having to plan a long time ahead: this is something
new for an infrastructure. Admittedly, many companies would like to take advantage of this, and that
is precisely what they expect when told about the potential benefits of Cloud Computing.
“Disaster Recovery Plan… as a Service”

We will see plenty of new usages around this new model under where you pay only when you really
need to use the resources. Another usage is the possibility to create “in the cloud” a backup site on
which will be hosted all the virtual servers. What is new here is that organizations that did not have
the financial resources to pay for backup Data Center (creating at the same time a Disaster Recovery
Plan or a Business Continuity Plan) can now have access to a second Data Center for which they will
pay only in case of an incident happening on their primary site. Numerous French and European
providers already offer this type of services (Frascaria, 2009).
Cédric Mora
45 December 2009
Graphic 4 - A few examples of new uses with Cloud Computing
Those few examples help to understand what French companies may find in Cloud Computing
services, and what they can expect. The common point for those companies is that Cloud Computing
can be used for new projects within the IT department or the organization; thus, there is no actual
migration of existing applications. It is relatively easy to launch such projects because of this new
economic model that does not oblige an organization to invest in the acquisition of hardware from
the very beginning. SMEs, as well as large organizations could be interested in this.
II.3.c. Internal/Private Cloud Computing

Companies that want to benefit from this new model without outsourcing their infrastructure can
create what everyone calls now a “Private Cloud” (Babcock, 2009): recreate the services inside the
organization. But what is exactly Internal Cloud Computing and is it financially and operationally
interesting? Who will use this type of services and why? The goal of this paragraph is to understand if
private cloud can be more relevant than Public Cloud Computing and, at the same times, help us
understand better what choices organization will have to make.
Basically, Private Cloud Computing (meaning internal Cloud Computing) is simply a new layer of new
technologies that organizations add over their existing infrastructure like virtualization, self-service
portals or chargeback systems.
What are the differences between Private and Public Cloud Computing?
If we look at the different notions underlying Cloud Computing, we can see that there are real
differences between Public and Private Cloud:
Cédric Mora
46 December 2009
Factors Public Cloud Private Cloud

Thousands of homogeneous servers Hundreds of heterogeneous servers
Resource pool
used by a large number of customers from the internal departments
Done by the provider with tools
Done by the IT Department (or
Service created to manage a large number of
outsourced with external human
management computers (the headcount for 1000
resources) but less optimized
servers is optimized) on a 24/7 basis
Enabled (pay-per-use without any
Upfront costs to acquire the
Pay-as-you-go upfront fixed costs, except migration
hardware (or leasing)
costs)
Inherent chargeback tools provided Chargeback can be configured with
Chargeback
with the service the right tools
Variety of software choices (operating
systems, application servers, Limited heterogeneity because of the
Scope of licenses
databases, middleware components, smaller scale of the operations
…) with negotiated prices
Large amount of servers with highly Cannot compete with the
Operational
automated operational management investments made by a provider in
efficiency
tools automating the process
Benefits for the customer who can More flexibility and quick
Flexibility / have potentially access to a massive provisioning but does not offer the
Scalability number of servers and resources very same level of flexibility as the
quickly resources are, in fact, limited
Service Level No framework guaranteeing SLA in a
SLAs can be defined.
guarantees private environment
Investment is limited as it is
R&D investment Core business of the service provider
constrained by the IT budget
Best in the industry (power architect, Existing data center personnel that
Human resources
cooling architect, systems architect) has to be trained
We can conclude from the above that Private Cloud Computing is not a revolution in IT but simply
the convergence of all the technical trends.
Some examples of Private Clouds

Europe Airpost is one of the first French companies that created a private Cloud using VMWare for
the virtualization layer in 2008. The private cloud was presented with VMWare at a conference in
September 2009.
Fabrice de Biasio, CIO of the French airline company Europe Airpost.
“Europe Airpost is unique in Europe because the company works day and night. During the day,
we have en activity of passenger transport and during the night, we have an activity of freight
(Quick-change). Our activity is important 24/7 and thus virtualization offered us a way to use
more efficiently our servers by consolidating the infrastructure. With a Private Cloud, we have
been able to create more easily a Business Continuity Plan.”
Cédric Mora
47 December 2009
As we have seen with the previous comparison, a Private Cloud offers more than the usage that was
made of it by Europe Airpost. A case study from Robert Lemos (Lemos, 2009) shows what a travel
booking firm gained by creating its Private Cloud using VMWare and BMC’s BladeLogic software tools
to manage its virtualized data center in 2007. Before using a private cloud, the organization had
some issues that impacted the business in some way. The SaaS software that was updated very often
contained bugs and configuration issues that had to be corrected on each physical server. Also, when
the demand increased for its SaaS service, it had to deliver, install and configure very quickly new
servers.
Creating a private cloud (meaning, virtualizing the data center and using tools to automate all the
processes) helped the organization eliminating errors due to update deployment to application
(incidents caused by configuration mistakes dropped by 90%) and deploying more quickly new
servers in case of activity peaks. The company has saved 1.15 million euros since 2007, including
staff savings, by reallocating resources to other areas of the business. If it simplified the
infrastructure, the Private Cloud also added challenges: “develop and implement best practices”
around the virtual environment and all the toolsets, and a greater capacity to manage the “on-
demand capacity” that can be delivered very quickly.
I think this technology (we can cannot speak here of new economic model) is the normal evolution of
IT infrastructure. Private Cloud Computing promotes all these new technologies and enables
organizations to make a first step on a service approach.
Henry Peyret, Principal Analyst at Forrester, is working on Enterprise Architecture.
“Private Cloud Computing is not Cloud Computing: there is no debate. Private Cloud only tries to
recreate in-house some benefits of the Cloud using the same technologies like virtualization. The
problem is that only large companies will be able to create a Private Cloud that may offer the
same service level, whereas Cloud Computing is accessible to companies of any size.”
Reality of the Private Cloud

A Private Cloud also enables consolidation of resources, and thus a better consumption of resources
(think Green IT); but it can also be quite expensive to establish and operate. With a Public IaaS, you
pay for a number of virtualized servers whereas, with Private Cloud Computing, you have to pay for
physical servers, the virtualization software/maintenance and the installation and configuration of
the hypervisor. Some constructors are offering “black boxes” containing all these parts together,
such as IBM CloudBurst, but you must either pay upfront (140 000€ for the simplest one) or lease it
Cédric Mora
48 December 2009
(4000€ a month for 36 months) which either way is a commitment. Thus, the Return On investment
must be carefully calculated.
So, why would companies create a Private and not use Public Cloud Services? We will see in the
second part that the decision for an organization to put an application “in the cloud” shall take into
account some security, privacy, compliance and other legal issues and not only be considered based
on the technical feasibility, the maturity or the price.
The Private Cloud is also presented as a first step for organization by all the vendors, like VMWare,
that promote a solution where organizations start using a Private Cloud and then will access Public
resources when needed.
Figure 17 - Linking a Private Cloud to a Public Cloud could be easy with the right technology
(Cavalliere, 2009)
The resultant solution is by definition a hybrid cloud that use resources from different clouds. And
that’s the reason why we are talking about Private Cloud Computing in this thesis because the
solution is not “everything in the cloud” neither “nothing in the cloud” as we will see later.
The creation of such a Private Cloud can be difficult to implement as SMEs may not have the financial
resources to invest in an all-inclusive box, which is also the case for large companies that need to
virtualize big parts of the existing infrastructure. Forrester indicates that the benefits are more
important for large companies because of the economics of scale, and the adoption of scalable and
standardized infrastructures (Ried, et al., 2009): “the economically required volumes can only be
achieved if the private cloud is available across all organizational units and for various kinds of
enterprise applications.” Forrester concludes by saying: “If [we] consider only the technological
infrastructure, the new private cloud paradigm is nothing more than the next generation and
evolution of adaptive and elastic infrastructure concepts.”
This subpart ends with the following figure presenting a global view of the detailed services to sum
up what the organizations will be paying for when they will use them.
Cédric Mora
49 December 2009
Figure 18 - A better understanding of Cloud services
Cédric Mora
50 December 2009
Consumer – “What companies are or could be interested in this new model?”
II.4. Consumer – “What companies are or could be

interested in this new model?”
The Consumer part addresses the expectations of the organizations regarding these new services. A
company facing this innovative trend has to consider if the services are answering some needs,
respecting security and policies, and if this company is mature enough to use them. Throughout this
part, we will see emerging the points of attention, that will define whether this model will be suitable
or not, and the decision mechanisms if a company chooses to use Cloud services.
II.4.b. Will SMEs use IaaS and PaaS services?

Our first hypothesis was that, because SMEs used heavily SaaS services, they could be the enterprise
using first Infrastructure services. As we can see in Figure 19, SaaS offers more business value than
IaaS and PaaS (subjects discussed in the thesis): business processes are addressed and not the
technical infrastructure.
Figure 19 - Navigation in the Cloud (Ried, et al., 2009)
It is easier for SMEs to buy business applications rather than just a basic infrastructure on which they
would have to deploy a specific application (and they usually use less customized applications). A
report from Forrester confirms that the first hypothesis is wrong: large companies will use more
infrastructure services than SMEs (Ried, et al., 2009): 62% of enterprises of more than 1 000
employees consider that IaaS may be a priority for 2009 (15% as critical, 21% as high priority, 26% as
low priority) when it represents 43% for SMEs (9% as critical, 15% as high priority, 19% as low
priority). Even if this report covers organizations in Europe and other continents, the numbers are
quite important and we understand that this is true for French organizations.
Cédric Mora
51 December 2009
“Cloud Computing adoption will be easier for SMEs because they do not always have the human
skills in-house, cannot hire resources that have a deep knowledge, maintain the applications and
infrastructure, and their business can grow very quickly. But this adoption will happen at the
SaaS level where they can still make use of some settings like Salesforce. PaaS and IaaS services
won’t be much used by SMEs that will prefer “on-the-shelf” applications that are based on best
practices. Those services will be preferred by the large companies.”
Does that mean that all SMEs will use only SaaS and all large companies will prefer PaaS and IaaS? To
answer this question, we can ask another question: do large companies only use custom application
and, vice versa, does SMEs only use off-the-shelf applications? Obviously, the answer is negative
because every organization needs to develop custom applications (using PaaS or IaaS) that will create
competitive advantages and will buy “off-the-shelf” applications when there is no added-value
expected. This represents the strategy of an organization which considers that there is a need to
spend money on services that would help differentiating that organization from another.
Béatrice Rollet, Head Marketing for COLT Managed Services France, a European
provider
“French SMEs are stakeholders of the large organization’s ecosystem. They have very often the
same needs that these large organizations have regarding: IT industrialization, collaboration,
traceability, etc. But SMEs will tend to favor more pragmatic solutions, simple to deploy, and
providing a quick Return on Investment.
Yet, Information Technologies are sometimes a strategic lever for differentiation for SMEs to
play against large organizations. These SMEs will be the quickest one to adopt IaaS and PaaS
solutions.
We can still observe that small enterprises, those that do not have a CIO, have a purchasing
behavior quite close to the behavior of an individual. Therefore, only technophile CEOs will
make the choice to use IaaS and PaaS offerings. SaaS solutions will certainly be preferred by this
type of organizations.”
II.4.c. Concerns regarding Cloud Computing for

companies
Cloud Computing is a new model and we can understand why companies may find an interest in such
a disruptive model, as we mentioned previously. Asking the question of the suitability of the services
Cédric Mora
52 December 2009
for the organization raises the questions of the potential areas of concerns. Some companies may
prefer to continue using internal resources (with a Private Cloud), or continue to rely on existing
resources, instead of entering into “the public cloud”. We will refer below to the concerns that have
been expressed in France on Cloud Computing, assess the likelihood that these concerns could
materialize and examine what impact they may have on the companies.
But first, it is interesting to analyze the concerns expressed by French CIOs. Five major concerns are
on their minds: (Markess International, 2009): data privacy (31%), business continuity (28%), quality
of service (28%), network issues (23%) and provider lock-in (20%). The other concerns were, in
descending order: identity and access management, interoperability, network dependency,
sustainability of the model, backup and data recovery and data location.
The list of concerns above is not based on experience but rather on the perception of French CIOs of
what could be the relevant issues. The concerns are mainly related to the fact that an external entity
will have its hands on the data and application of their organizations. Thus, they formulate a number
of questions, as follows: are the data safe? Will there be a reliable service that resolves business
continuity issues? Can I stop using the service easily? Those are the most common concerns when we
are talking about outsourcing.
Forrester recently published a checklist of all Cloud Computing issues that pretty much covers all
those CIO’s fears (Wang, et al., 2009) and help classifying those fears in three categories: Security
and privacy, Compliance and Other legal and contractual issues. We selected below those fears that
are relevant to Platform-as-a-Service and Infrastructure-as-a-Service and added the Maturity of the
model’s concern.
Area Topics Detailed issues

Security and Data segregation and No separation of data from other customers, data-at-
Privacy protection rest protection, data-in-motion protection, data leak
prevention, third party access to data (subcontractors),
no destruction of the data at the end of the service
Vulnerability Evidence of such a program, no external assessment
management
Identity management Can directly integrate with customers’ directories, no
Single Sign On
Physical and personnel Access to critical assets, no background checks for all
security relevant personnel, no employee access document to
customer data, no SAS 70 audit
Availability Low SLAs, no DDos protection, not enough capacity
during peak load, no plan for upgrades or patches
Application security No third party components testing
Incident response No procedure for handling a data breaching
(notifications), response procedures violate customer’s
own incident response requirements
Privacy Critical data is not properly masked, data collected
about the customer (logs), data storage, third parties
might have access to customer’s critical data (such as
Cédric Mora
53 December 2009
government agencies)
Compliance Business continuity and BC and DR not as robust as those of the customer
disaster recovery
Logs and audit trail Cannot accommodate timely forensic investigation
(eDiscovery), logs and audit trails for customer’s
regulatory compliance are not kept or no dedicated
storage to store those are available
Specific requirements Local compliance requirements violate those of the
(e.g., PCI, EU privacy, customer, not ISO 27001, SAS 70, CPI or Basel II
Basel II) compliant
Other legal Liability No recourse actions in the event of a security incident
and or failure to meet SLAs (financial compensation)
contractual Intellectual property Data or applications (including replicated and redundant
issues data) are owned by the provider; rights to information
by the provider
End of service support No specification on what happens at the end of the
service period (data delivered back to the customer:
when, how; data destruction: when, how), fees accruing
at the end of the service
Auditing agreement Provider does not accept any audit
Personal data Location of the data
Maturity of Provider lock-in Lack of standards to easily switch providers or back-
the model source a service
Interoperability Lack of standards to be able to use different services
from different providers
Network issues and A network going down may be synonym of a service cut
dependency
Sustainability of the Providers currently offering those service may stop
model doing so in the future, as trend could go down the
investment regarding this model cease
Table 5 - Cloud Computing issues checklist - Adaptation from Forrester’s "How Secure is your
Cloud" (Wang, et al., 2009) and Security Guidance for Critical Areas of Focus in Cloud Computing’s
report (Cloud Security Alliance, 2009)
Depending on the choice of the provider and the service, an organization is likely to face different
issues. We will detail those issues in the “Channel” part.
Below are outlined four areas that organizations need to analyze before using Cloud Services; a fifth
area which is generally underestimated, is also mentioned. Companies that have issues regarding
those areas may find Public Cloud Services not suitable for them.
Security and privacy

Security is and always will be a major concern in IT because an information system of an organization
that is not protected may have a significant financial impact on that organization’s activities, or even
Cédric Mora
54 December 2009
endanger its existence. Most large companies, and some medium organizations, even have a Chief
Information Security Officer (CISO) who is responsible for security communication throughout the
organization, Risk and Control Assessment, threat and vulnerability management, and Identity Access
Management. With Public Cloud Computing, the CISO and/or organizations may find it more difficult
to define security rules and use the same processes on-premises and off-premises. But all security
issues do not have the same impact on the company and the majority of these issues can be resolved
by choosing the right service, asking all the necessary questions and updating the processes that will
supervise the service.
Figure 20 - Classification of the issues regarding Security and Privacy
As we can see in Figure 20, several issues can have a serious impact on a company. Some of them,
underlined in Table 5, need to be described as they will create “Go” or “No Go” situation for some
organizations.
Regarding Data Segregation and Protection, organizations need to know that one of the benefits,
which is “Shared resources”, can be an issue. If the organization has a policy prohibiting or limiting
the sharing of resources among multiple providers, the CISO won’t be able to choose a provider
offering shared storage services, or cloud services that share storing. He will need to specify that he
needs dedicated storage and thus, won’t be able to benefit from the economics of scale.
Most of the providers also have subcontractors that can have access to data that are not encrypted:
some outsourced tasks can be storage, archiving, monitoring or support. Customers of those
providers should ask if their provider have subcontractors, where they are located and what are their
roles.
As most providers offer different services that do not encrypt data, organizations need to apply the
maximum level of security possible to the service provided. For example, an organization should
never put any data in the cloud without encrypting them first. In this connection, Amazon Web
Services stipulates in its contracts: “You are solely responsible for applying appropriate security
measures to your data, including encrypting sensitive data” (Amazon Web Services, 2009).
Cédric Mora
55 December 2009
Vulnerability Management is one of the strategic roles of the CISO and he needs to know what is
the program of the provider to ensure that it matches the one of the organization. Organizations
need to be aware that not all providers will give details regarding matters such as how often they
scan their infrastructure and applications for vulnerabilities, what is their vulnerability remediation
process or whether they have the possibility to externalize vulnerability assessment.
The physical and personnel security issue might be very difficult to resolve as we cannot imagine
large providers (international or French) communicating information, before the signature of the
contract, on what type of verifications are done on the employees that have access to the customer
organization’s data. Nevertheless, we can easily imagine, for extreme cases, the seriousness of what
could happen if there is no restricted and monitored access to critical asters on a 24x7 basis and no
background checks have been realized on the personnel.
With the incident response issue, organizations face something much more problematic: the fact
that they don’t get informed when there is a data breach or other incidents. The majority of
providers will not carry out pro-active monitoring, or inform the customer of what the incident
response procedures were in a particular case, if the customer does not pay an additional fee. The
danger, of course, is that the provider may not respond appropriately to security issues of all the
types of companies that use the service, as all of them have security specificities.
Finally, privacy issues constitute the second major category of issues generated by the Cloud
Computing services because if critical data are stored in the Cloud, organizations know that they lose
some kind of control over those data. Even data collected about the use of the service (logs) mean
something that can be critical information for an organization.
Lionel Pelletier, Senior Consultant at COLT, has been the CIO of numerous French
organizations.
“Security is the biggest concern around Public Cloud Computing Services. CIOs will need a proof
that the data and applications are safe, otherwise they may continue to use internal resources.
Even if Cloud Computing abstracts, by nature, the location and operational details, organizations
will need more transparency on where the calculation are done and what are the rules and
process in place to handle the risks.
CIOs will certainly put non-strategic applications in the Public Cloud: this will impose a new
division of applications depending on the type of cloud.”
Of course, when we consider all the potential security and privacy issues, we tend to be afraid of
what could be the impact of those issues on the organization; however, such fear misses the point on
two aspects:
• All SMEs and some large companies may not have all the security policies that some of those
providers offer. How many organizations have an ISO 27001 (Information Security
Management System standard) or SAS 70 (professional standards used to assess the internal
controls of a service organization) certification? Providers can make significant investments
Cédric Mora
56 December 2009
in the security of the infrastructure because this is a core activity; they may also employ
experts in this field, with a dedicated security team.
• Major security threats are, in the reality, created by organizations’ employees when they lose
some data on private storage components, or change job from one company to another.
Christophe Baroux, Regional Sales Manager Southern Europe at Amazon Web

Services.
“We understand that our clients need guaranties regarding security and privacy issues. We
produced a white paper that defines what is security at Amazon Web Services (Amazon Web
Services, 2009). Organizations face everyday security issues that Cloud Computing can solve
when employees lose their unprotected USB key or laptops. Of course, we know that some
companies like Thales or the CEA won’t be able to use those services because they need a high
level of security and their policy forbids it.”
The main difficulty for an organization is to accept that some providers will not make arrangements
for an external audit. As a consequence, the organization will have to trust that its providers actually
implement the right level of security depending on the applications or data outsourced.
A recent study from Forrester showed that on 231 French decision makers interviewed, security is on
top of their mind (Gillett, et al., 2009):
• 39% of large organizations; and

• 50% of SMEs.
The problem is thus shared by all the size of organizations.
Compliance
Even with Cloud Services, organizations have fundamental protection requirements for business
continuity, disaster recovery, forensic investigation or other specific requirements. It is their
responsibility to choose the right service and still achieve compliance.
Figure 21 - Classification of the issues regarding Compliance
Cédric Mora
57 December 2009
Cloud Computing brings the idea that organizations may not have the possibility to preserve or
produce required digital information business information and records. Organization that have
programs on Records Information Managementi will have a serious difficulty to integrate those
services in the programs. This subject is often an integral part of corporate governance and should be
treated very carefully with a provider, as it is used in legal proceedings for compliance audits,
regulatory reporting (tax records, environmental discharge reports), internal investigations and civil
litigation. Applications and data hosted in the provider’s environment should be analyzed within a
global Information Lifecycle Management. The chosen provider for such applications will need to be
able to give access to these logs as long as needed, even when there is multitenancy.
Business Continuity and Disaster Recovery can be offered by some providers when they have
multiple Data Centers but there are two difficulties:
• The service may only use one Data Center; and

• The organizations should understand what the provider’s plan is because they need to
integrate it into their own Business Continuity Plan.
Finally, all organizations having specific requirements must choose services from providers that can
respond to them with documented practices, whether it is an ISO 20001 certification for large
companies or a PCI certification for eBusiness companies.
Christophe Baroux, Regional Sales Manager Southern Europe at Amazon Web

Services.
“Amazon and some over providers have developed their infrastructure knowing that the data
will go down, and thus, the Data Centers have been built with this possibility in mind and with
consideration given on how to bring an effective solution to it. With Amazon, a customer
chooses the region where he wants to store and host his applications: a European organization
can choose to use Data Centers located in Europe. We have Data Centers in Amsterdam,
Dublin, Frankfurt and London. In terms of Data recovery and Business Continuity, Amazon
replicates data inside the same Data Center but if the Data Center goes down, data are at least
in two other Data Centers. Regarding requirements, Amazon Web Services should be certified
SAS 70 before the end of the year.”
Behind these 2 issues, we understand that companies that have high requirements in terms of
security and compliance for their data and applications should analyze carefully the providers’
services before entering the cloud; in other words, they should not select a provider only by trusting
the brand when:
• They do permit external audit;

• Limited logs are available; and
• Forensics is possible.
Cédric Mora
58 December 2009
As I mentioned before, an organization shall select the “right services” when using public cloud
services. A low-cost provider will evidently raise more issues that won’t solved.
“The question ‘Is the Cloud less or more safe?’ can be answered in two steps:
• Privacy: this is a real danger because some providers will not explain and tell the
customer the reality of such services. Therefore, organizations may find difficult to carry
out due diligence processes. Also, even if an organization decides to encrypt the data in
the Cloud, it has to know that with money and time, everything can be decrypted and
consequently, encryption may not provide a 100%-proof level of security. Everyone in
the IT department should be aware of Risk Management: architects, CIOs, etc.
• Back up / Business Continuity / Disaster Recovery: providers are experts of this subject
and have a know-how that is greater than the majority of internal IT department. We
have to understand here that most SMEs didn’t have Business Continuity plans and
Cloud Computing will surely improve that. Before, some organizations bought AS400
servers just because they were known as easy to reboot in case of problem…”
Cédric Mora
59 December 2009
Legal and contractual issues

Some organizations may find legal barriers in the adoption of Cloud
Computing services. But first, it is important to underline that Cloud
Text approved by
Computing is a form of outsourcing and the clients will face issues that
Isabelle Issert de
they may already know. The contractual solutions will resemble, broadly
Braux, lawyer at COLT
speaking, to a standard outsourcing contract. But new challenges are
Telecom
created as Cloud Computing can abstract how a service is done and
where exactly are the data.
Figure 22 - Classification of Legal and Contractual issues
When Cloud Computing seems to potentially offer operational benefits on Business Continuity, the
outsourcing of data and servers constitutes a worsening factor in terms of confidentiality violation.
Isabelle Issert de Braux emphasizes that organizations need to be particularly careful regarding
personal data that are governed by the French law “Loi informatique et libertés” – for “Information
Technologies and freedom” (Loi n° 78-17, 1978). Treatment of those data, in a virtual environment
where they can be dispersed across, and stored in, multiple data centers all over the world (which is
also true for a “private cloud”), can lead to violations entailing the organization’s responsibility.
Thus, data in the cloud can be transferred across multiple borders and this has a significant legal
implications: transfer of personal data out of the European Union is subject to certain formalities and
a strict control from the French IT and Freedom National Commission (CNIL). The best practice, from
a legal standpoint, would be to locate the servers inside the European Union and keep control over
these servers.
An issue that can come up regarding data in the cloud is the protection of intellectual property rights
in the data. Few providers (and mainly SaaS providers) have a clear position on the ownership and
rights of some data. Fortunately, a serious IaaS or PaaS provider will not propose hosting services
where data of an organization would not be owned only by this organization (even replicated or
Cédric Mora
60 December 2009
redundant one). But it does not mean that legal or compliance teams should not be involved in the
process.
It may be impossible for some companies to use Cloud Computing services because they do not meet
all the applicable constraints. This may be the case, for example, with companies that need to store
health-related data and comply with specific requirements defined in the “Code de la Santé
Publique” (Code of public health), or credit institutions that are subject to specific safeguards
security. An organization needs to check that all specific legal requirements can be respected in the
new environment: this will depend on the data, the company, the provider, the services used and the
location. Some organization may already have a policy that preclude them from relying on services
that store data on servers installed outside Europe, such a policy having the effect of restricting the
Cloud Computing services to European providers and services. Also, organizations will have to
approach the liability discussion individually; this is because applicable regulations generally do not
impose as a requirement that the service provider shall contractually acknowledge its responsibility
for protecting the client’s data. Legal teams will often insist to include in contracts specific terms and
conditions on the various aspects of their potential liability, and on the consequences of that liability
(rights of recourse actions, financial compensations etc.) and include the corresponding provisions in
the SLAs.
But as we will see in the “Channel” part, there are two types of providers: those who are offering
services directly through an internet web page where the client sign a click-wrap contract (no
negotiation on the contract) and those who create a custom-made contract. Isabelle Issert de Braux
is rather skeptical on the fact that click-wrap contract providers let their customers enter into a
genuine contract negotiation and she believes that organizations that need specific SLAs will need to
choose providers that negotiate custom-made contracts.
We can identify several other potential legal issues (see below); however, the probability that these
issues will materialize is rather remote:
• Easier for a litigant to discover data on the cloud. During litigation, the adverse party may
seek the discovery of the organization's data directly from the cloud provider and serve on
the latter a subpoena from a judge even before the organization owning the data is informed
of the process. This situation is somewhat improbable under French law because such a
process is much more difficult to realize in France.
• Disposal of organization’s data if the latter does not pay (under the reciprocal requirement
where one pays and the other offers the service). This will probably not happen as providers
will prefer to cut the access and reestablish it later rather than dispose of sensitive data. And
there is a need to take into account the “proportionality principle”: a provider won’t stop the
service because the organization is 2-day late in its payment.
The use of Cloud Computing is not inadvisable, but lawyers will recommend generally to limit its use
to the less sensible applications, and refrain from such use particularly for personal data. Also, some
organizations (including SMEs) will need that the cloud computing provider agrees to external audit
procedures and produce the necessary security certifications required by some business sectors.
Cédric Mora
61 December 2009
Maturity of the model

Companies will face another issue related to the maturity of the model itself. Cloud Computing is
based on multiple technologies that are more mature but suffers from a lack of standards. Providers
can choose between several virtualization software (VMWare VSphere, Microsoft HyperV, Citrix Xen,
Parallels, Red Hat Enterprise Virtualization, etc.) and there are numerous clouds (since each provider
has its own cloud). Standards are only beginning to be created with the global awareness from all the
actors in the cloud. Some of those actors do not want to see providers going back to proprietary
solutions, partly because open-source solutions are increasingly used. The Open Cloud Manifesto (iv)
(Open Cloud Manifesto, 2009) points out that providers should not lock-in the customers in order for
them to move their data and applications easily from one provider to another, by using “open”
standards adopted by all the companies. Behind this manifesto hides some giants from the IT
industry like IBM or the SaaS and PaaS provider Salesforce.
Some initiatives have already been created (not linked to this manifesto):
• OVF standard that describes a virtual machine and them to be deployed on any platform
supporting this standard (VMWare, 2009);
• SLA@SOI 3-year European Commission project that will define a holistic view for specifying,
negotiating and managing the conditions under which services are provided. Those specified
“Service Level Agreements will allow these conditions to be expressed at both business and
IT levels”. (SLA@SOI, 2008); and
• Alliances between providers (Google’s App Engine and Salesforce’s Force.com for the PaaS
provider)
But all SaaS/PaaS/IaaS won’t have the same need in terms of standards. Technically, it is easier for a
company to change its IaaS provider than changing from a PaaS provider to another one. The reason
is that IaaS provider only has the infrastructure, when a PaaS provider adds the middleware layer and
the SaaS provider adds the application layer. When selecting a service from a provider, organizations
will need to know that they could face a lock-in issue, or an interoperability issue, when trying to link
services hosted from one cloud platform to another one.
Another dependency is the network: “what happens if the network is down and some major
applications are hosted in the cloud?” Of course, it is a source of major concern for an organization
to realize that, if there is an issue on the network, it could go from applications user inconvenience to
direct loss of revenue. This risk must be relativized as it does not happen more often than a power
outage and, even if it is costly, it can be redounded.
The sustainability of the model is occasionally questioned. Some large providers are massively
investing in Cloud Computing services and we must consider that a large number of companies will
“jump into the cloud”. But if providers stop investing in this model because they do not think it is a
viable model, or if customers have too many negative experiences, this could result in the end of this
model.
Those issues need to be taken into account when doing a Risk Analysis: using something new always
raises viability issues. Companies that have an exhaustive risk policy will certainly be constrained by
some departments inside the organization.
Cédric Mora
62 December 2009
Application and data Migration

The migration remains one of the most important technical issues: the transfer of existing
applications and infrastructure will not be transparent in the majority of cases. It will be more
difficult than simply “putting them on the cloud”: the architecture imposed by some providers is
dissimilar to most architecture of enterprise applications and existing infrastructures are not
developed to benefit from all the new possibilities offered by the cloud (Golden, 2009).
Of course, this is even truer when an organization wants to use providers that offer their services
only online (Amazon, Google, Salesforce) because there is no customization possible. Bernard Golden
adds that “once [enterprises] find out how difficult it is to move an application to an external cloud,
their enthusiasm dwindles”. With Amazon, organization will face storage issues because the
framework is completely different from the existing, and database issues as they do not work as well
in virtualized environments. It will be even more difficult with PaaS providers: Salesforce’s Force.com
uses a proprietary architecture that will demand organization to redevelop big parts of their
applications. And no tools exist to automatically convert yet an application into one that can directly
be used with Cloud Computing services. Of course, re-writing an application to a prescribed public
cloud model leads back to the lock-in issue described before.
We can see three scenarios for companies that want to migrate their custom applications (and
infrastructure) in the cloud:
• Migrate the entire application: some non-complex applications will have minor
modifications needed to be migrated, but will not obtain all the benefits out of such
migration (minor scalability). Only Infrastructure-as-a-Service offers this possibility.
• Rewrite major portion of the application: old applications may use old programming
languages or models that need to changed (and redeveloped) in order to exploit cloud
computing benefits. Deploying the application in a PaaS environment will surely mean
redeveloping major portions of the application as most of those services support new
languages (Python, Java). And
• Migrate some parts of the application: some key part of an application can be outsourced
that will really benefits from the cloud. Organizations will also face new issues (latency
because of the distance, security because there is no secure tunnel encrypting data, etc.).
The changes that are needed to outsource the application will rarely involve business logic, but
rather more infrastructure logic. Thus, organizations that have an old IT environment will have more
difficulty to migrate their applications and gain real advantages.
Human Resources
After referring to technical, compliance or legal issues, the last issue to consider may be the most
sensitive one: the actual IT staff. Using cloud computing services means outsourcing, automation and
virtualization. All of those will certainly cut jobs in IT departments and transform others. There will be
certainly less systems administrators that are doing administrative tasks (maintenance, storage, …) or
operations research analyst in-house which jobs will be taken by the provider. IT departments may
Cédric Mora
63 December 2009
need more human resources around cloud-monitoring solutions and cloud-service management
software, but the difference between these new jobs and the ones being cut will be negative. The IT
staff will need new trainings on subjects like web-scale developments and service monitoring to
benefit from cloud computing services without risks. We will develop this impact in the second part
with more precision.
Organizations (usually large ones, but also smaller ones to a certain extent) that have difficulties with
Change Management or have a difficult social context, will be hesitant to use Cloud Computing
services.
Karim Bahloul, senior consultant for IDC.
“Some companies will limit the use of Cloud Computing services at the beginning. They know
that the adoption of these services will replace the job of some employees that have been in the
organization for a long time. What would happen then? Job transformations at best, staff
reduction otherwise. Companies that will find it difficult to carry out such transformations will
certainly prefer to wait and see what could be the impact of Cloud Computing.”
Operational and Strategic issues

We have referred above to several issues; some companies that have specific requirements
regarding those issues may find public PaaS and IaaS Cloud Computing not suitable for them. Those
issues are more detailed in a document recently published (November 2009) by the European
organization ENISA (v) (ENISA, 2009). I categorized the issues relevant for the thesis in terms of, for
example, security, compliance or legal requirement but it is also interesting to analyze what has
happened with another type of outsourcing: offshoring. When organizations refer to their return on
experience (Hugon, et al., 2009), the cause of their negative experience in offshoring is related not
only to the quality of the service (38%) but also the complexity of the management of the provider
(56%), the change management (56%), the loss of knowledge (31%), a cost reduction less important
than originally planned (31%) or hidden cost (25%).
Those issues are very different from the fears related to security and low quality that were on the top
the organizations’ concerns when they were beginning offshoring activities and had no experience in
that field. In fact, two similar types of issues have been identified for Cloud Computing and
offshoring: some are operational issues and others, less easy to understand for a company, strategic
issues. The first ones are, for example, the security issues and the day-to-day operation issues while
the strategic issues could be the management or the transfer of jobs.
Cédric Mora
64 December 2009
Shrish Srivastava, teacher on IT/IS at HEC.
“Like offshoring, Cloud Computing is facing 2 types of issues. First, when companies start
something new, the companies only think in terms of operational issues. What will be the
problems that affect the day to day operations? And initially, the operational problems are
more important but very quickly, companies will realize that there are strategic issues. When
an organization start outsourcing to a vendor, it doesn’t really know all the issues that will
come up and, as it will go along the implementation and use, more issues will come up. We can
make a simple analogy with learning a new programming language where there are many
more things which are simply more than the programming logic. The same case happens here,
because once an organization gets into the things, it will realize that it is much more complex.
The fears that were around offshoring are pretty much identical to the fears around Cloud
Computing now. But the issues around offshoring really are more different now. Cloud
Computing have specific issues on operation but is quite similar with offshoring on strategic
issues. The basic problems are the same because Cloud Computing is not only about
technology like we could think. A company, that puts its IT in the cloud, gives some of his work
to a vendor. This is a real human problem because employees are not happy about the whole
thing and organizations have to think about that.”
We understand that we could rapidly see a transition on the actual fears on security, quality of
service and business continuity to real issues on change management or vendor management. This
transition already happened with offshoring which raises basic issues that are identical to those
applicable to Cloud Computing.
One of the main reasons why French companies want to use Cloud Computing services is to reduce
the cost of IT (Markess International, 2009). If the organizations want to solve all the issues before
using Cloud Computing services, it will certainly reduce the financial gain they were hoping to realize.
Hidden costs exist, not only in the migration phase but also during the use of those services:
• Security tools, devices and processes;

• Compliance audits;
• Develop risk analysis;
• Contract negotiations;
• Changes in application codes;
• Change management.
Thus, an organization that implements new processes and try to resolve these issues could be
financially impacted; but not to address these issues will also have financial consequences.
Cédric Mora
65 December 2009
Figure 23 - CapEx to OpEx cost savings versus Cost of Risk for cloud computing (Linthicum, 2009)
One could ask whether the organizations are mature enough to use Cloud Computing when we see
developing, in parallel, operational issues and strategic issues that had not been really envisaged and
evaluated?
II.4.d. Cloud Computing: only for mature

companies?
Behind this question of process organization maturity lies a number of questions. Organizations that
have already implemented the ITIL referential (Annex V) will want to know if Cloud Computing will
have an impact or not on their mature, or maturing, processes. Organizations that have not
implemented ITIL or equivalent processes that industrialize the IT department, will want to know if
they are prepared to use Cloud Computing services. Will it be less complex to manage the
infrastructure and software and all the activities and resources with new Cloud Computing services?
Could it be a way to begin the implementation of a framework like ITIL if that wasn’t the case?
These are important questions to understand whether an organization can use PaaS and IaaS Cloud
Computing services. We can already make two observations:
• Some companies have already used Platform and Infrastructure services without even asking
themselves those questions; and
• Having good processes and a reliable data management is already important even without
Cloud Computing services.
Before using new services or even a new technology, organizations should understand what they
really need, what they are paying for these new services and how the use of a shared infrastructure
Cédric Mora
66 December 2009
will impact their processes (workflow, policies, etc.). At first, one may believe that there is less
complexity in a cloud infrastructure: this is very often because some complexity is hidden from the
customer. In reality, there still is some level of complexity in the management side with a cloud
infrastructure when you use Infrastructure-as-a-Service (Hurley, 2009): staff, servers, patches and
updated applications, network latency, etc. Some of those issues are eliminated with the Platform-
as-a-Service but, as we have seen above in this part of the thesis, there are new issues being
generated.
Shirish Srivastava, teacher on IT / IS at HEC.
“We should be talking about the maturity of an organization that will use Cloud Computing
services even though some people might think otherwise. Actually, organizations will need to be
more mature on human side than the technology side and organizations need to understand
what they will give out to the vendor. But human and technical issues will be in the work and will
be very different for every company.”
Complexity of the environment

Gregor Petri has described what could be the adoption of Infrastructure-as-a-Service at the beginning
(Petri, 2009) and, in this connection, has observed intelligently that, what we call “the Cloud”, will be
an “additional set of infrastructure” combining inside resources and Public and/or Private Clouds,
Hybrid Clouds. Organizations will certainly use services from “multiple vendors [in order] to optimize
cost and balance risk”. We can understand that, even if infrastructure services were less complex to
manage, the introduction of new types of services may actually add more complexity because an
organization would have to manage different types of resources, situated in different locations, and
accessed from different providers at the same time.
Considering that organizations can now use services for which all resources can be dynamic and paid
“as-you-go” by the hour, we can conclude that the maturity of an organization can be a critical factor
in the adoption of such services. The combination of the growth of the number of servers, the need
to preserve the flexibility offered by virtualization and Cloud Computing, and the obligation to
maintain a good operational service level, leads to industrialization of the processes and
development of change management.
Cédric Mora
67 December 2009
Lionel Pelletier, Senior Consultant at COLT, has been the CIO of numerous
organizations.
“To get all the benefits from Cloud Computing and try to avoid major issues on security or
management, the organization and the provider need to have a good level of maturity. An
organization will need to create a framework to understand and monitor all activities, both
inside and outside the company. For example, a company using Cloud Storage Infrastructure
services that does not create a policy, where the usage rules are defined, will face several
issues. What type and amount of data can an employee store? I have faced that type of issues
and I believe that CIOs will quickly understand how Cloud Computing will accelerate the
implementation of such policies.
Both companies will need to be structured and the use of frameworks can be important. The
best frameworks in this situation are ITIL V3 where an organization will be able to develop
management policies inside the IT department, and eSCM where an organization will learn
how to interact with a vendor. This last framework will give best practices on the
organizational and technical parts: establish Proof of Concepts to see the maturity and issues,
work with specialized consulting firms if needed, etc.”
Frameworks like ITIL or COBIT will surely help to understand and respond adequately to the
complexity of managing multiple forms of services. In the next part, we will address how to develop a
Cloud strategy and insist on the fact that it is important to build a governance around goals, risks,
costs or interdependencies. For G. Petri, the goal is to “offer a transparent view across the various
infrastructures platforms [and] dynamically move applications to the cloud platform that is the most
cost or energy efficient” and this will possible only if some of “those [ITIL or COBIT] procedures are
deployed”.
In conclusion, SMEs or major organizations can use Cloud Computing services without implementing
frameworks like ITIL or procedures that have such best practices. But companies that want their
deployment with a Cloud service to be the most successful will imperatively need to have mature
processes: strategy and organization management, asset and configuration management, service
portfolio management, information security management, etc. G. Petri (Petri, 2009) is rather blunt
when explaining that: “Cloud Computing offers more options, more flexibility, more opportunities for
efficiency and automation [but] automating chaos will only give one thing, automated chaos”.
Cloud Computing and ITIL: a good combination?

To make IT work, organizations have to follow processes, configurations tasks, problem management
scenarios, change requests and ITIL is the best way to manage the IT resources within the IT
department and the Data Center. Of course, companies using SaaS will have solved most of the
issues linked to those processes because the provider will be managing a wide variety of elements.
With PaaS, and even more with IaaS, an organization still needs to be concerned about the
management of software configurations, the deployment of new versions or about how security is
Cédric Mora
68 December 2009
being administered (Oestreich, 2008). The following figure (Figure 24) shows some services that will
be important in the management of Cloud Computing.
Figure 24 - Business services based on ITIL that have a role in managing a Cloud Computing
environment (Mauger, 2009)
Cédric Mora
69 December 2009
Régis Mauger, CTO at BMC Software.
“We have developed a tool base on ITIL principles that allows Cloud management for
infrastructure-as-a-Service. Organizations that have implemented ITIL will have less difficulty
to manage these new services so using them really does not cancel the frameworks in place,
quite the contrary. Of course, the goals are to enable the use of Cloud Computing services and
manage those services.
For example, to industrialize a change request, we can identify the following actions:
• 1. Plan a new project,

• 2. Make a request (Service request management),
• 3a. Record the request (Change and release management),
• 3b. Record the change (Change and release management),
• 4. Initiate orchestration tasks (Processes and task orchestration),
• 5. Provisioning the cloud server,
• 6. Configure the cloud server (Configuration automation),
• 7.Check the cloud server (Governance and compliance management, Financial
management),
• 8. Manage the cloud server (Vendor Management, Human capital management),
• 9. Terminate the request (Service request management, Change and release
management).
These actions correspond to business services like planning, support or operations where
there will be employees from the IT department. It requires a certain rigor for an
organization to maximize the benefits of Cloud Computing and let users ask for new
resources in a “self-service” way. So, organizations need to automate orchestration,
allocation, change requests, monitor those cloud resources, implement and manage
different level of services to the different users, and make forecast to analyze the costs.”
Only automated procedures and transparency of mechanisms will allow the IT department to retain
an effective control on an increasingly unstable and virtual environment. Although IaaS and PaaS
Cloud Computing services get rid of some management issues, it does not suppress the need for
organization or discipline. And their effect on a given organization will be the direct consequence of
the planning and management put into their deployment, operation and supervision. In the second
part, the impacts of the adoption of PaaS and IaaS Cloud Computing services on the processes of the
IT department will be detailed.
Cédric Mora
70 December 2009
II.4.e. SWOT analysis of Cloud Computing for

organization interested in the model
Knowing all the benefits and concerns, the actual economic environment and the IT market, we can
now present the SWOT matrix that shows the information previously presented.
Graphic 5 - SWOT of Public Cloud Computing services
II.4.f. Early adopters

The first organizations that will use Public PaaS and IaaS Cloud Computing services can be identified
with the benefits and drawbacks developed before. Those innovators and early adopters will want to
realize at least one of the following benefits:
• Save money (pay less on staff, hardware, …) because of seasonal/temporary needs;

• Change the way they spend on IT with a new Business Model (following the growth of the
activity: pay per number of clicks, the bandwidth, number of tasks done, etc.);
• Get operational benefits;
• Quickly create an infrastructure without investment;
• Focus on core business and innovation;
Cédric Mora
71 December 2009
• Access to virtually infinite resources;

• Access to Overflow platforms (to get more resources than those offered in-house);
• Use services used by the competition;
• Are already using colocation services or managed by a provider in-house; or
• Launch projects that do not have a clear ROI, avoiding CAPEX investment and having the
possibility to stop at any time.
Figure 25 – Innovation Adoption Curve (Rogers, 1962)
Organizations that may use Cloud Computing services (late majority/laggards) at a later stage are
those that have at least one of those characteristics:
• Existing infrastructure that is complicated to migrate;

• Difficult social context because of IT staff reduction;
• Important legal issues regarding to private data;
• Compliance requirements;
• Sensitive organizations that need extreme security; or
• No seasonal activity.
Based on those hypotheses, we can draw a picture of the first cloud users:
• eBusiness web sites (seasonal activity within the year: marketing campaigns, sales);
• Independent Software Vendors (no management of the infrastructure, capability to grow
easily, development of the SaaS model for their software, possibility to have multiple Data
Center across different countries to be near the final users);
• Small IT integrators (that have a lot of test/development/pre-production servers and
developer teams);
• New companies that needs specific applications (easier to use Cloud services than create
your own Data Center with all operational expenses); or
• Large companies that do not work in Defense, Health, Finance and some Government
agencies or International organizations (avoid legal, compliance, security issues).
This is not an exhaustive list and it does not mean that other companies will never use Cloud
Computing services for some applications and we will see in the next chapter what type of
applications are eligible to “go in the Cloud”. But these companies have the potential to massively
use Public Cloud Computing Services.
Cédric Mora
72 December 2009
Corporation – "Why is it relevant to the strategy of the organization?"
II.5. Corporation – "Why is it relevant to the

strategy of the organization?"
We described the new economic model, the benefits that some organization can expect from Cloud
Computing, and the risks that those companies will have to manage. This part on Corporation will
develop more precisely what type of custom applications, organization will be able to put in the
Cloud, always with the idea that:
• It addresses business needs;

• It should be cost effective; and
• It must remain coherent with the Information System (policies, governance, etc.).
We will see that new questions are raised:
• What applications are best suited for the cloud? Is there an eligibility matrix?
• Are there some frameworks that an organization can use to make this choice?
• What are the best practices?
• Is there a way to migrate an application to the cloud?
• Does it need to be in an overall strategy?
• Can an organization get some help to decide?
II.5.a. Balanced Scorecard

Answering these questions will be a very important step for companies that want to start using such
type of services. From what we have seen before, the use of Cloud Computing service has to address
business needs. A Balance Scorecard allows an organization to see if its operational activities are
aligned with its objectives and strategy. PaaS and IaaS Cloud Computing services will have an impact
on those 4 perspectives:
Cédric Mora
73 December 2009
Figure 26 - Balanced Scorecard of Cloud Computing, Adapted from the Balance Scorecard by Kaplan
and Norton (Kaplan, et al., 1996)
The Cloud Computing strategy chosen will have to be in coherence with this Balance Scorecard,
where we will be able to create targets and track the performance with Key Performance Indicators.
II.5.b. Make or buy?

Every company needs to differentiate itself because it is in a business environment that is filled with
an increasing number of competitors. A way to accomplish this is to simply focus on what the
company does best: its core expertise and added-value activities (product innovation, customer
relationships or strategic business growth initiatives). We are back to a typical outsourcing question:
should the IT department do a task in-house or outsource it?
The Gartner consulting firm described the concept of a next-generation IS organization with the IS
Lite model (Gartner, 2003). Like Cloud Computing and other trends, this organization is “slimmed
down to lighter, more flexible organization with a smaller internal staff and more-focused
competencies” (Gartner, 2009). The basic idea is that this transformation is possible through the
outsourcing of many functions (such as infrastructure services) and the migration of others (such as
system development) to business unit IT groups.
Cédric Mora
74 December 2009
Figure 27 - Gartner’s IS-Lite model
Cloud Computing services enter into the same trend, letting a provider manage a part of the
Information System, that does not create value, to a company, and could offer some benefits. I will
not detail this model longer but we can still observe a major characteristic with one of the key roles
(in yellow circles) which is the management of the provider that will be a sensitive process.
Cédric Mora
75 December 2009
organizations.
“Depending on the maturity of an organization, a large organization will be able to outsource

or not. All organizations have this need but only mature ones will know what to outsource the
right way: operate on the infrastructure by itself or let a professional operate it and focus on
the core business. The next step is simply a ‘Make or Buy’ study which will analyze risks and
costs.
Large companies will have to make precise Business Cases, leverage all the issues with the
Return on Investment of such a decision. It will depend of the business sector where the IT
budget is not the same. If a company is unable to manage its growth curve (volumetric
storage for Business Intelligence or no policy on storage can be managed by a provider if an IT
department decide to subscribe to storage-on-demand) or temporal growth of the activity (ex:
eBusiness website), isn’t it more simple to outsource the management of this infrastructure?
If we take the IS Lite model from Gartner representing the activities of the IT department as a
triangle from the strategy to the infrastructure management, we see that there is a large zone
that doesn’t need to done by the organization because there is no added-value. Cloud
Computing services may satisfy needs to outsource the management of servers, storage,
network, some applications and middleware, and desktops. An in-depth risk analysis will help
the CIO answer some questions regarding what to outsource: what are the risks to have a pre-
production platform that is down whereas I want to be sure that my production platform
needs to have the maximum of security and availability. We will probably see a gradual
outsourcing from the test and development architecture, to the pre-production and Business
Continuity resources: those services could benefit from the Cloud economics.”
To first answer the ‘Make or Buy’ question, one should determine whether it is financially more
interesting to outsource a service. We have already identified this characteristic in the first part of
the thesis that explained the new economic model and some examples of ROI.
SaaS versus PaaS and IaaS

When organizations choose between building their own solution and buying the solution of a
provider, they face a second level of choice: do they buy an application on-the-shelf (Software-as-a-
Service) or do they develop a custom application (Platform-as-a-Service and Infrastructure-as-a-
service)?
As we said before, choosing a SaaS solution allows a company to focus on core activities but it will
not help it differentiating itself from others on the outsourced service. And this is vital to a company:
differentiation. Otherwise, what make the difference between two companies? IaaS and PaaS
services offer a way to develop and host custom applications in the cloud that will help a company
differentiate itself. We can consider that when 80% of the need for applications would be covered
with Software-as-a-Service, the last 20% will be the most important part since it would allow a
company to use specific applications on the Cloud.
Cédric Mora
76 December 2009
Of course, depending on the strategy of a company and its business sector, a strategic application for
an organization will not be as strategic for another (Human resource management system for
Consulting firms, Property management for real estate agencies, etc.) and thus will need to be
differentiating.
Control versus agility

As we have seen in this part, some companies may not be interested in such a new model: we face
here a second question that opposes the control which organizations have over their services against
the agility offered by Public Cloud Computing services.
We see that “too much control results in lack of agility [but] too little control exposes the
organization to risk” (Behnia, et al., 2008). When an organization will make a choice whether to use
PaaS and IaaS services, elements outlined in Figure 28 following will have to be borne in mind
because, when the business will want to have the maximum of agility possible, some employees will
want to apply the maximum degree of security possible. A balance point will have to be found by the
organization when the IT strategy will be established.
Figure 28 - Control vs Agility (Behnia, et al., 2008)
II.5.c. Choice of the applications to outsource

Knowing that some organizations should have a significant interest in using Infrastructure and
Platform services, there is a need to identify applications that could be hosted in the cloud.
We can understand that, as of now, certain applications (such as banking and stock-trading systems
or telecommunications infrastructure) will have to be managed locally due to legal requirements,
security threats or stringent uptime requirements. But, in the application portfolio of an organization
those applications are not the only ones and some other applications may not impose such strict
uptime requirements. It is necessary to differentiate low-critical applications from mission-critical
applications because they actually may be managed with the same management framework and
under the same operations costs.
Applications that could be outsourced are also the ones that could get the more benefits from being
in the cloud, with the new economic model offering greater flexibility.
Cédric Mora
77 December 2009
James Staten, from Forrester, rightly saw emerging three patterns for IaaS services:
Figure 29 - Three emerging patterns for IaaS services (Staten, 2009)
For PaaS services, the emerging patterns are similar. We can identify:
• Volatile web applications;

• New SaaS providers developing their applications on top of PaaS services, that often
integrate tools to test and develop their program quite easily from an environment to
another.
Those services are less mature than IaaS services, and as we saw that the risks are different. But
providers offer a wide range of new services that some companies are already trying for Proof of
Concepts (see Annex III).
The following figure proposes a manner to define what are the best applications to host in the cloud,
based on all the previous findings and assumptions. Four dimensions are represented on this priority
matrix:
Cédric Mora
78 December 2009
• Size of savings: basically, an application that have temporal needs or needs elastic capacity
will create more savings if it is in the cloud. We can also suggest applications that have low
SLAs to be hosted on low cost services for financial reasons. Also, depending the use of an
application by company, the savings will be different (some ERPs will always have the same
traffic when others will have for example a great variation during the fiscal year end).
• Ease of realization: the migration part is addressed (described in this part).
• Size of spends: the budget needed to outsource an application.
• Criticality of an application: this is the more difficult dimension because it is very often
specific to a company but we tried to take general cases.
Figure 30 – Example of priority outsourcing matrix
This exercise needs to be done by every company that would like to know what applications could be
outsourced. It will give this company some priorities and help it in the definition of a roadmap.
Primarily, organizations will certainly look at areas that offer quick wins with simple ROI calculations.
Applications that are low in business value but offers substantial savings and easy to move into the
cloud will be preferred.
Cédric Mora
79 December 2009
organizations.
“At first, an organization will identify all critical and non-critical applications within a business
process. All data must be classified in terms of security and sensitive data should not be
treated off-premises. Applications that are non-critical could be hosted in the Cloud if the ROI is
interesting. Applications that are critical may have backup resources (Data Recovery resources)
that could also be hosted on the Cloud because they are rarely used. The idea is to elect the
right applications to outsource.
But I think the first use of Cloud Computing services will be on-demand resources: Grid
Computing where an organization can rent out resources for a short period of time. Some
organizations such as banks have created internal Grids for important calculations. The cost to
buy and manage this Grid is impressive when we know that this is not their core business and
they do not always use it at full capacity. This type of applications could be good candidate for
Cloud Computing. Another good example is an eBusiness website which needs additional
resources for a promotional activity. The storage and in-house servers will still be on-premises
but the additional resources will not be. This use of a platform that enables overflow is non-
intrusive which is more interesting as a first step.”
The selection of the outsourced services can be realized with different methods (Hugon, et al., 2009):
• Comparison with best practices: using this method will be difficult because there isn’t a real
return on experience on the use of IaaS and PaaS services and the only best practices have
already been explained above. But it is still possible to compare it with other outsourcing
best practices and some new frameworks (Risk IT and Val IT from ISACA); and
• Eligibility matrix.
Eligibility matrix
The eligibility matrices offer a way for organization to elect the right applications for something
based on criteria and policies created by an organization. This proven method has been developed by
a large number of organization and we will not detail here all the questions and explain how to rank
the answers. But it is still important to indicate that this matrix will need to be realized with a clear
strategy (see Balance Scorecard): reduce costs, improve customer satisfaction, innovate, etc.
Cédric Mora
80 December 2009
Figure 31 - Cloud Computing applications funnel
Some criteria of this matrix are the following (but organizations are invited to add any necessary
additional criteria which they would consider as being more relevant):
• Cloud strategy: this is the most important criteria as it will define the importance of the
others. This strategy will have to be aligned with the business and the strategy of the
organization.
• Interesting economics (Return on Investment): see Economic model.
• Technical feasibility: see Migration issues.
• Internal maturity: with every form of outsourcing, the maturity issue of an organization is
raised and this criterion should not be rejected.
• Core activity: a company should decide if it wants to outsource only non-core activities or
more if the benefits are more important.
• Acceptable risk: what are the policies of an organization in terms of security, and SLAs for an
application?
• Legal issues: what are the requirements for a service?
• Mature provider services: the analysis of the services offered by the providers is also
important. A lot of new services are created each month: some are mature, some others are
not.
• Monitoring resources: is the company ready to monitor the application in its new
environment and ensure that the SLAs are respected?
A criterion does not appear in this funnel: the possibility to buy a SaaS off-the-shelf and not host a
specific application in the Cloud. This issue was discussed previously in the ‘Make or Buy’ paragraph.
The result of this eligibility matrix can be represented with the following figure.
Cédric Mora
81 December 2009
Figure 32 - Result of an eligibility matrix (Hartman, et al., 2009)
When large organization may have internal resources to realize this matrix, SMEs may have more
difficulties. Precisely, we are seeing a lot of new offers that propose Cloud Audit to see which
applications could be outsourced in the cloud.
Shirish Srivastava, teacher on IT / IS at HEC.
“An interesting question is the interest of outsourcing critical application for the organizations.
If we look at offshoring, we see that organizations are offshoring and outsourcing key things:
development of critical applications, Research & Development, etc. Some companies offshore
heavily, like Boeing that offshored the development of a critical application in engineering. And
this is a very critical issue for a company like Boeing.
Cloud Computing is still in its early stage. We will see a large number of people experimenting
with it and thus, organizations don’t know what they can face. At first, organizations offshored
the development of applications to reduce the cost but, now, some organizations are
offshoring to get an expertise to develop critical applications. With Cloud Computing,
organizations are still mainly looking to save costs, even if some companies are also looking for
an expertise, SMEs for example. We will possibly see the same evolution with Cloud
Computing: using it for cost reduction only without outsourcing critical applications and then
using it for critical applications.
This is the normal way of things: with something new, people try to experiment it and then go
for bigger things and probably that will happen in the case of Cloud Computing.”
Cédric Mora
82 December 2009
II.5.d. Cloud Strategy

Implementing a Cloud strategy will be essential if an organization wants to use Cloud Computing
services. Without a proper strategy, Cloud Computing could be a real threat to the CIO and the IT
department: bad ROI, reduced control of the IT services, failure of migration projects, poor SLAs for a
critical application, security threats. The CIO should lead this strategy because if something happen
with a Cloud service, he will have primary responsibility. Conversely, Cloud Computing could be a
huge opportunity for the CIO and simply add another string to his bow: he can deploy an application
in-house or on the Cloud if it corresponds to the right characteristics.
Hybrid Cloud: the obvious solution

We can envisage that no company will only use Public Cloud Computing services (except maybe new
ones and some eBusiness or ISV companies) and every company will have at least one Public Cloud
Computing service project. The underlying idea of this thesis has always been that none of those two
extreme solutions will prevail. We will rather see the apparition of what is called a Hybrid Cloud,
mixing internal and external services, to create an environment that provides the level of service
tailored to each solution, combining agility and control (Figure 28).
If we consider an organization with its traditional IT at this stage, we can plan a simple roadmap
where the first step could be the creation of a Private Cloud and then the common use of Public
Cloud services, creating at the same a Hybrid Cloud (Figure 33). This is what predicted IBM presenting
the IT roadmap of the IT department.
Figure 33 - A possible IT roadmap (Zhu, 2009)
The vision is shared with consulting firms like Gartner who says that “Private Cloud Computing will
not just be a viable term [but] a significant strategic investment for most large organizations”, this
being “a stepping-stone to future public cloud services” (Gartner, 2009). Forrester also asked the
question to IT decision-makers defining the same trajectory for a roadmap.
Cédric Mora
83 December 2009
Figure 34 - Server Virtualization Is A Top Priority For Most Enterprises In 2010, But Cloud Is Not
(Gillett, et al., 2009)
Of course, we have seen in this thesis that some companies will not create a Private Cloud first but
will certainly use different services: traditional IT and experiment with Public Cloud services.
The segmentation, between applications that could be hosted in the cloud, the ones that should stay
on-premises and others which will be cut in different parts (possible with a Service-Oriented
Architecture) distributed according to the risk and benefits, will be gradual. Some companies will
possibly test and develop applications in a more agile environment (the Cloud), and those first quick
wins will enable the IT department to publicize their success to the business world. At that time,
organizations will start considering more challenging deployments, with new tools and best practices.
A certain maturity has been established by itself and this is what we will present now.
Cloud Maturity Model

Creating a Maturity Model is always difficult as it is always criticized, and exceptions for certain
projects or companies are common. The goal is to propose an adoption model with milestones for IT
loosely modeled after the Capability Maturity Model from the Software Engineering Institute at
Carnegie Mellon University. Jake Sorofman proposed the following 5-step Cloud Maturity Model:
Cédric Mora
84 December 2009
Figure 35 - 5-step Cloud Computing Adoption Model (Sorofman, 2008)
This model proposes for each level: “strategic goals, key investment requirements, expected returns,
risk factors, and readiness criteria for graduating to the next steps”. Of course, this model won’t
always be true for every company because, for example, a new organization may be able to access
directly the 4th phase due to the economic environment. But this model is fairly consistent in its
construction because it takes into account the psychological dimension of the adoption of something
new, and also the maturity of the processes needed to fully exploit the benefits offered by Cloud
Computing. A large majority of SMES and large organizations will recognize themselves in this model,
and always apply it with a view to be aligned with the business.
Cédric Mora
85 December 2009
Guillaume Plouin, Head of the Cloud Computing offering at Octo Technology

and author of the book “Cloud Computing and SaaS” (Dunod).
“I differentiate two types of services in Cloud Computing: Location of application (SaaS), and
Run a specific application on demand (PaaS & IaaS). We have a clear idea of the type of
applications that are used with SaaS by French early adopters, but we still see a small number
of users that run specific applications in France. Those PaaS and IaaS early adopters that we
are working with are experimenting. They can initiate innovative approaches for new tools,
applications. At the same time, this is a way for them to test services mentioned by the press
and consulting firms. They will be able to have their own opinion on these services and then
consider it as a platform for outsourcing. In this context, the risk of data security is lower and
the organizations will be able to benefit of the rapidity of deployment, which is very
interesting for an experimental approach.
For example, a large company recently created a center of competence to test these services
in its innovation department. That way, the IT department can prevent that the use of such
services be covertly tested without supervision.
My point of view is that some companies will start using these services that way and,
eventually, start using it for more traditional applications.
We are also seeing a significant number of startups and Independent Software Vendors
starting using the Cloud to run specific applications. For startups the reason is obvious, since
they can quickly launch a service without CAPEX. For example, a French company called Run
My Process uses Amazon Web Services for the infrastructure layer of its information system.
ISVs are following the shift launched by SaaS which offers a new model of consumption of IT
resources. All these vendors are asking themselves how to propose their software with this
new model and, of course, using a PaaS or IaaS service is a good solution. We can even
envisage that, eventually, those vendors will only propose SaaS services to their customers
without managing the underlying infrastructure.”
Cédric Mora
86 December 2009
Channel – “Provider: who, why and how?”
II.6. Channel – “Provider: who, why and how?”
After defining a cloud computing strategy, an organization will have to choose the right provider for
the applications it wants to outsource. Unlike traditional outsourcing, in most of the case, we don’t
see any relationships between the provider and the organization that uses Cloud Computing services.
This could be normal if we think of the electricity metaphor created by Nicholas Carr: an organization
does not have a special relationship with its electricity provider.
This model correspond to some major actors like Amazon Web Services (Elastic Compute Cloud,
Simple Storage Service, …) or Google (Google App Engine) where we don’t see how a relationship
could be relevant. But the integrators and other cloud providers know that a number of
organizations will need a closer relationship than just a web page interaction. We will first describe
all the models of cloud computing providers and the relationship that organizations can expect.
First, a map of the different providers shows their positioning in terms of offers and business
readiness.
Figure 36 - Cloud Computing providers, France 2009 (Markess International, 2009)
This matrix is the only one that presents the French actors, but it may not be fully adequate since
some actors do not have Cloud Services but rather rely on traditional managed services and
offerings. Furthermore, several of the above providers have multiple offerings, thus multiple
relationships with customers are possible. Trying to integrate all services providers in one matrix may
complicate the comprehension.
Cédric Mora
87 December 2009
II.6.a. Different relations possible

No relationship - European providers
In this model, a provider offers services through a simple web interface. The contract is a click-wrap
contract where the organization needs to accept all the clauses without negotiation possible. The
quality of service is clearly known as is it a standard approach. The customers have to adapt their
architecture and needs to the ones proposed in the different services: the provider does not take
into account the specificities of an organization.
The customer and the organization do not need to meet each other, and no advice is given on how
the service could be optimized or improved. The service given is just a tool and it is expected that the
customer will use it by itself. This relationship represents best the utility metaphor. The business
model of these providers is clear and customization is really not appropriate, even if the provider
tries to offer a wide range of services. Thus, the access to such type of services, when there is no
relationship with the provider, is very quick.
When based in Europe, and more particularly in France, the service will tend to raise fewer issues but
this type of providers does not always specify where applications and data will be located.
For the moment, European providers’ services are less developed than some services that we can see
in the United States for example. Without commitments from the provider, the services remain
simple and are less expensive than those offered through a strategic relationship.
No relationship - Non-European providers

The same relationship can exist with providers that do not have a Data Center in Europe. It raises
more issues as the data and applications may not be located in Europe and communications with the
provider are more complicated.
Interface between the organization and the provider

A relationship is possible with an organization that will be the interface between the customer and
the provider. Different roles are possible:
• The prescriber: it will give advice to the customer on how to use the service from a provider,
helps it realize a Proof of Concept, and sometimes realize integration activities. Usually, the
prescriber does not have a relationship with the provider (often non-European provider);
• The consulting firm: it will package some offers from various providers into consulting
services;
• The Provider/Reseller with added-value: some provider will be able to develop new offers on
top of other Cloud providers (ex: a Paas offering that uses IaaS services);
• The broker: that will choose for an organization what is the best relationship and the best
provider for it.
Strategic relationship – Providers that have a presence in Europe

With this model, organizations can expect to receive more from the provider than a simple service.
Those providers are closer to the customer, are providing customized and less standard solutions
Cédric Mora
88 December 2009
(security, architecture, …) and offering specific SLAs in a negotiated but flexible contract. This model
is the evolution of the classic hosting/managed services model with cloud computing benefits added.
With a strategic relationship, organizations won’t be able to stop using a service automatically just
like when there is no relationship. This is a long term contract with some consulting/professional
services at the beginning (migration, integration), and ongoing services with a service manager
handling the relationship.
Global Approach
The relationship can be even closer when cloud computing services are provided together with other
services (data and voice solutions: optic fiber network links, etc.). In this case, the global approach
offers the organization the possibility to have more responsibility taken by the providers than it
would be the case with simple SLAs.
This approach is possible with Telecom providers that control the network and the infrastructure.
“Internal providers” - IT department as the service provider

When talking about Private Cloud Computing, the IT department is seen as an “Internal provider”
that has a service approach which takes some benefits from the Public Cloud Computing. This can be
a simple room for SMEs, up to multiple Data Centers for large companies that are consolidated
through virtualization. As we have seen before, the gain is not identical but it will define the new
relation that organizations have with their respective IT departments.
Figure 37 - Different relationships with a provider
II.6.b. Choosing the model

To choose the provider and the relationship needed, the organization will have to analyze some
criteria: Cloud Computing strategy, maturity of both sides, complexity of the solution (bespoke,
special needs), legal issues, price, in-house resources, risks, provider’s characteristics and ability to
stop the relationship.
Cédric Mora
89 December 2009
Cloud Computing strategy

What does the organization want? A provider that only offers IT resources or use more services from
the provider and be in a position to partner with it? Will there be only one provider (combining SaaS,
PaaS and IaaS services) or multiple contracts with different providers? Does one provider can offer
solutions for all services to outsource consistent with the Cloud Computing strategy of the customer?
Maturity of both sides

Is the organization mature enough to use Cloud Computing services? What are the current processes
in place to manage the infrastructure, applications, data, and human resources? No management can
create significant issues if an organization decides to simply use a “no relationship” strategy: from a
bad ROI to complex compliance or legal issues.
Complexity of the solution

Organizations searching for complex solutions will tend to have a strategic or a global approach that
will enable them to obtain exactly what they need with custom SLAs. A simple platform that is
standard (security, architecture, no sensitive data, etc.) could be easily hosted off-premises, without
interaction with the provider. So, what type of applications does the organization want to outsource?
Legal issues
Obviously, depending on the model chosen, the organizations will not take the same legal risks. A
strategic relationship, where a provider takes more responsibility and may offer consulting services
to advise its customer, provides a level of protection that the model without relationship does not
offer.
Price
Outsourcing the infrastructure will be more expensive when there are additional services on top of
the infrastructure service, with a long-duration contract. But companies which are only looking to cut
costs may choose low price models that offer the simplicity to stop the payment at any time. Of
course, organizations that do not successfully calculate the ROI of a model will tend to use Private
Cloud Computing services.
In-house resources
Organizations that already have in-house resources and want to keep them for any reason may be
encouraged to choose the internal provider solution. It still may need some Change Management but
it will require less transformation than for using Public Cloud Computing services, which may create
social issues in the end.
Risks
All the risks described in the second part are not identical with all the models because of the absence
of real visibility in what the provider offers in the no-relationship model. Furthermore, the use of
non-European providers accentuates those risks. If the security risks and other risks are too
important, companies will tend to use the internal provider model. Also, Service Level Agreements
are very explicit when addressing Public Cloud Computing services, but there may be a need for them
to be more customized in terms of strategic or global approaches.
Cédric Mora
90 December 2009
Provider’s characteristics
Does a provider offer different types of models? Is it possible to switch from one model to another
one or combine different models?
Ability to stop the relationship

Global approaches and even strategic approaches mean a long relation with the provider (contract
lock-in) whereas a simple model offers the possibility to stop the service in case of failure, even if it
may be harder to migrate the platform easily (technical lock-in).
II.6.c. Benefits and drawbacks of the models
Benefits Drawbacks
No relationship – • No interaction with the provider and

• Easy to start a new service
European provider no dedicated support
• Easy to stop a service (no
• Difficult to get information from the
contract attachment)
provider whether he will be
• Offers all the benefits of
compliant with legal and security
Cloud Computing services
standards or not
• Low cost
• Potentially low SLAs
• Difficult to manage the
infrastructure or platform services
without the right tools and
processes
• Difficult to recreate the same in-
house platform (standard security
and architecture)
No relationship – Non- • Difficult to do something against the

• Wide variety of services easily
European provider provider in case of problems
accessible online
• Bigger risks
• Price lower than European
competitors
• Easier to provide good global
services for all end-users
(geographic location)
Strategic relationship – • May offer less flexibility as this a

• Easier to get real interactions
Providers that have a contract with a duration
with the provider
presence in Europe (integration, …) • Price is higher than the one for a
“no-relationship” model
• Custom SLAs
• Choose the right business
model
Global Approach • Difficult to stop the relation as other

• Possibility to recreate the
Cédric Mora
91 December 2009
same level of security with services like network will be built

end-to-end control (network around the Cloud services
and infrastructure)
“Internal providers” • Cost is more important

• Keep more in-house
resources in case of difficult • No “infinite” resources
social environment
• Easier evolution of internal IT
where process can be created
progressively
Consulting firm • Cost is more important because of

• The consulting will help the
Interface the consulting services
organization choose the right
provider for the • All risks may still exist with the
customer/project (broker provider
role)
• Major commitment of the
firm to balance Cloud
Computing concerns
Prescriber interface • Cost is more important because of

• Provide guidance from the
the consulting services
prescriber (expert in Cloud
Computing services) • All risks may still exist with the
provider
Reseller interface • The customer may end up dealing

• Reseller may offer more
with risks from the reseller and the
business value
provider
Table 6 - Comparison of benefits and drawbacks of all the models
II.6.d. The providers

Organizations will be able to choose between multiple providers that can provide some of these
models. We are seeing 3 types of genuine providers that are presented below.
Cédric Mora
92 December 2009
Figure 38 - 3 generic models of providers
The “No relationship model” will be possible with some providers like Google, Salesforce or Amazon.
Most PaaS offerings will be proposed with this model. Professional-managed hosting companies will
give access to their infrastructure to customers as a simple managed “extension” of customer’s
infrastructure but will not provide any added-value on the outsourcing part.
The “Custom contract model” is the evolution of classic outsourcing that integrates Cloud Computing
services. Some typical actors will be:
• Traditional IT software integrators will have a closer relationship to help the client in the
migration, the integration or, occasionally, the strategy. Here, IT is definitely a sensitive
subject where an organization will need consulting services to help it choose the right
services.
• Network infrastructure and services providers can provide packaged services where an
organization will really create a cloud that will have at the same time: infrastructure and
network.
The “interface model” will provide added value services on top of Cloud Computing services. For
instance, some consulting firms do not host data and application but can provide the services that
will help in the management and integration of Cloud Computing services. They can also have the
role of brokers of Cloud Computing solutions proposing the best solution for an organization. For
example, Capgemini offers consulting services, development, migration and back-up with Amazon
Web Services offers (Capgemini, 2008).
A recent study (Portio Research, 2009) showed that French companies would trust more network
infrastructure and services providers (45%) than traditional IT software integrators (23%) and
professional-managed hosting companies (32%). This particularity is typically French because, with
the global European results, professionally-managed hosting companies are preferred over network
infrastructure and services providers.
Cédric Mora
93 December 2009
It is important to underline that some providers can offer multiple models of relation, and that an
organization can work with multiple providers and consulting firms at the same time.
Also, these providers will target different types of organizations and, thus will have different strategy.
A look at Porter’s generic strategies allow us to understand that the “No-relationship model” will
have for strategy the Cost Leadership and that the “Custom contract model” could be a
differentiation or segmentation strategy depending the degree of the relationship.
Figure 39 - Porter's Generic Strategies (Porter, 1980)
Evidently, an organization, wondering what would be the best relationship, will have to wonder if it is
looking for cost and accept all the risks, or customization.
Cédric Mora
94 December 2009
Guillaume Plouin, Head of the Cloud Computing offering at Octo Technology

and author of the book “Cloud Computing and SaaS” (Dunod).
“My vision of the relationship, between a provider and an organization in Cloud Computing
services, is that there should not be human or commercial contacts like it exists with a normal
outsourcing contract. For me a Cloud provider must offer a self-provisioning API and there is
no custom contract, just a service that you can access in a few clicks. So all the resources are
standardized and a customer is compelled to only use the proposed services. Only this solution
offers the maximum benefits because you have a complete access over your resources and the
services can be stopped, no matter what, at any time.
Thus, the close relationship with the provider does not exist anymore.
Some IT integrators or telecommunication providers offers Cloud Computing services where
there are professional services and custom contracts. For me, those services do not enable the
customer to fully exploit what we can expect from Cloud Computing (Self-provisioning, stop
using the service anytime, etc.).
It’s true that all the major providers offering this maximum of opportunity are American
(Google’s App Engine, Salesforce’s Force.com and Amazon’s EC2/S3/…) and French companies
would prefer European services. To help, some prescribers will intervene between the provider
and the organization. This third party will be able to give some best practices and what would
be great opportunities.”
Béatrice Rollet, Head Marketing for COLT Managed Service France, a European
provider
“We will see two dominant types of relations between an organization and its provider. The
first one is the relation offered by some actors like Google and Amazon where the companies
tend to consume like would do an individual. There is a notion of trust because the organization
does not control everything and there is not a total transparency. The second one is the relation
with a provider that is used to manage outsourcing deals and that can answer to all questions
regarding: data privacy, backsourcing and custom guarantees offerings. At the end, if an
organization wants a service where a simple commodity is looked for, it will use the first
relation, but if it is looking for added value to manage a complex environment that is more
structured, it will choose the second.
If we look at SMEs, it is likely that they will be turning to brokers to help them decide what
would be the best provider and what would be the adapted solution. This form of supply will
grow with the maturity and interoperability of Cloud Computing solutions. Some companies,
such as 8K miles, are beginning to offer these types of service to SMEs.”
Cédric Mora
95 December 2009
A survey, involving French CIOs and other IT representatives (Portio Research, 2009), shows that
some providers already have been preferred for different type of solutions:
Figure 40 - PaaS providers (Portio Research, 2009)
Figure 41 - IaaS providers (Portio Research, 2009)
We can be somewhat critical about this study that includes only major actors and no new entrants.
Also, some actors are positioned as only IaaS providers (IBM) or PaaS providers (Amazon) when,
actually, they provide a wide range of services.
II.6.e. Choosing the right provider

Depending on the type of relationship you need with the provider, and having defined the strategy
that would be the best for the applications, the organization needs to choose the right provider.
Obviously, the risks described in this part will have a deep impact on the choice as an organization
cannot work with all the providers due to security, compliance, legal or technical issues.
Organizations that want to put custom applications in the cloud, using PaaS or IaaS services, have
obtained information on all the potential benefits, and are also knowledgeable of all the issues that
may arise under the different types of relations and services; they need to start asking question to
Cédric Mora
96 December 2009
the potential providers to the extent this is possible, and benchmark these different providers
(Wang, et al., 2009).
A checklist of negotiable and non-negotiable requirements

A good start for the development of the contract would be the creation of a checklist that defines
negotiable and non-negotiable requirements. To create this checklist, an organization needs to
search for all requirements:
• Certification requirements;
• Geographical limitations;
• Regulatory requirements against multitenancy;
• Security.
Internal resources can be used from different departments to obtain all the necessary information:
compliance, risk, legal, IT departments. SMEs and large organizations that do not have internal
resources and possess sensitive data and applications should contact specialized consulting firms to
do a feasibility study.
Once that study completed, the organizations will be able to evaluate the offers received from the
providers. All the information must be clearly defined before using the services of a provider, either
on the website (electronic documents, white papers, …) if there no direct relation with the provider
or by asking more questions directly when needed. Other ways of obtaining information are like
customer reviews in public or private groups, and investigations or interviews from specialized
magazines (for example, the MagSecurs magazine is currently carrying out a study on Cloud
Computing providers that should be published soon).
Providers that do not accept the non-negotiable requirements should be avoided. When negotiable
requirements are not respected, negotiations should be conducted with the provider in terms of
recourse actions or financial compensations. But those negotiations are only possible when there is
no click-wrap contract as we will see in the next paragraph.
Audits
Most of the providers that offer a “no-relationship” model will not accept external security audits
because of the business model itself (Hogben, 2009). An audit entails costs for both the customers
(financial) and the provider (time). Only companies that will outsource either several applications or
critical ones will categorically want an audit, but only providers with custom-made contracts will
propose this type of service. The audit should reveal useful information on provider’s infrastructure,
applications and operations without impacting on the activity of the provider.
This will be very costly for independent SMEs, but SMEs that are part of a group could contact its
parent to work together, thus optimizing the costs of the audit.
Service Level Agreements

SLAs will have a key role in the choice of the provider. Having defined the right SLAs needed for each
application outsourced in the third part, organizations just have to focus on providers that respond
to such needs. But these companies will need more than just a number (i.e. a price): they will have to
understand how it was calculated and what are the architecture and operations in place to establish
this number. Some providers can propose SLAs that are over their real level of service by taking the
Cédric Mora
97 December 2009
risk that nothing will happen: it is a marketing and legal risk (Golden, 2009). Organizations will be
able to use services that offers 99.45% uptime (4 hours downtime) a month to 99.999% or even
100%. A simple example is the outage suffered by some providers that exceeds the uptime
guarantee.
Review the solution that is the best suited for the final users
Obviously, the most relevant factor to take into account, when evaluating what is the best solution, is
the final user’s satisfaction. Moving an application to the cloud should not degrade the end-user
experience. If we are considering the development of a new application, a particular attention should
be given to the quality of the service.
Some basic analysis should be done, addressing questions as follows: where are the final users? Are
they all located at a single work place or rather distributed in several locations worldwide? Does the
service offered by the provider meet user’s expectations?
Carrying out such an analysis will help the organization in dealing with geographic redundancy and
latency. In this connection, large organizations will tend to look for a service that can be provided
from multiple locations.
Different business models for each provider makes it difficult to compare

We saw in the economic model that for each solution, there can be a specific business model. For
example, some providers do not charge for the use of incoming bandwidth, but they do charge a
significant price for the use of outgoing bandwidth. Another model would be for a provider to charge
the same lower price for incoming and outgoing bandwidth. We see that, according to the behavior
of the application, an organization will prefer to put an application in a cloud rather than another.
This is an example, among others possible, of the wide range of the existing business models.
Test the provider

Possibly, the best advice is to test a provider by actually using the service within a Proof of Concept
approach (generally three months). This is the best way to judge some services and what is the
quality of service of the provider on:
• Flexibility;
• Pricing (truer when there is no relationship with the provider);
• Service management and customer relationship (truer with strategic relationships).
Of course, the risk in the case of a strategic relationship is that during the time of the Proof of
Concept, the quality of the service will be actually better than the average service given at a later
stage.
But, it will help an organization to know whether this is the right relationship and the right vendor or
not. An approach could be for a customer to test multiple providers at the same time before really
choosing one, and thus determine which one suits that customer the best. Of course, there is an
impact on the cost, but this is an interesting test that organizations can try very easily with click-wrap
contract solutions, and also with most of the strategic vendor solutions that will help the
organizations test their services.
Cédric Mora
98 December 2009
II.6.f. Conclusion
For the moment, most of the PaaS providers only offer click-wrap contract solutions whereas it is
easier to find IaaS solution with custom-made contracts.
The choice of the provider and the model of relation is a complex one as it will define the way you
manage and use IT services. To sum up what we said, we will repeat the key points of that exist when
choosing the vendor:
• Start choosing the vendor after defining your cloud strategy;
• Create a checklist that shows what are your requirements;
• Choose the model of relationship that is right for the organization;
• Do not hesitate to make some Proof of Concepts on provider premises;
• Partner legal and technical teams to analyze and then launch audit if really needed;
• Do not only choose a provider only on the price but also the services;
• Clearly review the contracts and solve issues that may have an impact on the activity of the
organization.
Cédric Mora
99 December 2009
Circumstances – “The environment”
II.7. Circumstances – “The environment”

Over the 6 previous parts, a clear environment has been defined that will influence every decision of
an organization. I will rapidly highlight the elements creating this environment and present the
lessons that I have drawn.
Choosing to use IaaS/PaaS Cloud Computing services is the result of simple elements that an IT
Department may not control. I have already referred to the economic situation that encourages
companies to reduce all cost, including IT costs. Cloud Computing allows to transform capital
expenditures into operational expenditures immediately. A CFO could ask the CIO to use these types
of services in order to respond to the challenges imposed by the economic environment in which the
organization operates. Over the long term, and possibly in different circumstances, an organization
would prefer the opposite (bad ROI, impact on accounting, etc.).
Something else could have an influence on a more political level as certain awareness is appearing
about how much resources companies are consuming. Green IT, which I won’t detail in this thesis, is
part of a global movement that promotes a better consumption and less pollution. Consolidation,
virtualization and, thus Cloud Computing for example, could be a way for organizations to only use
resources they need. Some actions already exist in the United Kingdom, which forces companies to
pay a tax when they do not respect the rules of environment sustainability. Conversely, organizations
respecting these rules will receive compensation.
Then, if the competition starts using these services and either find a way to get a better service level
or is stronger because it dedicated its resources to added-value tasks, would an organization
continue denying this new possibility? A company needs to evolve to be successful on the long term
and this is only possible with an adequate strategy, and by listening to customer needs (either
internal or external customers). The CIO will have to take into account their interlocutors who will
not want to hear that something is impossible because of the existing IT infrastructure and
applications; and if it is actually impossible, these interlocutors will require a credible explanation.
Figure 42 - Factors driving change (Behnia, et al., 2008)
Cédric Mora
100 December 2009
This will always be true for every IT Department and Cloud Computing represents a solution for some
of these needs for change. I developed a number of risks and issues associated with Cloud Computing
and obviously some organization won’t be able to use these services (legal or compliance issues). But
some other organizations, that have less sensible issues, will certainly rapidly adopt some services as
some responses will be given soon regarding:
• Technology (we can envisage a manner to bypass issues related to DataBase, migration,
etc.);
• Security (this being the major threat for every companies, we can envisage that large
investments will be realized to address this issue);
• Availability (new solutions will be created to enhance actual solutions);
• Lock-in, interoperability, Data location, etc.
An organization does not have any control over these issues but providers, consulting firms, software
vendors and legislators are expected to provide solutions for these issues, letting the organization
the possibility to deal only with issues it can work on by itself. The only remaining blocking points will
then be:
• The maturity of an organization which processes or management, for example, may be

heavily impacted; and
• The absence of real strategy and governance processes.
To find a way to resolve this, the right governance will have to be applied by the CIO with the
appropriate decisions based on the identified mechanisms:
• Strategy alignment: identify how the strategy can be improved with Cloud Computing
(Balance scorecard);
• Eligibility of the applications: how can an organization choose the right custom applications
for outsourcing;
• Choice of the relationship with a provider: what is the best relationship for an organization
depending on the expected services;
• Coherence with the internal maturity: evaluate the gap between the existing and future
situations;
• Gradual rise of this maturity: define phases, roles and objectives to reduce the gap.
The above is even more relevant for SMEs or startups that already have, or will have, specific
applications in their information system. For them, spending a large amount of money upfront on
something that may not be their core business (infrastructure and platform management) should be
less and less compelling. Their processes can still be quite easily changed to develop the right
mechanisms from the start. The lesson is that the environment may require, in the end, the adoption
of Cloud Computing services by the CIO. Some circumstances will create the right situation for such a
use and it would be nonsense not to integrate Cloud Computing services in the strategy, with all
necessary precautions being taken of course. Actually, it may offer a solution for the famous saying
“Do more/better with less”.
Cédric Mora
101 December 2009
III. Part 2 – Impact on the organization
Cédric Mora
102 December 2009
Part 2 – Impact on the organization
Strategy
Cloud Computing services offer a new way to consume IT resources, thus providing organizations
with a way to be closer to the needs of their customers, while still have differentiating applications
and focus more on value-added services. Organizations that have chosen to use this type of service
have been able to understand all existing risks and realize that a genuine strategy is needed to still be
able to keep some control. Depending on the relationship with the provider and the type of services
outsourced, consistent with the global strategy, an organization will experience some
transformational changes as it integrates technological, process and human factors:
• An internal reorganization of the IT department’s processes and resources;

• A new positioning of the IT department causing a paradigm shift in the structure of the
organization; and
• A better alignment with the business strategy and how the organization works.
We will develop our analysis according to the 7S model from McKinsey (Pacale, et al., 1981) with a
focus on the Strategy, Systems and Structure how they influence the other “Soft” elements: Shared
values, Style, Staff and Skills.
III.1. Strategy
Strategy is the key for an organization to develop its activities and achieve the long-term objectives.
As we have seen in Part 1, choosing to use Cloud Computing is already a strategic decision; however,
we only had a glimpse of the decisive impacts it has on the overall strategy of the organization.
III.1.a. Outsourcing is, by definition, a strategic decision

Using PaaS and IaaS services for the migration or the development of an application will be mainly
for cost reasons at first, if the economics are interesting. But Cloud Computing is about outsourcing a
number of tasks that were done by an organization, whether there is a strategic relationship with a
provider or not:
• Maintenance of servers, storage and other components;

• Advanced provisioning with the constructors;
• Middleware management (for PaaS services).
Doing so, two aspects are appearing: a focus on the core business and some employees that will not
have to do this job anymore. Some particularities of PaaS and IaaS Cloud Computing services over
traditional outsourcing are:
• Business Process Outsourcing of operational tasks (and not a complete service that is built
around the process of an organization, like Human Resources Management or Event
Management);
• A possible relationship is the absence of relationship, and one key characteristic of Cloud
Computing is the idea that the customer has a certain freedom (self-provisioning, etc.); and
• Migrate an application in the cloud does not necessarily mean cost savings.
However, this particular outsourcing raises as many questions as traditional outsourcing do and, if
generalized, operates a radical change in the strategy.
Cédric Mora
103 December 2009
Strategy
III.1.b. No longer restrict customers’ demands

The first impact is on the perception of the final users. One time limited, Business Units do not have
to limit their strategy to the existing infrastructure. Resources that were once onerous, limited and
complex are now accessible, easy to configure and paid by use. The strategy of an organization or a
business unit should not be curbed because the IT department does not have the reactivity or
enough resources for a new project or an event.
provider
“Cloud Computing will be important for the strategy of the organization. I have in mind the
example of a French company that produces ophthalmic lenses. This medium enterprise wanted
to improve its production line by reducing the delay for production and distribution. IT enabled
this company to achieve its objective and allowed it to gain important market shares. For it to be
possible, the company should not be hampered by the engine, the IT.”
The customers of the customers also have some needs and a way to reduce customer churn is to
deliver better: have a significant user experience for critical applications (low latency, availability),
business continuity for web application and sites, and continue innovating by introducing tangible
value.
III.1.c. The IT Strategy

The Business Strategy should reflect what an IT department can do and what the IT strategy shall be.
Decisions made without the participation of the IT department could create some of the risks we
already talked about. We will detail more extensively in the Structure part the consequences of
bypassing the CIO when the decision to outsource or not some specific applications is taken. But in
order to be proactive, the IT department must implement an IT strategy, preferably based on a
roadmap, to understand what benefits are accessible and what policies must be implemented.
III.1.d. IT, to influence the Business strategy

The IT strategy can even influence the Business strategy. Cloud Computing introduces new usages:
for example the use of resources for a short period of time or the punctual use of resources.
Organizations can experiment with the Cloud and create Proof of Concepts for innovation for
example. In other words, the organization can test new projects relatively quickly and stop them if
the return is not satisfying or the project is a failure. We can imagine the introduction of a new
capability in a software if the organization is an Independent Software Vendor or an online
application for eBusiness website (the example of the New York Times).
Cédric Mora
104 December 2009
Strategy
On the one hand, Cloud Computing can facilitate innovation through these new usages and, on the
other hand, the corresponding cost savings can be reallocated to finance other things, like
innovation, process optimization and maximization of performance.
III.1.e. Strategy maps

A strategy map is a visual representation of the strategy of an organization (Kaplan, et al., 2001). It
illustrates how the organization plans to achieve its mission and vision by means of a linked chain of
continuous improvements (Wikipedia, 2009). For a commercial business (here an eBusiness web site
or Independent Software Vendor), the strategy map illustrates the long-term game plan or
competitive strategy to achieve increased profitability. For a nonprofit or governmental organization
(here the IT department), it illustrates the plan by which the organization intends to improve
performance of its mission.
The following strategy maps does not present the real strategy of an organization, nor provide best
practices, but simply illustrates what could look like a strategy map where Cloud Computing services
are used to achieve the fixed goals.
The IT Department – “Large Organization”
Figure 43 - Strategy map of an IT department
The customer perspective has been replaced by the partner perspective: the business departments.
We see from the above Figure that the strategy has an important place and must follow the business
Cédric Mora
105 December 2009
Strategy
needs. The right combination between innovation and control will have to be found in order to
“deliver according to plan”.
e-Business web sites/ Independent Software Vendors – “SME”
Figure 44 - Strategy map of an eBusiness web site or an ISV
Those types of companies are intimately linked to their information systems as it is very often their
only source of income. Flexibility, rapidity and innovation are their only way to differentiate
themselves from competitors. Cloud Computing services need to address those needs.
Strategic measures and targets will have to be defined by the organization, based on those strategy
maps. For the Internal perspective, which explicitly underlines the role of those services,
organizations could have the following characteristics [Strategic objective – Strategic measure -
Target]:
• “Create new projects quickly” – Time to launch a new project – Reduce time by 50%;
• “Offer flexibility and scalability” – Number of users that were not able to access the service,
or accessed to a low quality service – Reduce by 90%;
• “Cloud Strategy and Governance” – Review applications and infrastructures in a committee
responsible for the eligibility – Analyze 50% of those applications and infrastructures;
• Etc.
This exercise to develop a strategy map will help a company to understand where it is now, where it
wants to be and how to get there. An organization that spends large sums of money to “Run IT”
Cédric Mora
106 December 2009
Strategy
could find it beneficial to develop a new strategy based on the use of Cloud Computing services
(either migrating custom applications or launching transformational projects).
Cédric Mora
107 December 2009
Systems
III.2. Systems
Cloud Computing will obviously have a transformational impact on the systems of an organization
because with the Cloud Computing, the IT department will move from the control of an
infrastructure to the control of a process. The information system is divided in multiple geographic
locations that can be controlled by different actors: the IT department, French providers, non-
European providers, etc.
Before explaining all the impacts, it is important to understand what is the maturity of an
Information System for a given organization. The simple figure below shows that four types of
situation exist: from an IS that is very expensive and does not offer value, to an IS that can provide a
competitive advantage.
Figure 45 - Path of progress for the Information System (CapGemini, 2008)
With Cloud Computing, early adopters from SMEs and large organizations could theoretically access
the first and second situations:
• Part of the maintenance on the infrastructure level can be outsourced;

• High flexibility and agility;
• Project can be stopped any time with certain providers;
• Outsourcing of certain applications provide cost reduction; and
• More time to think and urban the Information System.
Startups could even start directly with a “controlled” information system giving them a good base to
develop their activities and evolve easily when necessary.
CapGemini consulting firm calls the “abyss” the situation where an organization start investing in IT
without the returns it was waiting for. PaaS and IaaS services could help the CIO to “jump the abyss”
but he will have to understand the overall impacts on all processes in order to benefit from these
services.
Cédric Mora
108 December 2009
Systems
III.2.a. Internal reorganization of the IT department’s

processes and management
Some IT departments have a strategic place in an organization, others are considered as cost centers,
but they are all trying to get more maturity to improve the service they provide. SMEs and large
companies know that information is one of the most strategic resources inside an organization. The
early adopters that will use PaaS and IaaS services in the next months will still need to collect,
analyze, product and distribute information without problems. Thus, they need to understand what
the potential impacts on the IT department are, regarding: management, realization of new projects,
assurance of quality and employees. To help us understand what the changes are, we will look at the
ITIL framework which deals with those types of issues.
ITIL Service strategy

The first service of ITIL, Service Strategy, suggests that the “[IT department’s customers] do not buy
products but the satisfaction of particular needs” (ITSMF - The IT Service Management Forum, 2007).
To provide the right services, the IT department needs to have a clear strategy on: “the services
offered, the providers offering the services, the perception and measure of the services, the financial
management, the allocation of resources, the combination of internal and external services”, etc.
The Cloud Maturity Model outlined in the third part shows that, initially, organizations will
experiment Cloud Computing with an additional set of infrastructure that would co-exist with the
existing traditional infrastructure. Thus, the first key process that will be impacted will certainly be
the Service Portfolio Management because the use of a new service leads to the complete
description of the new service which includes at least the business case, the value of the service in
the portfolio and the approval. Those 3 characteristics will be difficult to complete because the
comparison between the services offered is not easy (why is the business model better?) and some
policies could limit their use.
Financial Management is also impacted in 3 ways. First, we will see an improvement of the
chargeback to the departments that use IT services if the virtual servers, storage, or applications
developed on PaaS platforms are correctly managed, because organizations will be able to trace the
final users more easily. Second, the economic model “pay-as-you-go” shows that an organization can
take less financial risks with an allocated budget, for the IT department, that is more closely linked to
the revenues. But this model can represent a danger if the management of the IT resources is not
controlled because of the dynamic and automated nature of the environment. The estimation of the
budget on a one-year period will be based on the growth of the activity of the organization, but
server sprawl is a reality in a virtual environment.
The last key process impacted is Demand Management because Cloud Computing represents a
solution which allows for the “uncertainty of the demand”. With the Cloud Computing, organizations
will not experience an excess capacity issue since the capacity will automatically meet the demand.
Such an improvement does not mean that an organization does not have to control the demand.
ITIL Service Design

Service Design, within the business change process, is defined as the “design of appropriate and
innovative IT services with the following goals”: “identify and manage risks, design secure and
resilient IT infrastructure and environments, design measurement methods and metrics, maintains
Cédric Mora
109 December 2009
Systems
processes and policies, and develop skills and capabilities within IT” (ITSMF - The IT Service
Management Forum, 2007).
Some processes of Service Design will be automated when others will have a greater importance. For
example, Service Level Management and Capacity Management are task that can be easily
automated with the right tools because it is easier to have an overview of the entire infrastructure
and platforms, and the corresponding agreements. A point to emphasize is that, although the CIO
will get clear SLAs on the provided services, the monitoring part of those 2 processes will still be
necessary for determining whether the provider meets the requirements. The nature of Cloud
Computing is also to address availability issues deferring part of the problem of Availability
Management to the provider according to customer needs. Still, Service Design has to focus on what
is the needed availability: a non-critical service may only need a 95% availability rate when a critical
service (for example an eBusiness website) should need the maximum availability possible because a
lower percentage would result in a loss of revenue. With a proper management and classification of
the services (see CMDB in ITIL Service Transition), the IT department will be able to really choose and
improve the availability needed for the service and not the availability of the underlying systems and
infrastructures.
IT Service Continuity Management can be addressed with Cloud Computing solutions by introducing
risk reduction measures and recovery options at technical level. We have seen in the second part
above, however, that some risks may be too serious for a company (lock-in issues for Platform-as-a-
Service, or network issues need to be taken into account). Those services need to be integrated in
the global Business Continuity Plans. The choice of services from providers that cannot be trusted will
have a direct impact on this process. The same problem exists with Information Security
Management where security issues that could appear in Cloud Computing need to be addressed with
the overall corporate governance framework. This will be difficult if the existing policies are not
applicable in the Cloud environment. An organization may have to compromise between the strategy
to outsource a service and the need for security. This process may also be responsible for the result
of potential audits of providers as explained in this thesis.
Of course, the largest impacts will be on the Supplier Management process, simply because the
number of providers will be higher. This will result in an increased complexity and a larger perimeter
for the process, for example to determine whether the providers perform according to the terms and
conditions of their contracts.
ITIL Service Transition

Service Transition “delivers services that are required by the business into operational use” (ITSMF -
The IT Service Management Forum, 2007). The purposes are: “ensure that the service can operate in
foreseeable extreme or abnormal circumstances, identify the stakeholders within suppliers, customer
and other areas and adaptation of service design where the need is detected during transition”.
The Change Management process is the key activity of the Service Transition because all changes are
“recorded, evaluated, authorized, prioritized, planned, tested, implemented, documented and
reviewed". PaaS, IaaS and virtualization in general provide a fast access to the IT resources,
accelerating at the same time the process of Change Management. This evolution to a real-time
management is important in terms of Financial Management. Since resources are paid when they are
used (often by the hour), the organization will still pay for these resources, whether or not they are
Cédric Mora
110 December 2009
Systems
needed, in case the process to stop using them has not been implemented. Impacts of automation
on Change Management can have serious consequences and need to be analyzed by the IT
department as this is something which could jeopardize the estimated ROI.
The process of Service Asset and Configuration Management controls internal and external
resources and Cloud resources add a complexity over this management with new Configuration
Items. The number of Configuration Items could increase significantly and this is why the importance
of the CMDB (Configuration Management DataBase) will also increase. Thus, mapping the data, the
services and their dependency relationships will become vital so as not to lose visibility on the new
assets. Change Management requires real-time management and the CMDB will have to support this
characteristic when, before, it was updated only on a daily or weekly basis.
As a first step, it is important that some processes be strengthened. The Service Validation and
Testing and the Evaluation processes will be the right services to analyze with a Proof of Concept if a
project is right for Cloud Computing services. This process will have to define what the right SLAs are
and if the other processes implemented will be mature enough for the adoption of a new Cloud
service. An interesting point is that with Platform-as-a-Service and with some Infrastructure-as-a-
Service solutions, the Service Validation and Testing and Release and Deployment Management will
simplified because they will be integrated and automated in a global solution.
ITIL Service Operation

Service Operation’s purpose is to “deliver agreed levels of service to users and customers, and to
manage the applications, technology and infrastructure that support delivery of the services”.
Due to the nature of Cloud Computing and virtualization, which offers new possibilities for business
continuity (automated resolution of problems), some processes like Problem management, Event
management or Incident Management will likely be easier to achieve on the infrastructure level. The
staff can focus then on the custom applications or development issues that are really important for
the organization. Routine interventions may be automated and recurring incidents eliminated.
Particular should be given to the Request Fulfillment and Access Management processes because of
the self-service access to IT resources. Agility and control must be balanced so that users still have
the benefits offered by Cloud Computing (simplicity of access to resources, etc.) but within a frame
defined by Service Operation and respecting the policies of Service Strategy. All Cloud Computing
issues regarding confidentiality, integrity of data and intellectual property are managed within the
Access management process. The impact of Cloud adoption on this process is very serious and should
be emphasized.
ITIL Continual Service Improvement

While Service Strategy and Service Transition is highly significant at the time of the decision of Cloud
adoption is taken, Continual Service Improvement will certainly reveal issues that had not been
detected before, when using these services. The purpose of this service is to “maintain value for
customers through the continual evaluation and improvement of the quality of services”.
The CSI service will present how it is possible to improve the value of a service: the establishment of
goals and measurable targets will determine if an organization will increase the use of Cloud
Cédric Mora
111 December 2009
Systems
Computing services in case of success or stop using such services if there was no improvement or
worse.
We can see some obvious metrics that can be used to analyze the impact:
• Technology metrics: SLAs for a specific PaaS or IaaS service, average time to solve an
incident, utilization rate of the resources, etc.;
• Process metrics: Number of problems or incidents automatically resolved in Incident or
Problem Management processes, Time needed to add a change request in the CMDB, gap
between allocated budget and consumed budget in the Financial process, etc.;
• Service metrics: Response time (time needed for an end-user transaction to complete),
System agility (alignment of IT versus workload over time), etc.
Lionel Pelletier, Senior Consultant at COLT, has been the CIO of numerous French
organizations, is ITIL certified and he had the opportunity to implement ITIL on several
occasions for large groups.
“If we look at the ITIL processes, we can see some important impacts on the internal services
and processes.
Configuration Management will become more complex with Cloud Computing. I think that the
entire model should be rethought because of the introduction of the virtual dimension in
comparison with the existing dimensions that are:
- Identity;
- Hardware; and
- Software libraries.
Continued Service improvement will become important. The acceleration of the service will
create new issues around the fluidity of the processes. Thus, the management of the processes
will have to be significantly improved.
Finally, Service Transition will impose deployment acceleration as a general rule.”
Cédric Mora
112 December 2009
Systems
The following figure is a graphical overview of the impacts on the processes of the IT department:
Figure 46 - Control the process, overview of the ITIL schema (ITSMF - The IT Service Management
Forum, 2007)
Towards Greater maturity

Looking at the impact Cloud Computing may have on the ITIL services allow us to understand that the
adoption of new services will certainly create management issues within the IT department, being
overtaken by the events.
Even a Private Cloud can create some of the issues as I recently heard at a Conference on Cloud
Computing (vi). One of the participants with whom I was discussing told me that he was tasked with
the deployment of virtualization inside his organization and that he experienced numerous problems
with the management of these servers. The different users created hundreds of virtual machines that
where not stopped at the end of their utilization. The administrators were not able to understand
who was using these servers and so, didn’t know if they could get rid of the virtual machines. The
organization ended up paying for a large number of licenses for the operating systems and the
Cédric Mora
113 December 2009
Systems
applications on those virtual machines. He said that he considered the possibility of stopping using
virtualization as the projected ROI has not been reached. He questioned whether the adoption of
IaaS services would not aggravate the problem since some resources would be paid for use.
Whether an organization is ITIL certified or not, those impacts will be real on that organization. We
can understand from all those findings that the adoption of Cloud Computing is not transparent for
the customer. Without the proper processes and Service Value chain (ITIL or not), an organization
will certainly create new issues that will reduce the expected benefits.
We already addressed the question of the maturity and we can say that the more the organization is
mature, the more it will benefit from these services. At the same time, this is a significant
opportunity for organizations to implement mature processes.
Guillaume Plouin, Head of the Cloud Computing offering at Octo Technology and
author of the book “Cloud Computing and SaaS” (Dunod).
“Cloud Computing is a great opportunity to have services with clear SLAs with cost controls
because organizations always have serious difficulties in establishing service guarantees in-
house and knowing what is the benefit of IT against the cost. Cloud Computing providers are
capable to charge on CPU utilization, bandwidth or storage for example. Cloud users are
becoming more mature than what I can see in other companies because they directly have to
use best practices. In a way, Cloud Computing is more in line with ITIL than what IT is in most of
French companies.
An organization that uses Amazon Web Services knows exactly what services it pays for and
maybe this is also a way for startups and SMEs to structure their processes like major
organizations and maybe better. This is possible because Cloud Computing providers are very
well structured because they are industrials of infrastructure and platforms operation.”
Cédric Mora
114 December 2009
Systems
III.2.b. Realization of an application VS Migration of

an application
From the beginning, we have identified two moments where Cloud Computing can be used:
• For the realization of an application (new project); and

• For the migration of an application in the cloud (existing application).
If we look at the complete lifecycle of an IT application, we have the following overview:
Figure 47 - Application lifecycle, adapted from the project (Hugon, et al., 2009) and operational
lifecycles
The three identified phases are:
• Analysis and Conception: “Writing a project plan”;

o The requirements of an organization launch this step;
o This is the traditional step where the perimeter, budget and resources are chosen
with the inputs of the project; the planning, quality, governance and risks are defined
regarding to goals and policies of the organization; and documents are realized to
specify what needs to be done (by in-house staff or a third-party integrator).
• Development to Production: “Realization of the project”;
o The project is realized (it depends on the method of development – iterative, V cycle,
agile -, but usually Development, Test, Recipe and Documentation) and deployed;
Cédric Mora
115 December 2009
Systems
oThe projects ends with the capitalization of knowledge where everyone on the
project make an assessment;
o Project management will be very important here as it controls this important phase
(All projects failure happen during this phase). Also, throughout this phase,
communication to and change management of the future users will be important if
an organization wants to successfully install a new application.
• Operate on the application in production: “Operational/Production and maintenance
phases”
o This phase differentiates the operation and maintenance of the applications and the
underlying infrastructures. We often associate it with the “RUN” phase:
organizations dedicate here 80% on their IT budget on average.
o We learned from ITIL that the Continual Service improvement helps in the
management of application and infrastructure. It can go back to “defining
requirements” if the organization needs an evolution on the application.
o The last possibility is for an organization to stop using an application (“death”).
This figure will help me identify the phases that will be impacted on a French SME or Early adopter,
with the use of PaaS and IaaS Cloud Computing services.
Cédric Mora
116 December 2009
Systems
Infrastructure-as-a-service
Infrastructure-as-a-Service allows an organization to obtain servers, storage and bandwidth
resources at any time. During a project, the organization can decide to make all the realization in the
Cloud or after developing in-house. For an existing application, the organization will do it while it is
still in the operational phase. If we use the previous application lifecycle and highlight the
specificities, we obtain the following figure.
Figure 48 - Application lifecycle with Infrastructure-as-a-Service
The realization of an application in the cloud using Infrastructure-as-a-Service will not change
fundamentally but project preparation is essential. In effect, Cloud Computing introduces the
following possibilities:
• Use servers in the Cloud for development, test or recipe, or a combination of those;
• Deploy applications, which were developed in-house, in the cloud or deploy in a private
environment an application that were test and developed in the cloud;
• Mix services from different providers (including the IT department) for one phase (ex:
production); and
• Use services from different providers (including the IT department) during each phase.
We have seen some specificities of IaaS services in different parts of the thesis and we will see more
precisely below what an organization should take into consideration when realizing a new project or
a migration project.
Cédric Mora
117 December 2009
Systems
Governance and risks
• Issues & Best practices:

o Potential risks, which were explained in the first part, are found in the project.
Outsourcing the infrastructure that will be used during the project realization phase
may create sensitive issues regarding security because the project may contain
classified or personal data. Even if the resources used are for simple test and
development, security can be necessary (firewalls, etc). As a rule, the best practice
for test, development and recipe, should be not to use real data and even more if
there is only basic security.
o Non-compliance with policies. It is still possible that during the realization, an
organization finds that the policies defined in the governance are not respected. It
will certainly be the case if the organization uses for the first time such services and
the project preparation phase was not thought through. The right approach is to list
all the potential issues regarding the adoption of IaaS and matching it with
specification of the project.
o Backsourcing a project that is being developed in the Cloud can be either an easy or
difficult task depending on the solution of the provider. We can still make two
observations: it will be easier with IaaS and the issue needs to be dealt with at the
beginning. Moreover, some providers have self-service solutions that can be specific
to cloud environments. Specific developments need to be the less specific possible in
case of backsourcing.
o Lifecycle of the resources used for the project. A project will consume resources and
now an organization has the responsibility to manage temporary resources that have
now a life duration which is not traditional (a few months, a few days, a few hours,
etc.).
Quality

o Loss of quality may occur when using a different environment for development, test
and production. Obviously, the cloud environment has some specificities and test
and recipe rarely recreate the exact production environment if the project is
deployed in-house at the end. The same type of quality issues exists if one
organization decided, for example, to develop and test an application with a low-cost
provider and then deploy it into another environment (different SLAs, geographic
position, etc.). The main idea is to integrate the overall process in a quality test plan
that will identify the needs (scalability, security, robustness, etc.). For example, a rule
might be to use the same level of SLAs, or the same provider for test and production
environments.
o Integration with the existing Information System. Quality must be analyzed also
with the existing infrastructure and applications because the combination of both
outsourced infrastructures and on-premises ones can create some problems:
latency, new errors. This could ultimately impact some applications that were not
outsourced but are part of a process that use outsourced services.
Cédric Mora
118 December 2009
Systems
Communication

o Lack of communication with the provider during a project. Some Cloud Computing
services are accessible online with no contact from the provider. Using these new
services without any help or recommendation can definitely be a time bomb because
bad practices will have been established from the beginning. The “Interface model”,
where a prescriber will accompany an organization to establish basic scenarios, is
definitely a good solution.
Cédric Mora
119 December 2009
Systems
Platform-as-a-service
Platform-as-a-Service allows an organization to access an environment where there can be
configurable data models, configurable user interface, workflow models, integration APIs,
middleware, etc. During a new project, developers will find all the tools necessary for a specific task.
Migrate an existing application to a Platform-as-a-Service for production will quasi impossible
without development as we saw in the first part. If we use the previous application lifecycle and
highlight the specificities, we obtain the following figure.
Figure 49 - Application lifecycle with Platform-as-a-Service
Using a Platform-as-a-Service will really change the way an application is realized. IT departments will
be able to:
• Choose to develop an application with the specific PaaS framework from the provider;
• Use PaaS platforms to test (typology of the service) an application developed in-house; and
• Mix different PaaS services with internal services for production, creating an hybrid cloud.
Governance and risks

o Specificity of some developments. Some PaaS services offer a simple test
environment while some others offer a complete environment integrating
development, test, deployment, also offering integration with other services and
Cédric Mora
120 December 2009
Systems
specific services (database, language frameworks, etc.). The right risk analysis should
be done during project preparation, and consistent with the strategy.
o New services that have not been approved by a committee. We are in a phase
where providers launch numerous new services. It is quite possible that, during a
new project, the provider offer the customer to use a newly-created service. The
organizations must be careful with services that were not approved by the Cloud
Computing strategy and roadmap, and that were not planned in project preparation.
Quality

o There could be problems if there is a separation of the development and test
phases. PaaS services accelerate the creation of an application because developers
can focus only on the development part. Also, we can imagine that, as a first step, an
organization will develop applications that are not very complex because this is
something new. The testers will generally join the project at the end but it would be
interesting to integrate them at the very beginning. This is possible because some
providers have services that allow multiple views by different profiles, thus enabling
the testers to do unit testing very quickly. Otherwise, the organization would lose not
only the time that it has gained through the collaboration, but also the possibility to
have a complete view.
o Quality of the service for the development part is not sufficient. During the
development, the staff involved in the project may encounter difficulties to proceed
easily with that development because of the lack of adapted tools, or of the
necessary degree of freedom for conducting the activity, and consequently the
quality of the final product could be at risk. Clearly, the possibilities are limited to the
environment proposed in the service. A way to avoid this is to test the service on
small projects (proof of concept), look at the quality of the service and then start
using it for more complex projects.
o Faulty assessments of the technical specifications. During the development, a
project manager can discover that some faulty assessments were done and that the
technical specificities of the project are not suitable for a PaaS environment. Project
failures are not as disastrous as they were before because the resources are
consumed only for the duration of the development and of the project itself, without
a large investment upfront, and it is possible to stop at any time that activity.
Communication & Change management

o Use the time saved for more Change Management. Launch a project with PaaS
services is very quick because the entire environment is already available and
developers can start as soon as they have the technical specifications. The time
saved on development can be spent on change management: train the users,
implicate them, etc.
Third-Party integrator
Cédric Mora
121 December 2009
Systems

o Shorten developments mean closer relationship with a third-party integrator. An
organization can choose to outsource the development of the application but still
choose to host it with Cloud services. This could complicate the relationship with a
third-party integrator as the project will be shorter but more intense in terms of
exchange between the two organizations. In effect, with some PaaS solutions, the
organization will be able to see what the third-party integrator is doing (it is an
online platform) and give some feedback.
I have tried to emphasize earlier some possible impacts of PaaS and IaaS services on the way projects
are planned; however, some new impacts will certainly appear as these services will be increasingly
used. Only a small number of companies have used IaaS services, and a smaller number have used
PaaS services. Consequently, the first Return on Experience will be key elements in the success of this
type of services.
Laurent Dupuytout, CEO of the French consulting firm AVS Consulting, expert in
Cloud Computing solutions and realized integrations on PaaS platforms.
“The governance tool that was realized on Force.com PaaS platform was finished very recently
and we got a very interesting feedback from our customers.
First, there was a global respect of timing and costs, even if it was postponed by one week and
a half because the need evolved during the project.
Second, because the customer has the same access to this platform as the integrator, he has
the ability to see the application evolve in real time during the buildup phase. It enables both
sides to share ideas and test these ideas at the same time.
Third, regarding the project management, we have seen that the clients’ teams appeared to be
totally overwhelmed. Indeed, while AVS consulting team was 100% on the project, the client’s
team had to perform other tasks in parallel. Thus, there was a bad estimate of the workload
for them (software design validation and recipe). In the recipe phase, there have been changes
in design, and we have seen that allowed us to make the changes.
Four, there were more developments than expected in order to let client’s administrators, that
are not computer experts, make the application evolve easily with simple click and drops. The
specific development represented 20 days, which is not a very large number. In case of
problems, even if we had to throw out everything and start all over again, it would not
jeopardize this major international group.”
Cédric Mora
122 December 2009
Systems
III.2.c. New Tools

With this new model, an entire ecosystem has been created around these services to help with
management issues, risk issues, supervision issues, etc. Of course, new processes have to be
implemented and others have to be strengthened, and this is because the processes need to be
automated, or are becoming critical in terms of risks, as we have seen when we analyzed it with ITIL.
Obviously, using Cloud Computing services will have an impact on the tools that are currently used,
and those which will be used in the future, by the different organizations. Software currently
available in the organization do not have the necessary reactivity and cannot interface with Cloud
Computing resources. Thus, to help the organization overcome these issues, some companies have
created new tools to:
• Manage resources when they are in the “No-relationship model”;

o Using the services from Amazon where there is an API to manipulate the resources is
great for self-provisioning and letting users do what they want. But, if new processes
are developed around these services for change request, access management or
infrastructure lifecycle management, the organization will want to manage more
efficiently the off-premises resources.
• Provide a unique interface to manipulate on-premises and off-premises resources from
multiple providers;
o If an organization does not want to have multiple environments for each provider,
including the IT department, it will need a unique interface that authorizes the
management of resources that can be anywhere in internal or external clouds.
Complexity is thus reduced and it is easier to have an overview of the global
infrastructure.
• Integrate ITIL best practices in a software created for all Cloud environments;
o If an organization has or is implementing ITIL, it will need to be able to use the
services according to those principles. It is not the case for a majority of APIs from
the providers.
• Data governance (organize data between those that should be hosted in-house and those
that can be in the cloud);
o Data security and privacy is a big issue for organizations. Having a tool that will
enable a company where all data are and be able to control any movement,
destruction for compliance and business continuity will be an essential task.
• Apply policy enforcement for all Cloud Services.
o An organization will possibly need to apply policy enforcement measures for all
applications in the Cloud with a defined governance: authentication, confidentiality,
routing, SLAs, alerts, events, authorizations, integrity, audit, monitoring, etc. Those
policy enforcement measures can be applied on incoming traffic (ex: a third party
PaaS application that need to access data locked on-premises), outgoing traffic (ex:
unsanctioned use of PaaS components by well-meaning developers, monitoring of
authorized cloud service activity) and Cloud services (ex: protect data and
applications from unauthorized use, manage the distribution of requests to
application instances between vendors).
Cédric Mora
123 December 2009
Systems
See Annex VII for more information.
III.2.d. Impact of the new billing

The new economic model will have an impact on all activities that are connected to budget
construction. The traditional model, under which an organization created the budget for the
following year, is being questioned. At the same time, an organization knows exactly what it is paying
for (resources consumed, etc.) and it is assumed that it can pay more for a short period if there is a
growth of the activity. Organizations have to forecast over the years how will evolve the application
and prepare the budget accordingly. This model will be difficult, for example, for French government
agencies which cannot exceed the budget when it is fixed at the beginning of a year.
All Information Systems that cannot integrate this model will have some issues:
• Forecast management may need to allow re-planning;

• Purchasing management is changed because resources are not bought but rented (pay for
use);
• Order fulfillment and logistics management: resources bought in the cloud are available
very quickly whereas the logistic may impose a lengthy process in reality; etc.
Is this new model interesting for an organization? A first answer is that, if the billing that is chosen
corresponds to the business model of the organization, it will certainly result in a significant
advantage. For the moment, the appearing business models mix different elements: number of
users, CPU consumed, incoming and outgoing traffic, and storage used, etc. This call for two remarks
to be made: these models may not be integrated in the existing information system, thus creating
new issues, and these models may not be the ones that will be of interest to the organization.
Henry Peyret, Principal Analyst at Forrester.
“Billing will be very important: the real flexibility for the organization will be its ability to select
the billing model that is interesting for it. A small number of providers are offering the possibility
to choose the billing model, not imposing their own new model but rather offering a wide range
of billing models when the organization contracts the service. Obviously, the organization will
know the billing model that will best answer to its own need for flexibility and for now the
flexibility is closer to the provider’s consumption (CPU, bandwidth, etc.). An example of model for
the organization could be a transaction payment model, a time spent model or volume used.”
I recently discovered that employees in an organization used Amazon Web Services to access quickly
servers with a view to developing and testing an application. There was no management whatsoever
around this action (security management, purchasing management, etc.) and these employees
presented afterwards an expense claim to the organization. Obviously, this needs to be integrated in
the management of the expenses, with a dedicated process, including because of the possibility for
abuses.
Cédric Mora
124 December 2009
Systems
III.2.e. Contracting
We indicated previously that a Cloud Computing contract looks like a
usual outsourcing contract with some specificities. Unlike outsourcing
Text approved by contracts, there is no return on experience from the first contracts that
Isabelle Issert de were subscribed. Surely, those contracts will not be as rigorous as some
Braux, lawyer at COLT organizations would like them to be. Besides, Cloud Computing
Telecom introduces the click-wrap contract in the professional sphere: this is a
contract where there is no negotiation possible and that is not even read
or analyzed. Cloud Computing contracts can be established between two French companies but it is
more likely that they will be done in an international context since a large number of providers are
non-European. These situations underline issues that must be controlled in a contract.
Click-wrap contracts
By definition, a click-wrap contract is a contract where a customer can only have two options:
• Accept all the clauses – “Validate”; and

• Refuse the contract if only one of the clauses does not meet the requirements – “Refuse”.
Those contracts are used every day on internet by final users that do not read what the conditions
are. The easiness to access those types of services by anyone is proportional to the risk that
organization may experience. Here are the issues and best practices for those types of contracts.
Issues
• ① No customization of the contract: the specificities of the organizations or applications
are not taken into account because it is impossible to contact the organization and negotiate
the contract with their lawyers. If the SLAs do not respect the requirements, or if some
clauses do not respect the internal policy, it will be the responsibility of the customer to
determine if it is acceptable to take the risk under those conditions.
• ② No legal officer in the process: any employee can easily access the services and accept
the click-wrap contract without validation from the legal department. The provider does not
require any assurance from the customer who can be anyone in the organization. Basically,
anyone can use those services and put on the cloud data or application that does not respect
the internal policy and that can entail serious legal issues, resulting in financial penalties for
the company. Some clauses from the providers could create a genuine risk, like “Provider can
change the terms of this Agreement without prior notice to customer”.
• ③ Privacy and Intellectual property clauses: the contract needs to answer to basic
questions regarding privacy or intellectual property issues. The protection to be granted to
information collected on the use the client is making of the various services should be
stipulated (the contract containing indications where this information is stored and on who
can have access to that information etc.), and in particular whether the provider have some
rights on the corresponding data. Although PaaS and IaaS are less impacted than SaaS (for
example with advertising on the screen based on organization data), the users of the services
need to be aware of the different risks related to privacy and intellectual property issues.
• ④ SLAs not indicated or do not have metrics: some SLAs are technical and may not be
formulated in a precise manner, different possibilities being offered depending on changing
Cédric Mora
125 December 2009
Systems
situations. For example, incoherent information may be given in the contract for Guaranteed
Response Time and Guaranteed Fault Repair Time that can expressed either in monthly or
annual numbers. If no metrics are given for the client to understand the information, those
numbers should not be trusted.
• ⑤ Financial compensations: compensations must be clearly indicated in the contract with
the SLAs. Some services will not provide sufficient compensation to balance the loss in case
of non-respect of the SLAs. This type of contract does not address the specificity of the
application, and consequently it is the sole responsibility of the customer to manage the
risks. For example, in Amazon EC2, the contract generally provides that compensation will be
granted only for failure of the hardware, and thus no commitment is made based on the
potential loss related to the specificity of the application: “You are personally responsible for
all Applications running on and traffic originating from the instances you initiate within
Amazon EC2”.
• ⑥ Other data issues (data retention, data movement, duty of care, etc): these elements
must clearly be indicated in the contract.
• ⑦ Arbitration and Mediation in International Contracts: some contracts may stipulate
dispute settlement procedures particularly burdensome for the client (for example imposing
arbitration and excluding mediation), or an attribution of national law jurisdiction which is
not favorable to the client.
Best practices
• ❶ Partner legal and technical teams to analyze the contract: lawyers are generally called
to intervene only when the organization could face a threatening issue, and they may not be
involved in the early stages of the negotiation, something which can create dramatic
situations. As much as possible, legal teams and technical teams should decide whether it is
desirable to use a service, and if so in which configuration (data location, securities), before
actually start using such a service, even if it would appear very simple to access the service
without bothering with much advance scrutiny.
• ❷ Do not accept a contract that has a clause which does not meet the requirements. This
looks like very strict advice but, if a client would accept such a thing, any application or data
hosted in the provider’s premises should then be considered as compromised. Thus, specific
uses like simple test projects that do not contain sensitive data may be used on those types
of service and nothing else. Even those simple projects should be closely monitored by the
legal, compliance and technical teams because the contract does not reflect the kind of
engagement desired.
• ❸ Create a list of authorized providers: the best way to be proactive is to choose a number
of providers that offer services in a click-wrap contract way after having carefully reviewed
the conditions and find them acceptable; this would normally apply to SLAs of providers that
really explain the nature of their services with sufficient transparency, and this, for a certain
type of applications and data.
Custom-made contracts
Custom-made contracts are obviously the preferred ones because they provide the organization with
the possibility to negotiate, enabling the service provider to take into account the specificities of the
Cédric Mora
126 December 2009
Systems
client. By definition, if this is a custom-made contract, organizations and their lawyers will be able to
enter into a genuine dialogue with the providers, but that doesn’t mean that there are no potential
issues to consider.
Issues
• ⑧ End of contract: the major issue is the end (expiration or termination) of the contract
which will rarely be covered adequately in the contract. This raises the concern, already
referred to in the thesis, regarding the reliability of the services or providers for a long period
(recovery, long-term viability). The best example is the company called The Linkup which
closed in August 2008, letting 20 000 customers paying for storage without the possibility of
getting their data back (Krigsman, 2008). Obviously, nothing was specified in this contract
regarding what would happen if such a situation, i.e. the unexpected closing of the company,
would materialize.
Best practices
• ❹ Assurance of legal and compliance requirements: all requirements regarding compliance
need to be detailed in the contract. This will be an assurance for the customer in case of
audit, and, by the same token, it will demonstrate good faith on the part of the client.
• ❺ Use Professional Services and specify how the provider interact with the organization:
the use of experts is a good choice as it is will consolidate the strategic relationship and help
the provider getting a better understanding of the organization’s activities and of the
sensitivity of some data and applications for that organization. This solution really defines
how the organization really collaborates with the provider: this is a win-win situation for the
relationship of the parties (i.e. contributing to establish confidence between the two parties
and supporting the potential evolution of the perimeter). The contract must stipulate how is
conducted the communication between the organization and the provider (form, duration,
timing etc.). The conditions for enabling the provider to intervene efficiently must be
formulated precisely for the different steps: the call, Guaranteed Response Time and
Guaranteed Fault Repair Time, all this being dependent on how critical the applications are.
• ❻ Integrate audit clauses: to ensure continuity in the compliance, it is necessary to write
how often and in what perimeter the audit need to be done. This is an assurance that the
provider will comply with the necessary requirements throughout the duration of the
contract. The contract will have to specify the human and organizational resources, and the
information and different tests being required.
• ❼ eDiscovery should be discussed: this matter can be a sensitive one because it can result
in a substantially more complex contract, thus inducing delays in the negotiation and
adjustments in the pricing schedules. But if the contract is silent on this aspect, the
cooperation and costs of the service provider will be unpredictable.
• ❽ Information on subcontractors: providers can also have subcontractors that can realize
some specific tasks like migration, archiving or backup. Of course, the lawyer will prefer to
select a provider that does not subcontract, since this will facilitate compliance with the
requirements and for obvious security reasons. If sub-contracting cannot be avoided, it
would be important to regulate it carefully in an appropriate framework.
• ❾ Difficulty of changeover periods: Isabelle Issert de Braux underlines the need to regulate
precisely the changeover periods, during which you move from the existing service to the
Cédric Mora
127 December 2009
Systems
new one (migration), and the case of reversibility and transfer so as to be able to prepare the
end of contract. All the conditions must be explained, and more particularly those that would
trigger the changeover period. In the case of reversibility, the perimeter of the information
recovered must be defined, and more importantly the manner in which such reversibility will
be realized (processes, technics) has to be specified.
• ❿ SLAs defined with Key Performance Indicators: during the operational phase, the SLAs
must be clearly respected and analyzed with KPI specified in the contract to control the
quality.
• ⓫ Analyze in case of non-respect of the SLAs: with the financial compensations, it is
advisable to indicate in the contract that all failure to the SLAs will result in documented
diagnoses addressing, for example: What caused the issues? For how long? and How was it
solved?. The contract must clearly indicate that providers have to provide the maximum
degree of transparency on their analysis, because the default solution would be for the
provider to give minimal information, without revealing what faced the organization in
reality.
• ⓬ Benchmarking clause: this clause is possible because of the nature of the contract that
has a longer duration than click-wrap contracts, for which the service can be stopped at any
time. That will be important if you need to compare the service that you pay for and the
same one offered by other companies at a significantly lower price. As a result of that
comparison, the organization may consider it appropriate to renegotiate the contract.
18 subjects to look for in a contract (①: issue; ❶: best practice)

Scope of services (cover the services being Innovation (evolution): ❺
delivered): ⑥, ❷, ❸, ❹, ❻, ❼, ❽
Performance (you would like to achieve): ①, Investment (how willing go we want to invest
❸ and actually improve it): ❺
Responsibilities (who is doing what?): ❹, ❻, Change (if someone want to change the contract
❼, ❽ or the service): ②, ❸
Contact points (within both parties): ❺ Confidentiality (who is allowed to access what
type of information): ⑥, ❶, ❸, ❽
Communication (what form, what media, how Announcements (how are we going to make
often): ❺, ⓫ announcements?): ⓫
Reporting (what form, what media, how often, Intellectual Property and Copyrights: ②, ③,
the contents of the reports): ④, ⓫ ❶, ❽
Review (how often do we review the contract, Liability (who is liable if something happens,
under what terms and condition): ❿ what amount are we liable): ①, ②, ❸, ❿
Dispute (how do we deal with disputes): ①, Termination (what about early termination
②, ④, ⑤, ⑦, ⑧, ❸ cases that could create heavy fees): ⑦, ⑧, ❸,
❾
Price and payment (for the various services Obligation: ❷, ❼
being delivered): ①, ❿, ⓬
Table 7 - The contract
We can conclude from the above that the choice of the provider will be also based on the contract
that defines the relationship between an organization and a provider. Isabelle Issert de Braux
considers that the price that a customer is paying will reflect the level of service the organization will
be getting. Thus, contracts under which the provider offers low cost services may present an
Cédric Mora
128 December 2009
Systems
unacceptable risk level. A risk analysis, which was described in the previous part of the thesis, is
needed and lawyers have to be integrated in the corresponding decision.
It is important to underline that, when click-wrap contract offers an increased level of flexibility, they
could be considered as being more risky, whereas custom-made contracts are precisely designed to
establish trust, openness and collective responsibility. The risks are shared, so are the rewards.
Cédric Mora
129 December 2009
Structure
III.3. Structure
The structure of an organization depends on its culture and objectives. Cloud Computing solutions
will have an impact on the way the IT department is working with other departments. A possible
consequence of this closer relationship is a real change in the organization, as suggests Henry Peyret,
analyst at Forrester. One may ask: what will happen to the existing decision-making processes and
the role of the CIO in it?
III.3.a. A important alignment for the IT department

The first objective of the IT department / CIO is to be aligned with the business strategy in order to
support the business. But strategic alignment also means that constraints and opportunities need to
be included in this business strategy. Thus, some reasons for a non-alignment are given in the
document published by CIGREF (CIGREF, 2002):
• “No IT strategy”;
• “No dialogue between the business, the General Directorate and the IT department”;
• “No consideration given to the potential of new services”; or
• “No proactivity in the IS function”.
To counteract these issues, Cloud Computing will present natural answers but some issues will be
resolved only by creating the right structure and processes between all the departments.
Thereby, the new economic data will show exactly what the organizations are paying for, and for
what is the level of services. It introduces the possibility to:
• Know what is the level of expenditure;

• What department is using the service (chargeback); and
• Know if expenses are made efficiently, and what is the return on these expenses.
This is therefore consistent with the trend in all organizations to develop a service approach with
clear SLAs. Furthermore, the IT department can now have all the tools needed to create a flexible
Information System.
Those natural answers are not sufficient for Cloud Computing adoption to be a success; they must be
supplemented by a genuine collaboration between the IT department and all the business units.
Investment in IT does not create results without proper thinking and actions on the strategy,
structure, processes and skills at all levels of the organization, which is what I try to develop in this
part. The following figure from the CIGREF document shows the alignment of these functions.
Cédric Mora
130 December 2009
Structure
Figure 50 - Alignment of the functions (CIGREF, 2002)
Obviously, looking at this figure, it is unavoidable to think about Venkatraman’s model, which
explains the relations between Business Strategy, IT strategy and the internal processes
(Venkatraman, et al., 1993). The findings I gathered from the interviews I have made, and researches
I conducted are as follows:
• Cloud raises interest from all managers in the departments as they are impacted through
their exposure to articles in the general press. Those managers become aware of the subject
without necessarily understanding all the ins and outs.
• Alignment models chosen by the organizations will be easier to achieve:
o Experimenting in the Cloud with new business models for “Investment centers” (IT
innovation);
o Support an intensive growth through flexibility for “Growth centers” (Business
innovation);
o Benefit from cloud economics by reducing maintenance for “Cost centers” (IT
implementation); and
o Develop customer value by delivering the right solutions and clear SLAs for “Profit
centers” (Business implementation).
IT can be seen as a “necessary evil” and outsourcing it to a provider does not mean that an
organization gets rid of it. I believe that it is quite the opposite because, at this stage, organizations
will not only focus on the technical dimension but also on the value IT will bring to an organization,
and on the services and solutions can help the organization. The structure must evolve accordingly.
Cédric Mora
131 December 2009
Structure
III.3.b. A new organization?

Organizations do not all have a unique model as they have specificities on:
• The relationship between the General Directorate, the IT department and the business units;
• CIO’s role (strategist, technician, organizer);
• CIO’s position within the organization (for example in the board of directors or under the
responsibility of the CFO); and
• The operational and functional organization.
A simple adoption of a few Cloud Computing services could be certainly transparent for the
organization of a company but, as the environment will be more complex, some experts see a
potential evolution for the company itself. In fact, it is not Cloud Computing only that could push
companies to adopt a new organization but a set of novelties (Web 2.0, social technologies or a
changing environment for example). The experts call this organization: the Network-centric
organization or Network organization.
Figure 51 - Evolution of the organization (BIT Group, 2008)
The new eco-system for an organization created by the increasing number of providers (but also
consultants, key Business partners, etc.) offers more flexibility: “the informality, interactivity and
adaptability of small teams of people retains a space for what we traditionally call ‘common sense’
for both understanding and action amid the accountability and constraints of the formal enterprise”
(Wikipedia, 2009).
I am somewhat suspicious whether such a new model will be easily implemented inside a company
because the management of such a model becomes very complex. Changing the organization of a
Cédric Mora
132 December 2009
Structure
company is a long process and Cloud Computing adoption will not necessarily push a company to go
along such a transformational change. But this is clearly a good evolution as the “Distributed It”
organization does not have a global management of all the Information System, making it difficult to
have a coherent IT strategy and governance for the Business Unit. Also, the “Centralized IT” solution
is not the best solution because the IT department will not be able to offer a specific service to a
Business Unit.
I will not explain in more details this new organizational model since it is now a well-known model; I
believe, however, that it is still interesting to have a look at its impact on the functions of the IT
department.
Figure 52 - Impact of the network organization on the IT department (BIT Group, 2008)
Infrastructure-as-a-Service can bring a real revolution because providers will “run” the infrastructure,
and we have seen that the right service with the right SLAs can be applied. Establishing the same
service levels for all resources is a bad idea. Platform-as-a-Service is more difficult to position on the
figure because we have seen that it will be certainly used for new projects (“Change”).
SMEs and large organization will not be impacted the same way, simply because the number of
employees in the IT department of a SME will certainly not allow the network organization showed
above. At the same time, large companies may have more difficulty to change their organization
model while SMEs can maybe be restructured more easily.
Cédric Mora
133 December 2009
Structure
“Cloud Computing is not a simple new technology but rather a real transition for companies.
The relational model is changing from a matrix model, where Business Units are not
independent, to a model called the network model. This is not a new model but some changes
will happen:
– Business Units can be entirely responsible with their customers;
– Business Units have their own accounting to get the flexibility they need to meet customer
needs;
- Business Units will need new differentiating services; and
- Contractualize internally with flexible contracts.
Why describing this for Cloud Computing? Well, a large number of organizations are
considering the opportunity of outsourcing through Cloud Computing, so as to learn how to
contractualize internally after. This is what is at stake for the next years: offering more
flexibility, a service which is specific for a Business Unit. These Business Units do not want to
hear about the smallest common denominator at the highest price.
This is a very profound change.”
III.3.c. Impacts on the decision making

The last interrogation concerns the decision-making process which is an important factor in the
management of the new services. We detailed in the first part some decision mechanisms to help a
CIO choose what could be outsourced in the Cloud, and referred to some key decisions that he needs
to make regarding the governance, the strategy and the circumstances.
But an element must be taken into account when specifying the decision-making process: the CIO
may not be the only decision maker. Providers do not only target the CIOs but also the CEOs, CFOs an
all the business units when they are offering Cloud Computing services. For the information, it is
known that SaaS services have been bought by Business Units, which did not inform the IT
department. Is this possible with PaaS and IaaS services? Although it seems quite impossible for it to
happen in SMEs, this could certainly be possible in large organizations where there could be IT
developers, or when a contract is passed with a consulting firm to develop a new tool.
This could be an apparent loss of power because IT resources are now easily accessible to everyone
and outsourcing means a perimeter that is reduced; however, the CIO and the IT department still
have important decisions to make:
• Establishing the IT strategy and the services that can be used;

• Establishing governance and security rules in the overall organization;
• Urbanize the global Information System; and
• Monitor and control the services.
Cédric Mora
134 December 2009
Structure
The most important thing is to be proactive because if CIOs do not experiment with these services
and publicize internally their results (is it possible to use these services? Under what conditions?),
they will certainly be bypassed and the door will be opened for all kinds of abuse.
“A company will have to adopt the model offered by Cloud Computing in the right way. If the IT
department does not prepare itself and does not accompany the internal customers for the
adoption of Cloud Computing and the identification of the right services, it will fail. The IT
department must become an orchestrator/broker of internal and external offers, and know
what the limits of the internal contracts are. It will also need to learn how to say: ‘no, I don’t
know how to offer the service requested by the Business Unit so I will use external services’. To
offer predictability, the IT department must determine the limits of internal and external offers
in terms of risk and billing model. This is what most organizations try to obtain with Cloud
Computing: transparency and predictability. It also means that the IT department must become
more flexible in terms of governance: to be able to tell very quickly if it is possible to offer
internally the requested service or if it needs to be obtained through a Cloud services provider.
Thus, it needs to be flexible in the systems but also in the decision-making, whether we choose
to buy an external service or not.”
Cédric Mora
135 December 2009
Shared values
III.4. Shared values

The “Shared values” element is fundamental for an organization as it defines the common goals of all
employees in the organization. We have seen in the previous elements a common factor which is the
relationship becoming closer between the IT department and the business.
This is the main consequence from the adoption of Cloud Computing services. Thus, a shared value
will be the collaboration between the departments. The organization is changing and for such a
change to be a success, it is important to have this value shared as a common one among all
employees. Employees acting only based on their own personal goals, which could be contrary to this
value, could severely affect the expected benefits.
We realize that it is becoming a value that every organization should adopt. Functioning in silos must
disappear because all types of issues can surface:
• Lack of consideration for business needs (collaboration between the business division and
IT);
• Dangerous use of Cloud services (collaboration between the legal department and IT);
• Limited innovation (understanding by the business of the new possibility offered by the IT
department);
• Bad monitoring of the services (collaboration between the internal teams of the IT
department); or
• Bad governance (creation of policies that should then be explained to the IT staff)
Of course, this value is added to the other existing values, provided they do not conflict among
themselves, such as to make money or achieve excellence in a particular field.
provider
“We will see some specific values between the early adopters of Cloud Computing:
- Innovation: the directors of the organization must be interested in new possibilities, change,
new horizons. For example, a director who is technophile will have in the culture of its company
the idea of trying new things even it can end with a failure.
- Flexibility and rapidity: dynamism in all the organization.
- Trust: to outsource carries evidence of confidence. It may simply not be in the culture of the
organization, which happen very often with French organizations. We see a lot of organization
that are consulting externally but that, at the end, prefer to work internally.
- International: SMEs may not have a culture that would favor the international dimension of
activities. For the moment, most of the providers are not French.”
Cédric Mora
136 December 2009
Style
III.5. Style
In order to ensure that “collaboration” is a shared value, managers inside the organization will have
an important role to play. They will need to inform their staff members that collaboration is not only
required to maximize the benefits of the organization but also to avoid severe risks. Failure to
respect the new processes that impose on employees to collaborate with other departments can
have not only financial impacts but also legal ones.
Actually, moving from the operational control of an information system to the contractual control of
a risk constitutes already a real change.
Managers will have two combine at the same time two qualities:
• Be rigorous: Cloud Computing introduces new risks and issues. The policies and governance
that have been implemented have to be strictly respected by staff members. It does not
mean that the management style of the manager should be a military style but rather that
the rules must be explained sufficiently. Employees should be keenly aware that It is not
possible to do everything, nor to do things without due consideration being given to the
manner in which they are being done.
• Let the staff have a certain freedom of action: Cloud Computing introduces new possibilities
and change the way some of the things were done in the past. This creates an environment
conducive to innovation. So, creation and imagination should not be constrained but rather
controlled appropriately.
These two characteristics may appear to be, to a certain extent, opposite ones but in order to
promote collaboration, both are important.
Of course, depending on the overall strategy of the organization, and the IT strategy in particular,
some managers may insist on some specific characteristics rather than on others.
I don’t really see here some specificities for French organization or SMEs in comparison with large
organization because it will be more about what the objectives are, and what is the culture it wants
to develop.
Cédric Mora
137 December 2009
Staff
III.6. Staff
Employees will, of course, be very impacted by the transformational change triggered by outsourcing
issues. If we have a closer look at the staff inside the IT department, below is what would result from
such a change according to ITIL services.
ITIL Service strategy

A role that will become more important is the one of Chief Sourcing Officer (CSO), whenever such a
role exists within an IT department since this function is not commonly available in SMEs for
example. The CSO is responsible for leading and directing the sourcing office and for the
development of the sourcing strategy. Together with the CIO, the CSO will need to coordinate the
Cloud Computing strategy depending on the type of relationship they have with the providers.
ITIL Service Design

Obviously, the key roles or functions for IT departments that use Cloud Computing services will be
the Supplier Manager, the Security Manager and the IT Service Continuity Manager. This reflects all
operational and strategic issues we have detailed previously. Other individuals will have a role that is
likely to be significantly transformed: the Capacity Manager or the IT Designers and Architects,
because of the outsourcing of some services and the automation of some manual tasks. One of the
goals of Service Design is to develop skills and capabilities within IT: this will constitute the
cornerstone for a beneficial use of Cloud Computing services.
ITIL Service Transition

The staff delivering Service Transition, generally composed of the same group of people already
providing other types of support, will help determine whether a certain type of Cloud service is best
suited for the enterprise, and if so, under which conditions.
ITIL Service Operation

Globally, the IT department is changing from controlling an infrastructure to controlling a process.
Consequently, Technical Management functions, Application Management functions and IT
Operations management functions will see their respective scopes changing. Some operational
aspects, and resources management, will be carried out by the provider and the monitoring and
control tasks will have more importance (status of services, Configuration Items, appropriate
corrective actions).
Jobs and functions of the IT department of large organizations are described every year in the CIGREF
nomenclature. Adoption of PaaS and IaaS services has a particular impact on the family called
“Method, quality and security support” which regroups all the “functions linked to definition, the
implementation, the control and audit of all quality, security and methods frameworks and norms
consistent with IT governance”. It is not surprising to see appearing in the version of 2009, a new
function called “Contract Manager” (CIGREF, 2009) whose main role is to “manage and monitor the
orderly implement of the contracts with providers”. This function has a clear resemblance with the
Chief Sourcing Officer in ITIL, and this confirms that it is an function which is essential, and that it is
imperative to fill up the corresponding position in the organization.
Cédric Mora
138 December 2009
Skills
We see the shift that generalizes the idea that the organization needs more resources to control if
the new services are working well. By outsourcing a number of tasks, some employees will not be
able to continue doing their actual job or will change the perimeter of their function. We may see
thus a certain law of conservation of jobs inside an organization but will the IT department need all
its employees? Sadly, there is no in-depth study on the evolution of the number jobs in the IT
department of French organizations, and categorized by functions. Forrester only published this year
a report showing “Where the Jobs are in IT” in the United States of America (Bartels, et al., 2009).
Despite the fact that computer programmer jobs continue to fall due to offshoring (-6.4% from 2008
to 2009), Forrester announces the number of computer operators will also decrease (-7% from 2008
to 2009) because of automation tools, virtualization and Cloud Computing. Simon Yates from
Forrester also added to the full report a commentary: "Managed hosting, SaaS, Cloud, traditional
outsourcing all threaten to move IT jobs outside the business. This is driving a change in the character
of IT departments. Service integration roles (including administrators, software engineers, and
network analysts) are becoming the core of IT, while programming and operations research are
increasingly provided by outside vendors.” I really think that this trend will be identical in France as
Cloud adoption is just beginning.
We see that French early adopters may see quickly a gap between the existing staff and the one they
may require if they start outsourcing their infrastructure.
III.7. Skills
We just saw in the “Staff” element that there will be a gap between the existing skills of the
employees and the skills they will need to “control a process”. Therefore, with the new functions to
which employees will be assigned, and also considering the availability of new tools, the IT
department will have to propose dedicated training sessions.
In order to promote new shared values, the employees will have to develop new skills, in particular
collaboration tools and awareness.
We can see that, if a large number of new projects and application migrations in the cloud are carried
out, the employees will clearly not have the capability to do the job as it requires specific skills. A way
develop these skills is to experiment and get some Return on Experience because, as of now, only
few people have these capabilities in the job market.
If we look at the global staff situation in the organization, we can suggest that a broader sensitivity
for IT in general shall be developed, including at the decision makers level.
Cédric Mora
139 December 2009
Skills
IV. Conclusion
Cédric Mora
140 December 2009
Conclusion
Skills
In a time of economic and financial crisis, the new economic model offered by Cloud Computing
draws the attention of all organizations, from SMEs to large organizations. Like a large majority of
outsourcing projects, Cloud Computing provide the means to reduce operational costs, thus enabling
the organizations to focus on their core business and on innovation.
The subject of Cloud Computing is broadly discussed in the context of Information Technology: the
general press and media are publishing numerous articles regularly on the subject and significant
investments in the field are decided by every major IT companies. All consulting firms and specialists
release new studies almost every day which predict a large adoption of Cloud Computing in the
coming years, more precisely after 2012 according to the Gartner.
But all the economical and operational benefits still weight little compared to the perceived risks.
Security is the largest type of risk for French decision makers, as emphasized by Forrester. This issue
and all the others will need to be resolved before French companies start massively using Cloud
Computing services.
This study aimed to focus on the French early adopters of these services, and more precisely on
Infrastructure-as-a-Service and Platform-as-a-Service, Software-as-a-Service being a more mature
service. The study has been divided in two parts, with a view to exploring more efficiently some of
the ins and outs of these 2 services that allow an organization to host specific applications in the
Cloud. The first part followed the 7Cs of Marketing to analyze everything that organizations must
take into account before entering the Cloud and what are the decision mechanisms associated:
eligibility, risk analysis, choice of the relationship and governance. The second part followed the 7Ss
of McKinsey to analyze the impacts of Cloud Computing on the IT department and its relations with
other departments. We also saw that SMEs and large organization may have different reasons
leading to adoption of this model.
This study has been illustrated by numerous interviews of CIOs, consultants, lawyers, teachers and
marketing managers. These interviews and all the conferences I have attended helped me
understand what the organizations wanted to know on this particular subject as it was very difficult
to find, at the same time, some real Return on Experience from French companies.
I believe that Cloud Computing is truly a revolution in the world of Information Technologies, and
that revolutionary trend is likely to continue to in the future, despite all the marketing hype. The
major investments being made are real ones and all indications show that, with this solution
maturing, French organizations will adopt these services, a situation similar to the one experienced
by Anglo-Saxon companies which are starting to use Cloud Computing in increasing numbers. But
these French companies have to understand very quickly what are the real issues of Cloud
Computing, issues that needs strategic decisions as they have an important impact on the human
resources and the management. The IT department will have to offer rapidly these types of service,
whether internally with a Private Cloud, that consulting firms see as a first step, and/or become cloud
brokers of the public clouds to give the best services to the Business Units.
The second part allowed us to identify where there could be some transformational changes in
French organizations. I can conclude that there is some urgency for these organizations to prepare
their Change Management plans, taking into account a number of remarks and concepts which I have
outlined in that second part. In Change Management, most of the issues are hidden as such a change
depends on the attitude and behavior of all the employees, i.e. the promoters, opponents and
Cédric Mora
141 December 2009
Conclusion
Skills
hidden opponents. This appears with all transformational changes (changes on the technology, the
processes and human), and particularly in France around outsourcing.
Organizations should start in a simple manner, by experimenting with Cloud Computing as a first
step, as proposed by Guillaume Plouin, and then go for more complex uses. We have seen that there
are two major scenarios with these services: migrate an existing application to the Cloud, or start
developing one in the Cloud. When migrating an application could be easier with IaaS, developing in
the cloud be easier with PaaS. We will then see that it can combine both needs from the CIO: pay less
for IT and innovate more quickly with IT.
I will conclude this thesis by quoting Nicholas Carr, an American writer who made famous the
electricity metaphor, in a report in which, among other things, he speaks about IT in 2018 (Carr,
2008):
“Just as the last century’s electric utilities spurred the development of thousands of new consumer
appliances and services, so the new computing utilities will shake up many market and open myriad
opportunities for innovation”.
Cédric Mora
142 December 2009
Skills
V. Bibliography
Cédric Mora
143 December 2009
Bibliography
Skills
Academic sources
Armbrust, Michael, et al. 2009. Above the Clouds: A Berkeley View of Cloud Computing. s.l. : UC Berkeley Reliable Adaptative Distributed
Systems Laboratory, 2009.
Bahloul, Karim. 2009. De la modernisation des infrastructures au développement de nouveaux modèles. Paris : IDC, 2009. Technologies,
Conception, Green, Ressources et Compétences vers une nouvelle génération d’infrastructures IT.
Bartels, Andrew H, Daley, Ellen and Ashour, Madiha. 2009. Where the jobs are: 2009 US IT Occupation Trends. s.l. : Forrester, 2009.
Bittman, Thomas. 2009. A Better Cloud Computing Analogy. A member of the Gartner Blog Network. [Online] Gartner, September 22,
2009. [Cited: October 22, 2009.] http://blogs.gartner.com/thomas_bittman/2009/09/22/a-better-cloud-computing-analogy/.
CapGemini. 2008. IT Strategy. s.l. : CapGemini, 2008. Course: HEC MSIT.
Carr, Nicholas. 2008. IT in 2018: From Turing's Machine to the Computing Cloud. s.l. : an Internet.com IT Management eBook -
Jupitermedia Corp., 2008.
CIGREF. 2002. Alignement stratégique du système d'information. s.l. : CIGREF, 2002.
—. 2009. Nomenclature 2009 - Les emplois-métiers du SI dans les grandes entreprises. s.l. : CIGREF, 2009.
Finishing off IT. Marquis, H. A. 2006. 4, s.l. : MIT Sloan Management Review, July 1, 2006, Vol. 47, pp. 12-15. 1532-9194.
Forrest, Will and Barthold, Charlie. 2009. Clearing the air on Cloud Computing. s.l. : McKinsey, 2009.
Gartner. 2009. Gartner says IT Organisations will invest more in Private Cloud Services than in External Cloud Providers through 2012.
Gartner Newroom. [Online] October 5, 2009. [Cited: December 7, 2009.] www.gartner.com/it/page.jsp?id=1193913.
—. 2003. The Reality of IS Lite. Gartner. [Online] September 2003. [Cited: December 13, 2009.]
http://www.gartner.com/resources/118500/118504/executive_summary_the_realit_118504.pdf.
Gillett, Frank E, Lee, Christina and Daley, Ellen. 2009. The State Of Emerging Enterprise Hardware: 2009 To 2010. s.l. : Forrester, 2009.
Gillett, Frank E. 2008. Future View: The New Tech Ecosystems Of Cloud, Cloud Services, And Cloud Computing. s.l. : Forrester, 2008. p. 17.
Gillett, Frank E., et al. 2009. IT Buyers Prioritize Virtualization Over Cloud. s.l. : Forrester, 2009. p. 5.
Hugon, Jean-Christophe and Loupy, Fabien. 2009. Les sociétés françaises et l’externalisation offshore - De la stratégie d’externalisation à la
mise en oeuvre opérationnelle - Le cas des développements informatiques. s.l. : HEC Paris - Mines de Paris, 2009. p. 113, Thesis. Mastère
Spécialisé Management des Systèmes d'Information et des Technologies.
IDC. 2008. IDC Finds Cloud Computing Entering Period of Accelerating Adoption and Poised to Capture IT Spending Growth Over the Next
Five Years. IDC - Press Release. [Online] October 20, 2008. [Cited: October 15, 2009.]
http://www.idc.com/getdoc.jsp?containerId=prUS21480708.
ITSMF - The IT Service Management Forum. 2007. An Introductory Overview of ITIL V3. s.l. : Best Management Practice Partnership, 2007.
Jacod, Claudine. 2008. Les grandes entreprises externalisent une gamme de services plus diverse que les PME. Le 4 pages des statistiques
industrielles. Ministère de l'Économie, des Finances et de l'Emploi, 2008, 242. Download the report at
http://www.industrie.gouv.fr/sessi/4pages/242/index.html.
Kaplan, Robert S and Norton, Dave P. 1996. Balanced Scorecard: Translating Strategy into Action. s.l. : Harvard Business School Press,
1996.
Kaplan, Robert S. and Norton, David. P. 2001. The Strategy-focused Organization: How Balanced Scorecard Companies thrive in the new
business environment. s.l. : Harvard Business School Press, 2001. ISBN 978-1591391340.
Krawczyk, Stéphane. 2009. Le Baromètre Entreprises France - Indicateurs - Suivre les Intentions d’Achats. IDC. [Online] 2009. [Cited:
October 16, 2009.] http://www.idc.com/france/downloads/research/toc/baro_entre_1_pres.pdf.
Markess International. 2009. Référentiel de Pratiques - Atouts & Bénéfices du modèle SaaS. s.l. : Markess International, 2009.
—. 2009. Référentiel de Pratiques Hébergement, Virtualisation, Cloud Computing - Edition 2009. s.l. : Markess International, 2009.
Cédric Mora
144 December 2009
Bibliography
Skills
Mell, Peter and Grance, Tim. 2009. Effectively and Securely Using the Cloud Computing Paradigm. [Powerpoint] s.l. : National Institute of
Standards and Technology, 2009.
—. 2009. The NIST Definition of Cloud Computing. s.l. : National Institute of Standards and Technology, Information Technology Laboratory,
2009. Version 15.
Nassah, Franck. 2006. L’INFORMATIQUE DANS LES PME FRANCAISES. s.l. : IDC, 2006.
Pacale, Richard, et al. 1981. The Art of japanese management. s.l. : Simon & Schuster, 1981. 978-0671225391.
Perry, Randy, et al. 2009. Force.com Cloud Platform Drives Huge Time to Market and Cost Savings. s.l. : IDC, 2009. p. 19, White Paper.
Sponsored by: Salesforce.com.
Plummer, Daryl C., Cearley, David W. and Smith, David Mitchell. 2008. Cloud Computing confusion leads to opportunity. s.l. : Gartner,
2008.
Plummer, Daryl C., et al. 2008. Cloud Computing : Defining and Describing an Emerging Phenomenon. s.l. : Gartner, 2008.
Plummer, Daryl C., et al. 2009. Five refining attributes of Public and Private Cloud Computing. s.l. : Gartner, 2009.
Porter, Michael. 1980. Competitive Strategy: Techniques for Analysing Industries and Competitors. New York : Free Press, 1980.
Pring, Ben, et al. 2009 . Forecast: Sizing the Cloud; Understanding the Opportunities in Cloud Services. s.l. : Gartner, 2009 .
Ried, Stefan, Matzke, Pascal and Lisserman, Miroslaw. 2009. Clouds Appearing In The Sky Of Outsourcing. s.l. : Forrester, 2009. p. 12.
Ried, Stefan, Mendel, Thomas and Lisserman, Miroslaw. 2009. yet Another Cloud. s.l. : Forrester, 2009. p. 7. Forrester’s First Proposal Of A
Cloud Taxonomy.
Rogers, Everett M. 1962. Diffusion of Innovations. s.l. : Free Press, 1962.
Schadler, Ted. 2008. Talking To Your CFO About Cloud Computing. s.l. : Forrester, 2008.
Shimizu, Koichi. 2009. Advertising Theory and Strategies 16th edition. s.l. : Souseisha Book Company, 2009. Professor from Josai University
Graduate School of Business Administration.
—. 2003. Symbiotic Marketing Strategy 4th edition. s.l. : Souseisha Book Company, 2003. Professor from Josai University Graduate School
of Business Administration.
Staten, James. 2009. Best Practices: Infrastructure-As-A-Service. s.l. : Forrester, 2009.
—. 2009. Which Cloud Computing Platform is right for you? s.l. : Forrester, 2009.
Staten, James, Yates, Simon and Echols, Ben. 2009. TechRadar™ For Infrastructure & Operations Professionals: Cloud Computing, Q3 2009.
s.l. : Forrester, 2009.
Venkatraman and Henderson. 1993. Strategic Alignement: Leveraging Information Technology for Transforming organizations. IBM
Systems Journal. IBM Systems Journal, 1993, Vol. 32, 1.
Wang, Chenxi, Penn, Jonathan and Herald, Allison. 2009. How secure is your cloud? s.l. : Forrester, 2009.
Yuhanna, Noel. 2007. Database Archiving Remains An Important Part Of Enterprise DBMS Strategy. s.l. : Forrester, 2007. p. 20.
Cédric Mora
145 December 2009
Bibliography
Skills
Journalistic and official sources

Babcock, Charles. 2009. Why 'Private Cloud' COmputing is Real - and worth considering. Information Week. April 13, 2009.
Carr, Nicholas G. 2008. The Big Switch. s.l. : WW Norton & Co, 2008. 0393062287.
—. 2005. The End of Corporate Computing. MIT Sloan Management Review. 2005, Vol. 46, 3.
—. 2008. The new economics of computing. Rough Type. [Online] November 05, 2008. [Cited: October 24, 2009.]
http://www.roughtype.com/archives/2008/11/the_new_economi.php.
Cloud Security Alliance. 2009. Security Guidance for Critical Areas of Focus in Cloud Computing. s.l. : Cloud Security Alliance, 2009.
ENISA. 2009. Cloud Computing - Benefits, risks and recommendations for information security. s.l. : ENISA, 2009. p. 123. Download this
document at: http://www.enisa.europa.eu/act/rm/files/deliverables/cloud-computing-risk-assessment.
Financial Times. 2009. 6 Mars 2009, s.l. : Financial Times, 2009.
Fleck, Chris. 2008. Cloud Economics 101 - Part 1. Citrix Community - the Citrix Blog. [Online] September 27, 2008. [Cited: October 3, 2009.]
He is Vice President of Community and Solutions Development at Citrix Systems and speaker of various Cloud Computing conferences..
http://community.citrix.com/display/ocb/2008/09/27/Cloud+Economics+101+-+Part+1.
Frascaria, Kareen. 2009. Le PRA as a service, tendance forte de la rentrée. ZDNET. [Online] ZDNET, July 21, 2009. [Cited: November 5,
2009.] http://www.zdnet.fr/blogs/cloud-news/le-pra-as-a-service-tendance-forte-de-la-rentree-39702547.htm.
From Shafts to Wires: Historical Perspective on Electrification. Devine Jr, Warren D. 1983. 2, s.l. : The Journal of Economic History, 1983,
Vol. 43. S0022050700029673.
Golden, Bernard. 2009. The Case Against Cloud Computing, Part One. CIO. [Online] January 22, 2009. [Cited: November 15, 2009.]
http://www.cio.com/article/477473/The_Case_Against_Cloud_Computing_Part_One. CEO of Navica Inc., a systems integration firm
specializing in open source software.
—. 2009. The Case Against Cloud Computing, Part Three. ITWorld. [Online] CIO.com, February 9, 2009. [Cited: November 25, 2009.]
http://www.itworld.com/saas/62255/case-against-cloud-computing-part-three?page=0%2C0.
Hoff, Christopher. 2009. Domain 1 - Cloud Computing Architectural Framework. Security Guidance for Critical Areas of Focus in Cloud
Computing. s.l. : Cloud Security Alliance, 2009.
Hogben, Giles. 2009. Privacy, Security and Identity in the Cloud. s.l. : ENISA, 2009.
Krigsman, Michael. 2008. MediaMax / The Linkup: When the cloud fails. ZDNet blogs. [Online] ZDNet, August 27, 2008. [Cited: November
24, 2009.] http://blogs.zdnet.com/projectfailures/?p=999.
Lemos, Robert. 2009. Inside one firm's private cloud journey. Network World. [Online] Network World, October 28, 2009. [Cited:
November 2, 2009.] www.networkworld.com/news/2009/102809-inside-one-firms-private-cloud.html?hpg1=bn.
Linthicum, David. 2009. 4 things that are driving cloud computing. [Online] October 7, 2009. [Cited: October 12, 2009.] Author of the book
"Cloud Computing and SOA Convergence in Your Enterprise: A Step-by-Step Guide". http://www.infoworld.com/d/cloud-computing/4-
things-are-driving-cloud-computing-598?page=0,1.
—. 2009. The Value of Application Service Governance for Cloud Computing. s.l. : Layer 7 Technologies, 2009. p. 10. Founder of a consulting
organization dedicated to excellence in SOA implementation, corporate SOA strategy, and leveraging cloud computing. He was an associate
professor of computer science, and continues to lecture at major colleges and universities..
Loi n° 78-17. 1978. Loi Informatique et libertés - Loi n° 78-17 du 6 janvier 1978. January 6, 1978. Loi relative à l'informatique, aux fichiers et
aux libertés.
McAfee, Andrew. 2009. The Cloudy Future of Corporate IT. The Business Impact of IT. [Online] August 21, 2009. [Cited: October 22, 2009.]
McAfee is currently a principal research scientist at the Center for Digital Business in the MIT Sloan School of Management, and a fellow at
the Harvard’s Berkman Center for Internet and Society.. http://andrewmcafee.org/2009/08/the-cloudy-future-of-corporate-it/.
Oestreich, Ken. 2008. ITIL, ITSM, and the Cloud. Fountainhead. [Online] Insights into the enterprise data center & green technology space,
November 10, 2008. [Cited: November 29, 2009.] Vice president of product marketing at Egenera. Speaker in various conferences on Cloud
Computing (SYS-CON Cloud Computing Conference & Expo 2009, etc.). http://fountnhead.blogspot.com/2008/11/itil-itsm-and-cloud.html.
Cédric Mora
146 December 2009
Bibliography
Skills
Open Cloud Manifesto. 2009. Cloud Computing Use Cases White Paper. s.l. : Cloud Computing Use Case Discussion Group, 2009. p. 37. Can
be found on: http://opencloudmanifesto.org/resources.htm. Version 1.0.
—. 2009. Open Cloud Manifesto. Open Cloud Manifesto. [Online] Spring 2009. [Cited: November 15, 2009.]
http://www.opencloudmanifesto.org/Open%20Cloud%20Manifesto.pdf.
Petri, Gregor. 2009. Cloud Computing and the New Role of the IT manager, Will ITIL and COBIT Help or Hinder? Conclusion. CA Community.
[Online] CA, October 23, 2009. [Cited: November 28, 2009.] http://community.ca.com/blogs/itil/archive/2009/10/23/cloud-computing-
and-the-new-role-of-the-it-manager-will-itil-and-cobit-help-or-hinder-conclusion.aspx.
—. 2009. Part 2: Cloud Computing and the New Role of the IT manager: Will ITIL and COBIT help or hinder? IaaS. CA Community. [Online]
CA, October 20, 2009. [Cited: November 28, 2009.] http://community.ca.com/blogs/itil/archive/2009/10/20/part-2-cloud-computing-and-
the-new-role-of-the-it-manager-will-itil-and-cobit-help-or-hinder.aspx.
SLA@SOI. 2008. Press Release #1: European research project SLA@SOI, led by SAP, has commenced. SLA@SOI. [Online] 2008. [Cited:
November 15, 2009.] http://sla-at-soi.eu/wp-content/uploads/2009/01/press_release1.pdf.
Cédric Mora
147 December 2009
Bibliography
Skills
Providers and Consulting firms documentation

Amazon Web Services. 2009. 37Signals Case Study : Amazon Web Services. Amazon Web Services. [Online] Amazon Web Services, 2009.
[Cited: October 24, 2009.] http://aws.amazon.com/solutions/case-studies/37signals/.
—. 2009. Amazon EC2 SLA. Amazon. [Online] October 23, 2009. [Cited: October 24, 2009.] http://aws.amazon.com/ec2-sla/.
—. 2009. Amazon Web Services Customer Agreement. Amazon Web Services. [Online] October 30, 2009. [Cited: November 12, 2009.]
http://aws.amazon.com/agreement/.
—. 2009. Amazon Web Services: Overview of Security Processes. Amazon Web Services. [Online] September 2009. [Cited: November 11,
2009.] http://s3.amazonaws.com/aws_blog/AWS_Security_Whitepaper_2008_09.pdf.
—. 2009. The Server Labs Case Study: Amazon Web Services. Amazon Web Services. [Online] June 2009, 2009. [Cited: October 26, 2009.]
http://aws.amazon.com/solutions/case-studies/the-server-labs/.
Atos Origin. 2008. Du mainframe au cloud. Enterprise 2.0. [Online] Ocotober 9, 2008. [Cited: October 12, 2009.]
http://entreprise2.wordpress.com/2008/10/09/du-mainframe-au-cloud/.
Behnia, Kia and Wrobel, Erik. 2008. Seven Requirements for Balancing Control. s.l. : BMC Software, 2008. p. 11. Kia Behnia, Chief Corporate
Architect, CTO Office, BMC Software; Erik Wrobel, Director of Product Management, VMware. Download at
http://documents.bmc.com/products/documents/62/88/96288/96288.pdf.
BIT Group. 2008. Business & Information Technology Group. Dîner – Conférence DSI 2010. Les tendances pour les DSI 2008 - 2012. s.l. : BIT
Group, 2008.
CA. 2009. Make Your IT Organization More Effective. s.l. : Computer Associates (CA), 2009. Written by William F. Clark (PUBLIC SECTOR
CTO) and Ray Wright (INDUSTRY SOLUTIONS).
Capgemini. 2008. Capgemini et Amazon Web Services signent un accord pour offrir des solutions de cloud computing aux grandes
entreprises. Capgemini. [Online] November 18, 2008. [Cited: November 2009, 2009.]
http://www.fr.capgemini.com/m/fr/n/pdf_Capgemini_et_Amazon_Web_Services_signent_un_accord_pour_offrir_des_solutions_de_clou
d_computing__aux_grandes_entreprises.pdf.
Cavalliere, Lionel. 2009. Construire une infrastructure IT optimisée pour le Cloud Computing avec la virtualisation. IDC - Infrastructure IT et
Cloud Computing. Paris : VMWare, September 24, 2009. p. 19.
Gruau, François. 2009. Comment faire évoluer votre infrastructure IT dans le contexte économique actuel ? Paris : ATOS ORIGIN, 2009. Vice
President Innovation & Business Development. Presented at "Cloud Computing and Infrastructure - IDC Conference".
Hartman, Tyson and Beck, Larry. 2009. Defining the Business Value of Cloud Computing. s.l. : Avanade, 2009.
Hurley, William. 2009. A Down-to-Earth look at Cloud Computing. [interv.] Tom Parish. BMC Podcasts. s.l. : BMC, April 29, 2009. Chief
Architect, Open Source Strategy at BMC Software.
IDATE. 2008. Comportement d'achat des PME. IDATE Consulting and research. [Online] IDATE, July 15, 2008. [Cited: December 21, 2009.]
http://www.idate.fr/fr/Research-store/Comportement-d-achat-des-PME_316.html.
Mauger, Regis. 2009. Cloud Computing. Paris : BMC Software, 2009.
Morrison, Scott. 2009. Steer Safely into the Clouds - Why you must have Cloud Governance before you move your apps. s.l. : Layer 7
Technologies, 2009. p. 12. Vice President Engineering and Chief Architect.
Open Crowd. 2009. Cloud Taxonomy, Landscape, Evolution. www.opencrowd.com. [Online] May 4, 2009. [Cited: July 29, 2009.]
www.opencrowd.com/assets/images/views/views_cloud-tax-lrg.png.
Portio Research. 2009. COLT CIO survey. s.l. : COLT, 2009. Internal survey.
Rollet, Béatrice. 2009. Cloud Computing for dummies. Malakoff : COLT, 2009. Conference.
Sorofman, Jake. 2008. The Cloud Computing Adoption Model: Eating the Elephant One Bite at a Time. rPath. [Online] rPath, October 23,
2008. [Cited: November 30, 2009.] Vice President of Marketing. http://blogs.rpath.com/wpmu/closing-the-gap/2008/10/23/the-cloud-
computing-adoption-model-eating-the-elephant-one-bite-at-a-time/.
Cédric Mora
148 December 2009
Bibliography
Skills
VMWare. 2009. Open Virtualization Format. VMWare. [Online] 2009. [Cited: November 15, 2009.]
http://www.vmware.com/appliances/getting-started/learn/ovf.html.
Winter, Richard. 2008. Why Are Data Warehouses Growing So Fast? B eye Network. [Online] April 10, 2008. [Cited: October 24, 2009.] An
Update on the Drivers of Data Warehouse Growth. http://www.b-eye-network.com/view/7188.
Zhu, Jinzy. 2009. Cloud Computing Technology and Practice. IBM. [Online] August 20, 2009. [Cited: December 6, 2009.] http://www-
07.ibm.com/events/nz/ibmforum/presentations/downloads/IBMCloudLabsKeynote_JinzyZhu.pdf.
Online encyclopedia
Gartner. 2009. Gartner Glossary. Gartner. [Online] 2009. [Cited: December 13, 2009.]
http://www.gartner.com/6_help/glossary/GlossaryI.jsp.
Wikipedia. 2009. Information Technology Infrastructure Library. Wikipedia. [Online] Wikipedia, November 27, 2009. [Cited: November 28,
2009.] http://en.wikipedia.org/wiki/Information_Technology_Infrastructure_Library.
—. 2009. Mainframe computer. Wikipedia. [Online] September 14, 2009. [Cited: October 12, 2009.]
http://en.wikipedia.org/wiki/Mainframe_computer.
—. 2009. Network-centric organization. Wikipedia. [Online] Wikipedia, May 28, 2009. [Cited: December 20, 2009.]
http://en.wikipedia.org/wiki/Network-centric_organization.
—. 2009. Records Management. Wikipedia. [Online] Wikipedia, November 9, 2009. [Cited: November 11, 2009.]
http://en.wikipedia.org/wiki/Records_management.
—. 2009. Strategy map. Wikipedia. [Online] Wikipedia, December 6, 2009. [Cited: December 6, 2009.]
http://en.wikipedia.org/wiki/Strategy_map.
Cédric Mora
149 December 2009
Skills
VI. Annexes
Cédric Mora
150 December 2009
Annexes
A growing interest for Cloud Computing – Google Trends
I. A growing interest for Cloud Computing – Google Trends

Google Trends is a Google tool that allows to measure the popular interest for a subject on Internet.
Below, 3 expressions are compared: SOA (Service Oriented Architecture), offshoring and Cloud
Computing.
Search Volume Index : how many searches have been done for the terms entered, relative to the
total number of searches done on Google over time.
News Reference Volume : number of times the topic appeared in Google News stories (only English-
language headlines are displayed).
Figure 53 - Google Trends (http://www.google.fr/trends?q=cloud+computing%2C+soa%2C+offshoring –2009

December 20)
We can see that this subject is growing in interest for the last year and a half, and it could become
the subject of IT attracting the highest degree of interest in a few years from now.
Cédric Mora
151 December 2009
Annexes
Layers of Cloud Computing services
II. Layers of Cloud Computing services

To understand better the technologies behind the terms SaaS, PaaS et IaaS, we present below the
different layers shown by the Cloud Security Alliance (Hoff, 2009).
Infrastructure services contain the Data Center itself and the physical machines in it. Infrastructure-
as-a-Service also adds hardware-abstraction layer and, if needed, core connectivity and delivery to
these resources. The API layer allows the consumer to manage this infrastructure.
Platform-as-a-Service is on top of IaaS and

adds an integration layer that allows the
consumer to use providers’ development
frameworks in order to develop specific
applications.
Software-as-a-Service is built on top of

PaaS and offer the consumer a complete
environment: content, application and
presentation.
We can understand that SaaS providers

could be clients of PaaS and IaaS
providers, and conversely PaaS providers
could be clients of IaaS providers.
Ex: A company that sells SaaS to

consumers may develop its application on
top of a PaaS solution, for example
Salesforce.com. Salesforce.com could be
built on top of Amazon Web Service
offering, who is a IaaS provider.
Figure 54 - "Cloud Reference Model" - Cloud Security Alliance (Hoff, 2009)
Cédric Mora
152 December 2009
Annexes
Taxonomy of Cloud Computing
III. Taxonomy of Cloud Computing

Here is the classification (Open Crowd, 2009), from the consulting firm OpenCrowd, that presents all
type of existing offers of Cloud Computing services and some providers’ solutions.
Figure 55 - Cloud offerings
Cédric Mora
153 December 2009
Annexes
Nicholas G. Carr’s electricity metaphor
IV. Nicholas G. Carr’s electricity metaphor

Nicholas G. Carr published in 2005, in the MIT Sloan Management Review, an article entitled The End
of Corporate Computing (Carr, 2005) which was developing the idea that the fragmented model of IT,
where all organizations have their own IT infrastructure, will disappear.
He compared this transformation to what happened years ago with electricity. Organizations that
used to rely on their own private factory for satisfying their needs for electricity now get their
electricity from providers whose role is to distribute electricity. Thus the organizations no longer
need a dedicated factory for this task but rather they simply have to pay for the electricity they
consume. This is no more a function done by organizations but a service they use. Similarly,
Information technologies like software or hardware will not be seen as assets but will be bought as a
utility service, a commodity, that they get from an IT provider. Here is what Nicholas Carr said:
“Manufacturers began to shut down and dismantle their waterwheels, steam engines and electric
generators. They no longer had to run their own dynamos; they could simply buy the electricity they
needed, as they required it, from new utility suppliers. Power generation was being transformed from
a corporate function into a utility. Now, almost exactly a century later, history is repeating itself.
Information technology is undergoing the same transformation.”
But this process took nearly 50 years to complete and the real impact of the technology was not
visible at first because electric motors were initially used as simple replacements for steam power,
and factory layouts remained unchanged (McAfee, 2009). Electrification of industry in the United
States began around 1883 and, as late as in 1930, nearly 20% of factory power was still supplied by
steam engines and that situation persisted in some old factories until the 1960s. Andrew McAfee, a
professor at MIT, recalls that there were detractors and skeptics about the new technology
throughout the transition period, and he quotes a statement from Warren D. Devine Jr’s paper in the
Journal of Economic History (From Shafts to Wires: Historical Perspective on Electrification, 1983):
“… the merits of driving machines in groups or driving them individually were discussed in the
technical literature throughout the first quarter of the twentieth century. Between 1895 and 1904,
this subject was vigorously debated in meetings of technical societies; neither technique could be said
to be best in all cases… And, over 20 years later, group drive was still being strongly recommended for
many applications… Two textbooks printed in 1928… make it clear that there were many situations in
which group drive was justified.”
This metaphor is not accepted by everyone, suggesting that IT is much more complicated than
electricity.
The idea of entering into a transformation where no organization will have in-house IT
infrastructures has raised numerous reactions. H. A Marquis published, one year later, a response to
N. Carr’s article, where he invalidates the possibility of a total transformation (Finishing off IT, 2006).
Marquis emphasizes the vital importance that may have a resource in an organization and the risk its
absence would entail. He argues that organizations are already insourcing functions in their IT
department. These are not isolated actions and some laws may complicate further the idea of a total
Cédric Mora
154 December 2009
Annexes
Nicholas G. Carr’s electricity metaphor
transformation (Gromm-Leach Bliley and Sarbanes-Oxley in USA). More importantly, he says that
some tasks that make the strength of a company should not be outsourced: only simple tasks that do
not add value should be.
We can also cite Thomas Bittman from Gartner who says that the electricity utility metaphor doesn’t
work (Bittman, 2009) and shows two reasons:
• “Computing is a rapidly evolving technology”,
• “Service requirements vary widely for computing”.
IT evolves everyday very quickly whereas electricity production and distribution hasn’t evolved much
since the invention of air conditioning that made distance distribution possible.
This electricity metaphor, which may not be the best one, simply shows that there is always an
evolution possible in the manner in which services or products are delivered, an evolution that takes
some time to come but that, eventually, is nearly total like for the distribution of electricity, water or
even music.
Cédric Mora
155 December 2009
Annexes
ITIL - Information Technology Infrastructure Library
V. ITIL - Information Technology Infrastructure Library
ITIL provides a framework of Best Practice guidance for IT Service Management (Wikipedia, 2009).
ITIL gives detailed descriptions of a number of important IT practices and provides comprehensive
checklists, tasks and procedures that any IT organization can tailor to its needs. ITIL is published in a
series of books, each of which covers an IT management topic. The names ITIL and IT Infrastructure
Library are registered trademarks of the United Kingdom's Office of Government Commerce (OGC).
Figure 56 - ITIL, a high level view of the service model (ITSMF - The IT Service Management Forum,
2007)
For more information, visit the ITIL website at www.itil.org.
Cédric Mora
156 December 2009
Annexes
Some Cloud Computing Providers and Consulting Firms
VI. Some Cloud Computing Providers and Consulting Firms

Here is a list of Cloud Computing actors that may interest French early adopters.
Infrastructure-as-a-Service providers
Provider Type of relations Services Location of the Data
Centers
AMAZON “No-relation” Online Servers: Elastic Compute Cloud, All over the world and in
WEB model Virtual Private Cloud. Europe (not in France).
SERVICES Database: Simple Storage Service, Possibility to choose the
SimpleDB, Relational Database Service location.
Other: Cloud Front, Simple Queue
Service
CLARANET “Custom contract” Private Cloud off-premises. France. Possibility to
In the future: “No- In the future: online servers with choose the location.
relation” model ClaraCloud.
COLT “Custom contract” Private Cloud off-premises. Europe and France.
TELECOM In the future: “No- Virtual server on-demand (no online Possibility to choose the
relation” model self-provisioning): COLT Dynamic location.
Infrastructure Services.
In the future: online servers.
GANDI.NET “No-relation” Online servers. France.
model In the future: online servers.
In the future: “No-
relation” model
GOGRID “Custom contract” Online servers. United States of America.
“No-relation” Cloud storage. Soon in Europe.
model Private Cloud off-premises.
IBM “Custom contract” Private Cloud off-premises. All over the world and in
In the future: “No- France.
relation model”
LINKBYNET “Custom contract” Private Cloud off-premises. France.
Virtual server on-demand (no online
self-provisioning): @GILE.
ORANGE “Custom contract” Private Cloud off-premises. France.
BUSINESS Virtual server on-demand (no online
SERVICES self-provisioning): ORANGE Flexible
Computing.
RACKSPACE “Custom contract” Private Cloud off-premises. USA and Europe.
“No-relation” Online servers: Rackspace Cloud. Not in France.
model
Cédric Mora
157 December 2009
Annexes
Platform-as-a-Service providers
Provider Type of Services Location of the Data
relations Centers
COLT ? In the future: Develop, test and deploy Europe and France.
TELECOM applications in the Cloud.
GOOGLE “No-relation” Develop, test and deploy applications All over the world (not in
model in the Cloud: Google App Engine. France). Impossible to
choose the location.
IBM “No-relation” Develop and test in the Cloud: IBM All over the world and
model Smart Business Development & Test France. Impossible to
MICROSOFT “No-relation” Develop, test and deploy applications All over the world and
model in the Cloud: MICROSOFT Azure. France. Impossible to
SALESFORCE “No-relation” Develop, test and deploy applications All over the world (not in
model in the Cloud: FORCE.COM. Europe). Impossible to
Private Cloud Constructors and software firms

Constructor Services
CITRIX Virtualization Software: XEN.
Private cloud: Cloud Burst (that integrated VMWARE).

IBM
Virtualization Software: HYPER-V.
MICROSOFT
Software: Ubuntu Enterprise Cloud.
UBUNTU Integration possible with Public Clouds.
VMWARE Virtualization Software: VSphere 4.
Integration possible with Public Clouds.
Cédric Mora
158 December 2009
Annexes
Consulting Services
Constructor Services
AVS Expertise center for Cloud Computing solutions: Salesforce’s Force.com.

CONSULTING
CAP GEMINI Expertise center for Cloud Computing solutions: Amazon Web Services.
COLT Cloud Audit.

TELECOM
IBM Cloud Computing consulting: audit, resilient cloud validation, etc.
OCTO Expertise center for Cloud Computing solutions: Amazon Web Service, Google App
TECHNOLOGY Engine, Salesforce’s Force.com
REVEVOL Expertise center for Cloud Computing solutions
Cédric Mora
159 December 2009
Annexes
Cloud Software
VII. Cloud Software

Some examples of the existing tools available for an organization are:
• Manage resources when they are in the “No-relationship model”;
Figure 57 - Orchestration tool from BMC Software
• Provide a unique interface to manipulate on-premises and off-premises resources from

multiple providers;
Figure 58 - A VMWare interface to manage on-premises and off-premises resources (on Terremark,
Hosting.com servers, etc.) with VCloud
• Integrate ITIL best practices in a software created for all Cloud (and virtualized
environments);
Cédric Mora
160 December 2009
Annexes
Cloud Software
Figure 59 - Enable automation with CA software, based on ITIL principles (CA, 2009)
• Data governance (organize data between those that should be hosted in-house and those
that can be in the cloud); or
Figure 60 - Data governance with Guardiam, a data governance software company recently
acquired by IBM
• Apply policy enforcement for all Cloud Services.
Cédric Mora
161 December 2009
Annexes
Cloud Software
Figure 61 - Policy Enforcement on Cloud Computing services from 7 Layer Technologies (Morrison,
2009)
These are only example of the possibilities offered by some Software Companies that are creating
everyday new features for their software to be compliant with Cloud Computing services and to
answer to some issues that I have underlined.
Cédric Mora
162 December 2009
Annexes
Cloud Software
Figures
Figure 1 - Actors of the Cloud Computing market ................................................................................................ 11
Figure 2 - Cloud Computing layers (SaaS / PaaS / IaaS) ........................................................................................ 13
Figure 3 - Public Cloud (Open Cloud Manifesto, 2009) ......................................................................................... 14
Figure 4 - Private Cloud (Open Cloud Manifesto, 2009) ....................................................................................... 15
Figure 5 - Hybrid Cloud (Open Cloud Manifesto, 2009) ........................................................................................ 15
Figure 6 - Community Cloud (Open Cloud Manifesto, 2009) ................................................................................ 16
Figure 7 - Forrester's TechRadar for Cloud Computing (Staten, et al., 2009) ....................................................... 17
Figure 8 - Motivations for IT investment (Nassah, 2006) ...................................................................................... 20
Figure 9 - 7Cs compass model ............................................................................................................................... 22
Figure 10 - 7S of McKinsey (Pacale, et al., 1981) .................................................................................................. 23
Figure 11 - IT investment in the years (Gillett, 2008) ............................................................................................ 27
Figure 12 - Customers pay for a service (Rollet, 2009) ......................................................................................... 31
Figure 13 - The infrastructure follows the actual demand.................................................................................... 32
Figure 14 - Economies of scale and skill drive cloud computing (Schadler, 2008) ................................................ 34
Figure 15 - Costs: New Project vs Existing Application; PaaS vs IaaS vs Internal IT .............................................. 39
Figure 16 - 3 major benefits for the organization on an operational level ........................................................... 40
Figure 17 - Linking a Private Cloud to a Public Cloud could be easy with the right technology (Cavalliere, 2009)49
Figure 18 - A better understanding of the services ............................................................................................... 50
Figure 19 - Navigation in the Cloud (Ried, et al., 2009) ........................................................................................ 51
Figure 20 - Classification of the issues regarding Security and Privacy ................................................................. 55
Figure 21 - Classification of the issues regarding Compliance .............................................................................. 57
Figure 22 - Classification of Legal and Contractual issues .................................................................................... 60
Figure 23 - CapEx to OpEx cost savings versus Cost of Risk for cloud computing (Linthicum, 2009).................... 66
Figure 24 - Business services based on ITIL that have a role in managing a Cloud Computing environment
(Mauger, 2009) ..................................................................................................................................................... 69
Figure 25 – Innovation Adoption Curve (Rogers, 1962) ........................................................................................ 72
Figure 26 - Balanced Scorecard of Cloud Computing, Adapted from the Balance Scorecard by Kaplan and Norton
(Kaplan, et al., 1996) ............................................................................................................................................. 74
Figure 27 - Gartner’s IS-Lite model ....................................................................................................................... 75
Figure 28 - Control vs Agility (Behnia, et al., 2008) ............................................................................................... 77
Figure 29 - Three emerging patterns for IaaS services (Staten, 2009) ................................................................. 78
Figure 30 – Example of priority outsourcing matrix .............................................................................................. 79
Figure 31 - Cloud Computing applications funnel ................................................................................................. 81
Figure 32 - Result of an eligibility matrix (Hartman, et al., 2009) ......................................................................... 82
Figure 33 - A possible IT roadmap (Zhu, 2009) ..................................................................................................... 83
Figure 34 - Server Virtualization Is A Top Priority For Most Enterprises In 2010, But Cloud Is Not (Gillett, et al.,
2009) ..................................................................................................................................................................... 84
Figure 35 - 5-step Cloud Computing Adoption Model (Sorofman, 2008) ............................................................. 85
Figure 36 - Cloud Computing providers, France 2009 (Markess International, 2009) .......................................... 87
Figure 37 - Different relationships with a provider ............................................................................................... 89
Figure 38 - 3 generic models of providers ............................................................................................................. 93
Figure 39 - Porter's Generic Strategies (Porter, 1980) .......................................................................................... 94
Figure 40 - PaaS providers (Portio Research, 2009) .............................................................................................. 96
Figure 41 - IaaS providers (Portio Research, 2009) ............................................................................................... 96
Figure 42 - Factors driving change (Behnia, et al., 2008) .................................................................................... 100
Figure 43 - Strategy map of an IT department .................................................................................................... 105
Cédric Mora
163 December 2009
Annexes
Cloud Software
Figure 44 - Strategy map of an eBusiness web site or an ISV ............................................................................. 106

Figure 45 - Path of progress for the Information System (CapGemini, 2008) ..................................................... 108
Figure 46 - Control the process, overview of the ITIL schema (ITSMF - The IT Service Management Forum, 2007)
............................................................................................................................................................................ 113
Figure 47 - Application lifecycle, adapted from the project (Hugon, et al., 2009) and operational lifecycles ... 115
Figure 48 - Application lifecycle with Infrastructure-as-a-Service ...................................................................... 117
Figure 49 - Application lifecycle with Platform-as-a-Service ............................................................................... 120
Figure 50 - Alignment of the functions (CIGREF, 2002) ....................................................................................... 131
Figure 51 - Evolution of the organization (BIT Group, 2008) .............................................................................. 132
Figure 52 - Impact of the network organization on the IT department (BIT Group, 2008)................................. 133
Figure 53 - Google Trends (http://www.google.fr/trends?q=cloud+computing%2C+soa%2C+offshoring –2009
December 20) ...................................................................................................................................................... 151
Figure 55 - Cloud offerings .................................................................................................................................. 153
Figure 56 - ITIL, a high level view of the service model (ITSMF - The IT Service Management Forum, 2007) .... 156
Figure 57 - Orchestration tool from BMC Software ............................................................................................ 160
Figure 58 - A VMWare interface to manage on-premises and off-premises resources (on Terremark,
Hosting.com servers, etc.) with VCloud .............................................................................................................. 160
Figure 59 - Enable automation with CA software, based on ITIL principles (CA, 2009) ...................................... 161
Figure 60 - Data governance with Guardiam, a data governance software company recently acquired by IBM161
Figure 61 - Policy Enforcement on Cloud Computing services from 7 Layer Technologies (Morrison, 2009) .... 162
Figure 54 - "Cloud Reference Model" - Cloud Security Alliance (Hoff, 2009) ..................................................... 152
Endnotes
(i) GDP: Gross Domestic Product is equal to the sum of the income generated by production in the country in
the period.
(ii) CAGR: The Compound Annual Growth Rate is a geometric mean growth rate on an annualized basis.
(iii) Tier one: Tier one storage solutions means that it is stored on expensive and high-quality media. It is usually
for critical data.
(iv) The Open Cloud Manifesto is a manifesto containing a "public declaration of principles and intentions" for
cloud computing providers and vendors, annotated as "a call to action for the worldwide cloud community"
and "dedicated belief that the cloud should be open".
(v) ENISA is the European Network and Information Security Agency. The objective of ENISA is to improve
network and information security in the European Union.
(vi) Conference organized by Octo Technology – “Les enjeux du Cloud Computing” (Stakes of Cloud Computing)
– 10 December 2009
Cédric Mora
164 December 2009
Annexes
Cloud Software
Cédric Mora
165 December 2009

Cloud Computing in France

Caricato da

Informazioni sul documento

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

Cloud Computing in France

Caricato da

Copyright:

Formati disponibili

Mastère Spécialisé –

Management des Systèmes d’Information et des Technologies

Cloud Computing in France,

Perimeter: Platform / Infrastructure as a Service, December 2009

• Lionel Pelletier, with all its experience as a CIO;

My family and friends for supporting me:

• André Farand, english proof reader;

The directors of this HEC/Mines Specialized Master:

• Marie-Hélène Delmond; and

• The consideration of IT to the strategy;

II.6.c. Benefits and drawbacks of the models ......................................................................... 91

IV. Nicholas G. Carr’s electricity metaphor ................................................................... 154

I.1. Context of the study

A first definition, proposed by the consulting firm Gartner is:

“A style of computing where scalable and elastic IT-related capabilities are

“Cloud computing is a model for enabling convenient, on-demand network access to a

• « Cloud Computing will be as influential as e-business » (Plummer, et al., 2008)

The different players in the Cloud Computing sectors are:

• Constructors and software providers: VMWare, EMC, Citrix, etc.

Figure 1 - Actors of the Cloud Computing market

I.2. Terminology and perimeter of the study

• A service-oriented technology, where consumer concerns are abstracted from provider

Figure 2 - Cloud Computing layers (SaaS / PaaS / IaaS)

o Offers: Billing, Financials, Legal, Sales, Desktop productivity, Human Resources,

o Offers: General purpose, Business intelligence, Integration, Development & Testing,

o Offers: Storage, Compute, Services Management.

Figure 3 - Public Cloud (Open Cloud Manifesto, 2009)

Figure 4 - Private Cloud (Open Cloud Manifesto, 2009)

Figure 5 - Hybrid Cloud (Open Cloud Manifesto, 2009)

• Community Cloud: infrastructures, shared by several organizations, support a specific

Figure 6 - Community Cloud (Open Cloud Manifesto, 2009)

Figure 7 - Forrester's TechRadar for Cloud Computing (Staten, et al., 2009)

The perimeter of the thesis is:

We will not discuss:

I.3. SMEs (Small and Medium Enterprises) versus

• Independent SMEs: they only have their internal resources.

These organizations consume IT services as follows (Jacod, 2008):

Figure 8 - Motivations for IT investment (Nassah, 2006)

I.4. Objectives and construction of the thesis

The objective of this thesis is, essentially, to answer two questions:

To answer these questions, we will divide the thesis in two parts:

(1) Understanding why organizations need decision mechanisms

The seven Cs are for:

• Communication (or Promotion): a lot of communication is done by multiple actors of Cloud

Figure 9 - 7Cs compass model

(2) Impacts on the organizations

Figure 10 - 7S of McKinsey (Pacale, et al., 1981)

The 7S are for:

I.5. Methodology of the study

Interviewee - Organization Position

Henry Peyret – Forrester • Principal Analyst

Lionel Pelletier – COLT • Senior Executive advisor in the consulting team

Isabelle Issert de Braux - COLT • Lawyer, Head of Legal office, France

Shirish Srivastava - HEC • Teacher on Information Systems and Techology,

Guillaume Plouin – OCTO • Director of the Cloud Computing offering

Béatrice Rollet - COLT • Head of Marketing of COLT Managed Services France

Speaker - Organization Conference Position

Christophe Baroux - Amazon Web Services – “Paris • Regional Sales Manager

Laurent Letourmy – Amazon Web Services – “Paris • CTO

Philippe Honigman - Amazon Web Services – “Paris • CEO

Fabrice de Biasio – IDC – “Infrastructure IT & • CIO

Karim Bahloul – IDC IDC – “Infrastructure IT & • Senior Consultant

Régis Mauger – BMC IDC – “Infrastructure IT & • CTO

Laurent Dupuytout – IT Management Partners – • CEO