Development of the business case for cloud computing

(1)

University of Groningen, Faculty of Economics and Business Master thesis

MSc Business Administration, specialization Business & ICT

Development of the business case for cloud computing

An extensive literature review and case study into the business case for cloud computing

University Supervisors Prof. dr. E.W. Berghout Dr. U.Y. Eseryel

Program MSc Business Administration

(2)

Acknowledgements

(3)

Executive summary

Cloud computing is a popular topic of interest, in both business and academia. Increased competition through globalization, cutbacks because of the global financial recession and demands for increased flexibility are driving the adoption of cloud computing globally. More and more competitors will be taking advantage of implementing cloud computing. As a result, the greatest risk to organizations might be that cloud computing is not used at all. “The savings offered by utilities eventually become too compelling to resist, even for the largest enterprises. Abandoning the old model becomes a competitive necessity.” (Carr, 2005, p.68).

In this research cloud computing is defined as follows:

“Cloud computing is a pay-as-you-go model for IT service delivery that utilizes networking technologies, in the form of the public Internet or a private intranet, to have on-demand access to a scalable pool of shared and distributed computing resources of seemingly infinite size. This will provide 24/7 access to, and worldwide availability of, the computing resources.”

For organizations to consider an IT investment in cloud computing a business case has to be created to evaluate the proposal and its alternatives. Even though an exhaustive academic literature review was conducted of the extant literature, hardly any cloud computing business case development methodologies were identified.

In this paper a cloud computing business case development methodology is proposed and validated and 12 constituents were identified. Through three case studies the influence of these constituents on the degree of successfulness of a cloud computing implementation was validated.

(4)

4.3.1 Introduction ... 50 4.3.2 Strategic alignment ... 50 4.3.3 Benefits realization ... 51 4.3.4 Alternatives ... 51 4.3.5 Financial analysis ... 51 4.3.6 Technical analysis ... 51 4.3.7 Implementation planning ... 52 4.3.8 Stakeholders ... 52 4.3.9 Risk assessment ... 52 4.3.10 Managing investment ... 53 4.3.11 Documentation ... 53

4.3.12 Conclusion and recommendations ... 53

5 Validation ... 55

5.1 Approach ... 55

5.2 Interview results and findings ... 55

5.2.1 Organization 1: Stichting Thuiszorg Midden-Gelderland (STMG) ... 56

5.2.2 Organization 2: GGZ Friesland ... 59

5.2.3 Organization 3: Wegener ... 62

5.3 Analysis of case studies + input framework / model ... 67

5.3.1 STMG ... 67

5.3.2 GGZ Friesland ... 67

5.3.3 Wegener ... 68

5.3.4 Consolidated input ... 70

5.4 Validated cloud computing business case development methodology ... 75

5.4.1 Introduction ... 75

(6)

5.4.3 Benefits realization ... 76 5.4.4 Alternatives ... 77 5.4.5 Financial analysis ... 77 5.4.6 Technical analysis ... 78 5.4.7 Implementation planning ... 78 5.4.8 Stakeholders ... 79 5.4.9 Risk assessment ... 79 5.4.10 Managing investment ... 80 5.4.11 Documentation ... 81

5.4.12 Conclusion and recommendations ... 81

5.5 Summary discussion ... 81

6 Conclusion ... 83

6.1 Research questions ... 83

6.1.1 Sub question 1: What business case constituents are available? ... 83

6.1.2 Sub question 2: What are the possible business case constituents for cloud computing? ... 84

6.1.3 Sub question 3: How do these business case constituents influence the degree to which cloud computing can be successfully implemented? ... 84

6.1.4 Main research question: What are the appropriate business case constituents for cloud computing investments? ... 84

6.2 Implications for practice ... 85

6.3 Implications for theory ... 86

6.4 Limitations ... 86 6.5 Future research ... 87 6.6 Reflection ... 87 7 References ... 88 8 Appendix ... 94 8.1 List of figures ... 94 8.2 List of tables ... 94

(7)

1 Introduction

The first section of this paper starts with the problem statement behind the conducted research which is reported in this paper. This is followed by the motivation for the conducted research, as well as the background information, the research objective, the research questions, as well as sections pertaining to the theoretical and practical contributions of this paper and detailing the scope of the conducted research. This first section will conclude with an outline for the rest of this paper.

1.1 Problem statement

Because of the different developments and changing trends in (business) information systems, information communication and technology, as well as increasing globalization, organizations have to respond to changes in the market and make strategic choices about the future of their mission and vision, as well as the translation of those in the business model, organizational structure and related business processes (Armbrust et al., 2009; Kim, 2009; Sabherwal & Becerra-Fernandez, 2011).

Investments in IT have to be made to reduce cost, reduce organizational complexity, increase business agility, align IT with business, help innovate and provide better products / services to customers (Prahalad & Hamel, 1990). One of the trends in business is outsourcing of non-core (business) processes and a refocus on an organization's core (value-adding) activities (Barthélemy, 2003; Gill, 2011). Investments in the IT environment are required and the relatively novel concept of cloud computing is one of the options available to organizations (Marston et al., 2011). Organizations make use of business cases in their (IT) investment decision making process. These business cases take different forms and have different degrees of richness. Having a rich business case (positively) influences an organization's chances of successful IT investments (Berghout & Tan, 2013). At the moment of writing this paper just one cloud computing business case development methodologies was identified in the (academic) literature. These should help organizations develop a business case for cloud computing investment(s) with the appropriate constituents to increase the richness of such business cases.

Therefore, these organizations lack the necessary information to make an informed IT investment decision with respect to cloud computing. What is lacking is a (validated) cloud computing specific methodology for developing a business case for cloud computing.

1.2 Motivation

In a world where organizations depend on increasingly complex and important information systems, less expensive, pay-per-use, easier to maintain and a scalable alternative exists in the form of cloud computing (Buyya et al., 2008). With such a high cost, high risk, high complexity and high impact investment a proper business case can help organization evaluate the IT investment decision and assist with the implementation (Berghout & Tan, 2013). For a proper evaluation of the business case for cloud computing, the appropriate constituents of such a business case need to be identified. Furthermore, a methodology for the development of a cloud computing business case is proposed in this paper through an academic literature review and is validated through three case studies from organizations in The Netherlands.

1.3 Background information

(8)

appealing. While the cost of hardware has been declining over the past decades and the false assumption might be that IT in organizations is getting cheaper with time. However, research indicates that the traditional computing IT infrastructure and maintenance has gradually become more and more expensive (Brodie, 1992; Rettig, 2007), increasingly complex, (Marston et al., 2011) and has not been able to meet the current needs, such as the demand for flexibility and scalability (Fox, 2011; McCarthy & Hill, 2011). Decreasing hardware costs and increased IT costs might indicate that IT investments are becoming more important to organizations.

In short, traditional computing is becoming less popular as organizations are looking for a more suitable alternative. As a result, organizations are increasingly investigating and investing alternatives such cloud computing (Gens, 2010; IDC, 2010).

To elaborate the concept of cloud computing, a definition is required. For the purpose of the conducted research which is reported in this paper, on the basis of academic literature review, cloud computing is defined as (Buyya et al., 2008, p.2; Foster et al., 2008; Armbrust et al., 2009; Mell & Grance, 2011):

Cloud computing is a pay-as-you-go model for IT service delivery that utilizes networking technologies, in the form of the public Internet or a private intranet, to have on-demand access to a scalable pool of shared and distributed computing resources of seemingly infinite size. This will provide 24/7 access to, and worldwide availability of, the computing resources.

This definition is based on multiple definitions of identified in the cloud computing literature. For a background information and other definitions of cloud computing see section 3.3.

Authors argue that cloud computing has (organizational) advantages over increasing cost and complexity of maintaining traditional computing (Rettig, 2007; Marston et al., 2011). Moving to a new IT infrastructure is not without risks and uncertainties (Davenport, 1998). However, this migration will be able to provide the organizations with increased efficiency and additional flexibility (Gill, 2011). Another benefit is that the general outsourcing of (business) processes, and in this case the IT infrastructure and processes, is able to allow the organization to refocus on their core competencies and achieve a competitive advantage (Prahalad & Hamel, 1990). Besides the perceived benefits of cloud computing, there are also possible disadvantages to implementing cloud computing. Both the perceived benefits and weaknesses are discussed more in-depth in the literature review, in section 3.3.

These possible disadvantages include the loss of control over the available IT assets. The interests and incentives of the provider differ from those of the consumer, this leads to a so-called principle-agent problem. In the case of cloud computing, this problem describes the difficulties in motivating the provider to act in the best interest of the consumer, rather than in their own best interest. In such cases, there could be uncertainties and additional risks of a cloud computing implementation.

(9)

resulted in the unavailability of numerous major websites and services that use the cloud computing products / services provided by Amazon (Venturebeat.com, 2011).

1.4 Research objective

A business case for cloud computing can help manage costs and therefore reduce the risk of overruns. Furthermore, stakeholders can be appointed and held responsible for their (in)actions. Therefore, this paper will investigate how a proper business case for cloud computing can be developed and should be evaluated. Without a clear methodology for the development of such business cases these business cases might not be complete in their evaluation of cloud computing and the opportunities and threats to their organization.

The research objective is to propose and validate a cloud computing specific business case development methodology. Such a methodology can be used by organizations or third parties to evaluate the feasibility of an IT investment in cloud computing. Furthermore, organizations can use this methodology as a framework when developing a business case for cloud computing.

The conducted research reported in this paper combines the scientific literature pertaining to information systems, cloud computing, IT investments and business case development methodologies. This literature review will lead to the proposal of a cloud computing business cases development methodology which is validated through case studies.

1.5 Research questions

Based on the posed research problem and research objective the following main research question guides the conducted research:

What are the appropriate business case constituents for cloud computing investments?

Through a literature review of the (academic) literature, a methodology for developing cloud computing business cases is proposed. Furthermore, this paper will attempt to validate the proposed cloud computing business case development methodology. In order to help achieve these goals, provide structure to this paper and help answer the main research question, the following sub-questions are formulated:

1) What business case constituents are available?

2) What are the possible business case constituents for cloud computing?

3) How do these business case constituents influence the degree to which cloud computing can be successfully implemented?

1.6 Theoretical contribution of this paper

(10)

1.7 Practical contribution of this paper

By proposing and validating a methodology for developing a business case for cloud computing investment and identifying the appropriate constituent elements, managers are better able to make strategic and operational decisions about the role of IT and cloud computing in their organizations. Furthermore, this methodology can be used by third parties as a framework in their role of providing quality or business case assurance.

"Strategy is the art of creating value. It provides the intellectual frameworks, conceptual models, and governing ideas that allow a company's managers to identify opportunities for bringing value to customers and for delivering that value at a profit. In this respect, strategy is the way a company defines its business and links together the only two resources that really matter in today's economy: knowledge and relationships or an organization's competencies and customers." (Normann & Ramírez, 1993, p.65).

1.8 Scope of the research

The previous sections discuss the objective of the conducted research. In this section, the scope of the conducted research is given.

In the literature review, the importance of Information Systems (IS) and IS investments are studied, as well as the role of the business case in IT investment decisions and implementations. This literature review forms the basis for the proposed methodology for cloud computing business case development. This methodology will be validated through case studies at organizations that have implemented (a form of) cloud computing.

1.9 Outline

This paper is structured as follows. In section 2, the research methodology, as well as the methods for literature collection and analysis, is formulated. Section 3 contains an in-depth literature review of the available (academic) literature concerning Information Systems (IS) management, traditional- and cloud computing, and IT investments. Furthermore, the key concepts of the literature review are summarized and analyzed which will serve as the foundation for proposal of a methodology for cloud computing business case development in section 4. The sub-questions posed above will be answered based on the literature review and analysis. In section 5 the for cloud computing business case development methodology and its constituent elements are validated.

(11)

2 Research methodology

This section describes the applied research methods, starting with the adopted research methodology. The second half of this section pertains to the literature collection and analysis methods.

2.1 Research approach

The main first part of the conducted research is the in-depth literature review. The literature review focuses on two key areas in the (academic) literature:

1) Two types of Information Systems (IS). A popular form during the past decades was traditional computing (Ernst & Young, 2010) and now organizations are considering cloud computing as an alternative.

2) Information Systems (IS) management, investments in the IT environment / infrastructure, as well as management of these IT investments.

These two key areas are reviewed in the literature review, after which they are combined in the proposal of a cloud computing business case development methodology.

In order to provide additional insight into the different subjects and to increase the validity of the conducted research, multiple techniques and sources of data were combined. This was done in order to triangulate the data and study the proposed cloud computing business case development methodology from different perspectives. More specifically, academic literature was reviewed prior to the conducted case studies. Using these different research techniques within a main research method is relatively a common practice for qualitative research (Myers, 2009). By adhering to this methodology the results could be checked and a balanced view is provided.

2.1.1 Literature review

Academic literature was reviewed concerning the topic of cloud computing, business cases, information systems and IT investments. In order to conduct an exhaustive review of the available literature the papers were identified via the EconLit & Business Source Premier databases through the EBSCO host aggregator search engine. Search results were limited based on the following three parameters:

1) Scholarly (Peer Reviewed) Journals 2) Full Text

(12)

Using the limiters above the different (combinations of) keywords resulted into the following numbers of identified academic articles: Keyword(s) Results Information system 21.330 IT investment 2.497 Business case 1.534 Cloud computing 289

Cloud computing AND business case 3

Cloud computing AND success factors 1

IT investment AND business case 13

IT investment AND success factor 6

IT investment AND project management 169 Information system AND business case 94 Information system AND IT investment AND evaluation 33 Cloud computing AND IT investment AND evaluation 0 Evaluation AND information system AND investment 128

Evaluation AND IT investment 180

Evaluation AND cloud computing 21

Table 1 Available academic literature

For the academic literature review no a-priori limitations with respect to the publication date of the articles were set, since this paper also pertains to history and evolution of business computing / information systems.

An initial review of the academic literature returned over 25.000 results. By adding additional, more specific, keywords, these results were narrowed down. These results were further narrowed down by examining the paper’s titles and summaries and non-relevant articles were excluded from further analysis. Based on a review of the abstract papers were filtered and similar / previous articles of the identified authors for the relevant articles were included for review as well.

Applying this broad approach tries to minimize the risk of excluding publications, reports, or other sources in the literature review. The goal was to get sufficient results pertaining to different topics in scope, as well as the relations among these topics.

Besides the literature search through EBSCO host, which is described above, the Google search engine and Google Scholar search engine were used as to not exclude other sources such as blogs, (white) papers, reports, forecasts, news articles, interviews and other publications of a non-academic nature that contained relevant information. The references section at the end of this paper contains references, in the Harvard style, to all materials that were used as sources in this paper.

2.1.2 Preliminary findings

(13)

In order to propose and validate a methodology for developing cloud computing business cases the following section will discuss two forms of information systems, traditional computing and cloud computing. Based on the identified differentiating factors, as well as a literature review of appropriate constituent elements for “traditional” information systems investments, a grounded methodology can be proposed. After which the cloud computing forms and characteristics are applied.

2.1.3 Case study

For the purpose of triangulation, case studies will be conducted. Through multiple case studies, organizations will be studied that have implemented, or are implementing, cloud computing. These case studies will assist in validating the proposed grounded methodology of the constituent elements of a cloud computing business case. For each organization the proposed business case will be studied, as well as face-to-face interviews will be held. Together with the academic literature review, this input should lead to a grounded and validated methodology of constituent elements of cloud computing specific business cases.

“A case study is an empirical inquiry that:

- investigates a contemporary phenomenon within its real-life context, especially when

- the boundaries between phenomenon and context are not clearly evident.” (Yin, 2003, p.13).

The purpose of the literature review is to provide insight and an academic foundation of the proposed methodology. The goal is to investigate cloud computing in terms of its characteristics, history, evolution, risks, benefits, business models and other relevant aspects. Furthermore, relevant frameworks and guidelines for business case development are studied. In-depth literature review allows for the establishment of a sound theoretical foundation from which empirical case studies can be conducted (Yin, 2003). According to the EPA, a case study is “a method for learning about a complex instance, based on a comprehensive understanding of that instance, obtained by extensive description and analysis of the instance, taken as a whole and in its context.” (Environmental Protection Agency, 2011).

For this paper, three exploratory case studies are part of the applied research strategy. This specific (exploratory) approach is useful in this early stage of research a particular topic (Myers, 2009). These exploratory case studies contribute to theory development.

Yin (2003) sets three conditions for when it is appropriate to use a case study as a research methodology, namely: 1) The type of research question posed: for ‘how’ or ‘why’ questions case studies are appropriate. 2) The extent of control an investigator has over actual behavioral events: a case study is appropriate

when an investigator has no control over the behavioral events of actors in the phenomenon that is studied.

3) The degree of focus on contemporary as opposed to historical events: a case study is appropriate if the focus of the research is on contemporary, instead of historical events.

(14)

“Case study research in business uses empirical evidence from one or more organizations where an attempt is made to study the subject matter in context. Multiple sources of evidence are used, although most of the evidence comes from interviews and documents.” (Myers, 2009, p.76).

(15)

3 Literature review

3.1 Introduction

Based on the identified literature in Table 1, the following sections include the conducted in-depth literature review. This literature review section of this paper will discuss two types of Information Systems (IS). The first, traditional computing, is an in-house way for organizations to design their IT environment (Spellmann et al., 2009). After traditional computing is discussed, the literature review examines an alternative IS, namely cloud computing. These topics, IS (including traditional- and cloud computing), IT investments and business cases, form the foundation of a methodology that is the result of the conducted literature review. This methodology is then subjected to validation in the form of multiple case studies. This approach is discussed in the previous section, the research methodology.

In section 3.2 pertains to Information Systems and discusses traditional computing. Section 3.3 covers cloud computing in detail. In section 3.4 investments in IT are studied and finally in section 3.5 the different business case development methodologies are reviewed.

3.2 Information Systems (IS)

Pearlson and Saunders (2009) consider Information technology (IT) to be all forms of technology to create, store, exchange, and use information. Information Systems (IS) are a combination of this technology, the people who use this technology and the process used within an organization to produce and manage information.

Information is of vital importance to organizations since all business processes require information for their optimal performance (Chaffey & Wood, 2005). Organizational value is derived from these business processes and IT is able to support these processes.

3.2.1 Traditional computing

Traditional computing is a form of business computing that is present in a large number of companies (Ernst & Young, 2010). With traditional computing, the provider focuses on selling hardware and software to the consumers (Marston et al., 2011). The consumer then has to figure out how to use it (effectively) (Du & Cong, 2010). The main stakeholders in this value chain, according to Marston et al. (2011), are the consumer; the party that is looking for a solution, and the provider; the stakeholder that offers products and services as a solution.

“In a traditional computing setup, the main stakeholders are the providers and consumers: the consumers use, own, maintain, and upgrade the systems while the providers deal with the sale, installation, licensing, consulting and maintenance of the technology involved. Cloud computing changes the roles of the traditional stakeholders and adds new ones.” (Marston et al., 2011, p.182).

Traditional computing is usually associated with in-house computing, which means that an organization houses their IT environment on its own premises (Spellmann et al., 2009). Outsourcing (parts of) the IT environment is also a possibility for organizations to reduce costs (Barthélemy, 2003; Gill, 2011). Using traditional computing requires large upfront investments in order to design, buy, and implement the systems in the organizational processes (Armbrust et al., 2009).

(16)

and benefits of this traditional set-up is the high level of perceived control the organization has (Sarrel, 2010). They are responsible for maintenance and upgrades of the systems they own. The provider is responsible for the sale, installation, licensing, consulting, and maintenance of the technology (Marston et al., 2011). This leads to a clear division of responsibilities and ultimate accountability (European Network and Information Security Agency, 2009). These responsibilities require staff with the expertise and skills to perform these duties. This is a costly affair (Gill, 2011) that does not always directly add value to the organization, since most of the times it is not a core competency or value-adding activity (Barthélemy, 2003). Furthermore, there is a yearly depreciation of hardware (Armbrust et al., 2009). Expertise and money is required for maintenance of legacy databases and applications as well as linking them together (Brodie, 1992). This results in a complex and costly environment (Brodie, 1992; Bisbal et al., 1999). All in all, providing the IT environment is not the core business of, or source of their competitive advantage for, many companies, therefore they might be better off by outsourcing it (Barthélemy, 2003).

Generally, the disadvantages associated with traditional computing can be categorized in the following three groups:

- Cost: the current legacy IT/ IS environment in many organizations is becoming more and more expensive (Brodie, 1992; Rettig, 2007). Maintenance and staffing are large parts of the budget and take money away from improving the business process by investing in IT (Girard, 1999; Curran, 2011; Gill, 2011) and focusing on the core competencies (Prahalad & Hamel, 1990). Large up-front investments are required if changes are made to the IT infrastructure (Tisnovsky, 2010).

- Complexity: more and more devices and applications are connected to and run on the IT infrastructure / network of the organization (Ernst & Young, 2010), making maintenance and security difficult and expensive (Marston et al., 2011). The IT infrastructure is becoming increasingly complex (Rettig, 2007). This is also negatively influencing business agility and flexibility (Brodie, 1992; Kephart & Chess, 2003; Du & Cong, 2010).

- Unmet needs: organizations are demanding increased computational power for a multitude of tasks, among them is the increasing amount of real-time data that needs to be processed more rapidly (Fox, 2011; McCarthy & Hill, 2011; KPMG, 2011). There is value to be derived from this so-called business intelligence (BI) or analytics (Kim, 2009; Sabherwal & Becerra-Fernandez, 2011). There is also a need for increased collaboration and integration among organizations and departments (Andriole & Khorasani, 2010).

Besides the abovementioned disadvantages, there are also risks and problems associated with traditional computing, such as:

- Responsibility: assuming responsibility for tasks / services that are not part of your core business / competency, leading to increased IT related costs (Barthélemy, 2003).

- Insufficient capabilities, skills and knowledge: dependency on possible insufficient internal capabilities, skills and knowledge, because qualified personnel to maintain the legacy systems are harder to come by; resulting into unmet needs and higher costs (Erlikh, 2000).

- Legacy systems: dependency on out-dated, large and inflexible, legacy systems; having an increase in complexity and costs of the IT environment and related information systems (ISs) as a consequence (Brodie, 1992; Rettig, 2007).

However, once the risks are correctly identified, the consumer and provider can separately or together take appropriate measures in order to adequately control, or mitigate, these risks.

(17)

and require skilled IT professionals to install, configure, tune, and maintain. [...] the difficulty of managing today’s computing systems goes well beyond the administration of individual software environments. The need to integrate several heterogeneous environments into corporate-wide computing systems, and to extend that beyond company boundaries into the Internet, introduces new levels of complexity. Computing systems’ complexity appears to be approaching the limits of human capability, yet the march toward increased interconnectivity and integration rushes ahead unabated.” (Kephart & Chess, 2003, p.41).

The disadvantages of traditional computing (high cost; increased complexity; unmet needs) combined with the risks and problems associated with it (responsibility; insufficient capabilities, skills and knowledge; legacy systems) are motivating factors for organizations to identify an alternative IT infrastructure solution. Technological developments and increased demands of organizations have created a path for an alternative to traditional computing, namely cloud computing.

(18)

3.3 Cloud computing

3.3.1.1 Introduction

In order to come to an understanding what cloud computing is, it is useful to compare multiple definitions by different parties, thereby not limiting yourself to one (authoritative) definition. In the process of identifying definitions of cloud computing one quickly finds that there are almost as many definitions as there are papers dedicated to cloud computing. This indicates that it is not clear what exactly cloud computing is, but also just as important, what it is not. In the first sub-section, the history of cloud computing is discussed. After which combinations of different definitions of cloud computing are used in order to explore the phenomenon. Together, the definitions and the explanation of cloud computing are followed by a description of the different cloud computing deployment- and service models.

3.3.1.2 History of cloud computing

ASP, or Application Service Provisioning, is a form of outsourcing whereby certain applications within an organization's IT environment are outsourced to centralized location, often provided by an external party (Bianchi, 2000). These applications are then provided to the customer via the Internet. In this form ASP shares similarities with SaaS, Software-as-a-Service, as discussed in section 3.3. In that regard cloud computing can be seen as a technological evolution and a marketing rebranding of products and services that were already available to organizations. However, cloud computing can entail much more than just providing software applications through the internet. For example, cloud computing refers to pools of on-demand resources that are shared, distributed and of seemingly infinite size.

"The old model - in which a user organization purchased and maintained hardware, operating systems, and applications in private premises - is being replaced by usage of on-demand computing and storage infrastructure capacity, and by SaaS." (Ojala & Tyrväinen, 2011, p.7).

Besides ASP, similar movements to the current cloud computing developments where already described in literature and there were similar real-world applications in businesses, such as distributed- or grid computing (IBM, 2002; Foster et al., 2008). What sets cloud computing apart is that cloud computing as we know it today has been made possible due to a number of recent (technological) advances, such as the capability of virtualization, a multitenancy environment, popularity of web services, increased global bandwidth, ubiquitous network access, reduced storage and hardware costs (Marston et al., 2011). These advances finally made the idea of computing as a true utility technologically possible and, more importantly, economically feasible (Creeger, 2009) and are currently driving the evolution and adoption of cloud computing.

In 1961 during a speech at the MIT Centennial celebrations, John McCarthy (famously) proclaimed: “If computers of the kind I have advocated become the computers of the future, then computing may someday be organized as a public utility just as the telephone system is a public utility.… The computer utility could become the basis of a new and important industry.” (McCarthy, 1999).

(19)

“As of now, computer networks are still in their infancy, but as they grow up and become sophisticated, we will probably see the spread of ‘computer utilities’ which, like present electric and telephone utilities, will service individual homes and offices across the country.” (Buyya et al., 2008, p.1; Jiang & Yang, 2010).

Since then there have been a lot of variations on the same basic idea of having centralized computational resources available as a utility that can be easily bought and sold (Wellman, 2010). Ideas such as grid- / distributed computing were incarnations of this idea (Foster et al., 2008), whereby the modern day concept of cloud computing shares some (technical) aspects with grid- / distributed computing. For example, using many separate physical machines and interconnecting them in order to operate like a single ‘virtual machine’, combining the available processing power.

3.3.1.3 Definitions of cloud computing

One of the (popular) definitions of cloud computing in the literature is from the NIST, the National Institute of Standards and Technology. The definition of cloud computing of the NIST is as follows: “Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.” (Mell & Grance, 2011). However, the authors of the NIST paper indicate that the concept of cloud computing is still changing and that their definition will change when cloud computing evolves and matures over time.

Other definitions of cloud computing were identified:

- “Cloud Computing refers to both the applications delivered as services over the Internet and the hardware and systems software in the datacenters that provide those services. The services themselves have long been referred to as Software as a Service (SaaS), so we use that term. The datacenter hardware and software is what we will call a Cloud.” (Armbrust et al., 2009, p.4).

- "A Cloud is a type of parallel and distributed system consisting of a collection of interconnected and virtualised computers that are dynamically provisioned and presented as one or more unified computing resources based on service-level agreements established through negotiation between the service provider and consumers.” (Buyya et al., 2008, p.2).

- “A large-scale distributed computing paradigm that is driven by economies of scale, in which a pool of abstracted, virtualized, dynamically-scalable, managed computing power, storage, platforms, and services are delivered on demand to external customers over the Internet.” (Foster et al., 2008, p.1).

- The hardware en software in the datacenters is what is referred to as ‘the cloud’ (Armbrust et al., 2009). It is the infrastructure that makes the cloud computing environment possible.

Combining technical and business aspects of cloud computing, ENISA (European Network and Information Security Agency) came to the following definition: “Cloud computing is an on-demand service model for IT provision, often based on virtualization and distributed computing technologies. Cloud computing architectures have:

- highly abstracted resources

- near instant scalability and flexibility - near instantaneous provisioning

- shared resources (hardware, database, memory, etc)

- ‘service on demand’, usually with a ‘pay as you go’ billing system

(20)

Using the definitions above, the following cloud computing definition is formulated, incorporating the technical as well as organizational perspectives. This definition will be used throughout the rest of this paper. A few key features are highlighted which are linked to the definitions given above:

Cloud computing is a pay-as-you-go model for IT service delivery that utilizes networking technologies, in the form of the public Internet or a private intranet, to have on-demand access to a scalable pool of shared and distributed computing resources of seemingly infinite size. This will provide 24/7 access to, and worldwide availability of, the computing resources.

As mentioned above, the idea of cloud computing is very broad. Therefore, the used definition is rather general. Cloud computing products and services do not necessarily have to include all features above; however, they should incorporate most (key) features.

3.3.1.4 Cloud computing deployment models

The adopted definition of cloud computing leaves room for different typologies / deployment models of cloud computing as well as several service models. The paper by the NIST describes four separate deployment models, namely:

- Private cloud: “the cloud infrastructure is operated solely for an organization. It may be managed by the organization or a third party and may exist on premise or off premise.” (Mell & Grance, 2011, p.3). - Community Cloud: “somewhat similar to a private cloud, but the infrastructure and computational

resources are shared by several organizations that have common privacy, security, and regulatory considerations, rather than for the exclusive use of a single organization.” (Jansen & Grance, 2011, p.3). - Public Cloud: “the infrastructure and other computational resources that it comprises are made available

to the general public over the Internet. It is owned by a cloud provider selling cloud services and, by definition, is external to an organization.” (Jansen & Grance, 2011, p.3).

- Hybrid cloud: “is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables interoperability.” (Jansen & Grance, 2011, p.3).

For example, the value of a private cloud is that it maintains the organization’s direct control over security, compliance and legal discovery (Sarrel, 2010). It's debatable if this type of cloud can be truly called a cloud computing product in the case the organization is both the provider as well as the consumer. This is because it does not suffice an important criterion mentioned in the definition of cloud computing, namely pay-as-you-go principle. If the consumer is the provider as well, which is the case of an internal private cloud, the organization is still responsible for building and maintaining the entire IT infrastructure.

The separation of cloud computing deployment models is of significance when we look at the potential cloud computing related products and services that stakeholders are able to offer. These differ depending on what deployment model an organization is considering migrating to, or has already implemented. This is because these different deployment models provide organizations with different degrees of control over their data and information. Higher risk and uncertainty is associated with a public or community cloud. This distinction requires that a proper risk and continuity evaluation is made before an organization migrates to the cloud.

3.3.1.5 Cloud computing service models

(21)

different from what has been offered before, Schaffer identifies dozens of service models that follow the XaaS form (Schaffer, 2009).

According to the NIST (National Institute of Standards and Technology), there are three cloud computing service models or so-called cloud computing layers (Mell & Grance, 2011):

- Infrastructure-as-a-Service (IaaS): “The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls).” (Mell & Grance, 2011, p.3).

This means that a consumer of the IaaS cloud computing product gets control on a so-called low level, meaning anything above the direct cloud computing hardware infrastructure. This gives the consumer a degree of freedom pertaining to what operating system to run, or what applications to move to the cloud. The provider of the IaaS cloud computing product provides the infrastructure with as few as restrictions. - Platform-as-a-Service (PaaS): “The capability provided to the consumer is to deploy onto the cloud

infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment.” (Mell & Grance, 2011, p.2).

The consumer gets the capability to deploy custom applications on the infrastructure of the provider, using the provider’s programming language and tools. Management of the underlying infrastructure is controlled by the provider and there might be an opportunity for hosting environment configurations. The degree of freedom which can be achieved when using an IaaS cloud computing product is reduced, but in turn it is less complex for the consumer to manage the cloud computing environment. In this case the responsibility for maintaining the hardware (infrastructure) and software (operating systems) is delegated to the cloud computing provider.

- Software-as-a-Service (SaaS): “The capability provided to the consumer is to use the provider’s applications running on a cloud infrastructure various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.” (Mell & Grance, 2011, p.2).

Through a web interface a consumer accesses an application running in the providers’ cloud infrastructure. The provider is responsible for all layers of (application) management, except specific client configurations. Just as with deployment models, differences in service models (the so-called SPI model, Software, Platform and Infrastructure) have an influence on the types of cloud computing related products and services can be provided by the cloud computing service provider, as well as the risks associated and the degree to which the cloud service provider is responsible for the management / maintenance.

3.3.1.6 Cloud characteristics

(22)

These factors motivate organizations to move to new IT solutions such as cloud computing. These factors are introduced in section 3.2.1, where the literature discussing traditional computing is reviewed. To summarize, these three factors are: cost, complexity and unmet needs. Broadly, these factors apply to all deployment- and service models above, except where it is explicitly mentioned.

These three main negative characteristics of traditional in-house computing in modern organizations can be alleviated by implementing (a form of) cloud computing. This makes them key drivers / motivators for cloud computing implementations. The following sections will describe how these “problems” of traditional computing impact businesses and, more importantly, what cloud computing can do to remedy these aspects.

Cost

Cost of the traditional IT infrastructure has increased over the last decades, which impacted the amount of money organizations could spend on their core competencies (Prahalad & Hamel, 1990; Rettig, 2007). Adopting a cloud computing solution could lead to a reduction in costs. Increased (financial) flexibility through the ability of scaling the costs with the usage of IT, as well as a transparency in cost allocation, are motivators for cloud computing (Gill, 2011). The cloud computing characteristic of cost associativity, meaning that “there is no cost penalty for using 20 times as much computing for 1/20th the time” (Armbrust et al., 2010, p.17), provides a financially flexible way of scaling IT with the demand.

“Some years ago, a report from Gartner found that more than 90% of a typical IT budget is spent on maintenance, and as little as 9% is left for actual business process improvement. The result is that a substantial gap has opened up between the goals of the finance organization—such as establishing clear business visibility, maintaining an effective internal control structure and process, and ensuring efficient GAAP conformance—and what IT can provide from the current systems. There simply isn’t any budget left for innovation.” (Gill, 2011, p.45).

Implementing cloud computing is a way to stop the seemingly ever increasing IT maintenance costs by transforming capital expenditures / investments (CapEx); the up-front investments, into operational expenses (OpEx); on a pay-per-use basis (Tisnovsky, 2010). This takes away the need for large up-front investments and transforms the process into a transparent and scalable system that is used and paid for when it is actually needed. This view of a cost reduction through implementing cloud computing is contrasted by the research of Spellmann et al. (2009). Their research indicated that if all costs, especially the hidden costs, such as costs of downtime due to unavailability of the cloud computing service provider, are included, over time the cloud computing solution, as reflected by the total cost of ownership (TCO), can even be higher than the current situation (Barthélemy, 2003; Spellmann et al., 2009). This contrast stresses the importance of a proper business case before an organization migrates to cloud computing.

(23)

Low computer power utilization in corporate data centers, with as much as 80% of the available servers having an average resource utilization of around 30% (Andrzejak et al., 2002), as well as with desktops in organizations which have an estimated average load of 5% (IBM, 2002). These figures can be contrasted with the possibilities for high utilization in large-scale cloud computing data centers (through the use of technologies such as virtualization). There is also an elimination of the depreciation penalty of (underutilized) hardware, because organizations do not have to take care anymore of their own IT infrastructure (Armbrust et al., 2010). Organizations can reallocate budget from maintenance of the traditional computing infrastructure to improving the actual business processes (Gill, 2011), by outsourcing non-core activities and processes. In this way, they are able to build core competencies (Prahalad & Hamel, 1990) and refocus on improving the service delivery towards clients (Barthélemy, 2003). Complexity

Organizations sometimes use hundreds of applications with millions of lines of code (Kephart & Chess, 2003) and different versions of those applications, spread out over departments, offices and business units (Akella et al., 2009). These very large legacy information systems are also old; employ old programming languages and legacy database services. Some are mission-critical and must be operational all the time (Brodie, 1992).

“as computing becomes more pervasive within the organization, the increasing complexity of managing the whole infrastructure of disparate information architectures and distributed data and software has made computing more expensive than ever before to an organization” (Marston et al., 2011, p.176).

This complexity is also caused by the system being inflexible; meaning that it is difficult to adapt the legacy information system to the changing business needs, and brittle; this means that the information system is easily broken when something is modified. This all leads to a fear: “the widespread fear that legacy ISs will, one day, break beyond repair” (Brodie, 1992, p.20).

Clearly, managing these applications and legacy (information) systems becomes increasingly complex and expensive (Marston et al., 2011). By pro-actively moving existing applications to the IaaS or PaaS cloud, or replacing these brittle legacy information systems risks can be reduced. Moving to a (standard) cloud computing solution which has one version for all users eliminates the need for versioning (Vogels, 2008). This also means that there is no need for (client-side) updating since there is just a single version of the application that is being used by everyone (Gill, 2011).

Unmet needs

The third driver for cloud computing implementations, unmet needs in the current situation, has some overlap with the two previously discussed drivers. Examples of the specific needs beyond the cost reduction and simplification of the IT infrastructure are: innovating business processes (Gill, 2011), adding and changing products or services, increasing business agility and flexibility (Armbrust et al., 2009; Sabherwal & Becerra-Fernandez, 2011).

“If there's a perfect symbol of corporate IT today, it's the personal computer. Not only is the PC ubiquitous in modern companies, dominating the desks of most office workers, it is also a microcosm of the overall state of computing resources at the typical corporation: fragmented, redundant and increasingly underutilized.” (Carr, 2005, p.69).

(24)

interface (Hayes, 2008) that scales with the user demand. This means that employees can work when they want, from the location they want and having the freedom to pick the device they want to use (phone, tablet, laptop, et cetera).

“The trend toward anywhere, anytime access to information will continue changing the business environment, blurring the lines between home and office, co-worker and competitor, and removing traditional enterprise boundaries.” (Ernst & Young, 2010, p.2).

By reducing complexity, through the outsourcing of non-core activities to a specialized partner (Barthélemy, 2003); the organization can refocus on its core activities (Prahalad & Hamel, 1990). Reducing the number of legacy systems and processes and refocusing on what is important to the company will be beneficial to the organization’s agility (Brodie, 1992; Rettig, 2007). This means that the organization can more quickly respond to changes in the market (Sabherwal & Becerra-Fernandez, 2011).

There are different trends in business such as analytics / business intelligence, or other computationally intensive business applications (Fox, 2011; McCarthy & Hill, 2011). The SPI service models provides even the smallest start-ups with the computational capabilities that used to be only available to the organizations with multi-million dollar IT infrastructures and server farms. Combining this with the need for mobility, agility and flexibility, means that there are some additional drivers for moving the IT environment into the cloud. Having cloud computing implemented in your organization lets you quickly scale up and down the available computational resources to reflect the actual usage (Buyya et al., 2008). Increased competition through globalization increases organizational demands for greater business agility and analytics (Armbrust et al., 2009; Kim, 2009). Being able to quickly respond to new opportunities or environmental changes in the market is key (Sabherwal & Becerra-Fernandez, 2011). Cloud computing provides a new way of using available technologies in connecting organizations in the marketplace (Greengard, 2010). It improves the supply chain, and makes collaboration and communication easier (European Network and Information Security Agency, 2009), for example, cooperating organizations in a supply chain utilize the same SaaS or PaaS service model, this (possibly) eliminates the need for complex data conversion and exchange. The border separating organizations is being blurred (Ernst & Young, 2010), resulting into a search for a solution that can make (interorganizational) collaboration and communication easier. Easier collaboration among people who are connected through cloud computing is now possible.

"The value of cloud computing is in the sharing of information and services transparently among users of a massive computing grid" (Mohammed, 2011, p.124).

Combining ubiquitous access with web interfaces (Hayes, 2008) provides easy collaboration. This easy sharing of information is also a risk when it becomes an unwanted, (un)intentional or accidental exchange of information, or data leak. Therefore, appropriate measures need to be taken for an organization considering migrating to the cloud. It's helpful to remind the consumer that there are multiple deployment models one can choose from. There are different degrees of perceived control the organization maintains over the infrastructure and the data / information therein.

3.3.1.7 Perceived additional benefits and (competitive) advantages of cloud computing

(25)

“the biggest risk accrue to those companies that don’t implement any form of cloud computing. IT organizations that don’t implement any form of cloud computing guarantee that their company will not get the benefits” (Metzler, 2009, p.8).

What follows is a description of the perceived benefits and competitive advantages of cloud computing to the customer, motivating them to migrate from an on-premise IT infrastructure, to a cloud computing based solution:

- Cost savings: there are some significant cost savings for the large scale cloud service provider that can be the basis of a competitive advantage. As discussed above, the truly large scale cloud computing data centers have significantly lower costs for electricity, hardware, software, operations, and bandwidth due to economies of scale (Hamilton, 2008; Armbrust et al., 2009). This reduction in cost is then translated into lower prices for the customer through competition. This results into a cost reduction of the IT environment.

- Utilization increase: higher utilization of available computing power is possible because of virtualization, load balancing across physical systems, and the fact that it is unlikely that all consumers require peek computational resources at the same moment. It is more likely that this demand for computing power will be distributed over the day (Marston et al., 2011). This also leads to a cost reduction, since less electricity and hardware is required.

- Computing democratization: another advantage of cloud computing over traditional in-house computing is that it provides the ability of performing computationally intensive calculations to the smallest companies, whereas before these were only available to the privileged companies that have invested large sums of money into the large-scale infrastructure required for performing these calculations (Marston et al., 2011). This is a leveling of the playing field due to a commoditization of the IT environment (Greengard, 2010).

3.3.1.8 Cloud computing weaknesses and threats

If an organization considers implementing cloud computing solutions, it should keep certain risks, obstacles, challenges, concerns and dangers in mind. In this section the available academic literature is reviewed in order to sum up all these cloud computing weaknesses. These should be part of a (formal) business case when considering / evaluating a cloud computing implementation.

“The biggest impediment to utility computing will not be technological but attitudinal” (Carr, 2005, p.71)

This risk perspective of cloud computing is well described in the literature, due to the attention paid to the topic, as well as experience with previous technologies and services that share similarities with cloud computing, such as outsourcing (Barthélemy, 2003). As a result the following list with factors is identified that need to be kept in mind when making the decision whether or not to implement cloud computing:

(26)

A challenge for organizations is to determine what data, if anything, can move into the cloud. It is important to correctly identify mission critical information and processes, and keep those in-house (Wellman, 2010). This is a balancing act, evaluating the benefits of cloud computing against the security and perception of control with traditional business computing.

A risk of data lock-in exists. Which means that an organization is unable to easily move out of the cloud, or migrate between cloud computing service providers, perhaps due to a lack of a standard interface (Armbrust et al., 2009; European Network and Information Security Agency, 2009). Furthermore, there are no guarantees that all data is adequately deleted from the old systems, since it is difficult to exactly identify the place where all data and systems are located in a highly virtualized environment, such as a cloud.

- Principle-agent problem: there is an incentive for cloud computing providers to increase the profit margins by overloading the system through overselling the service (Durkee, 2010). These competing interests, and the presence of information asymmetry between the stakeholders, leads to a principle-agent problem (Waterman & Meier, 1998). This means that the different parties have conflicting priorities and interests. The provider might want the lowest costs through lowering the quality of service and increasing the price in order to increase the profit margin. Whereas the consumer wants high quality at low cost. The consumer needs to select a provider with the same price versus quality demand and offer proper incentives in order to reduce the chance of a mismatch between the priorities of these stakeholders.

Besides the incentive for providers to increase prices in order to increase the profit margin, there is also a situation possible in which there is unfair billing to either the provider or consumer, or both (Wachs et al., 2011). This is due to inaccurate billing metrics used by cloud computing providers. Because of the inaccuracy of the metrics used to analyze the usage of the cloud computing resources by the individual customers, customers that use the computational resources efficiently get punished because they do not exploit these inaccuracies of the metrics. The inefficient users are rewarded because they exploit these inaccuracies without any financial repercussion. The optimal situation for all stakeholders involved is when the metrics are accurate enough to reflect the true usage of the computational resources by the individual customers.

- Unclear financial impact: as was discussed previously in the literature review in section 3.3, cloud computing might be cheaper compared to traditional in-house corporate computing, but this is not always the case. Research has indicated that if all costs are included over time, the cloud computing solution can even be more expensive in particular situations or for organizations (Spellmann et al., 2009). Before implementing cloud computing in an organization, the cost aspect of the implementation has to be examined in a business case.

- Legal implications: there are issues with data ownership, responsibility and privacy, as well as a lack of clarity with respect to the jurisdiction of the data stored in the cloud, can expose an organization to additional risks (Ward & Sipior, 2010). Organizations are sometimes unaware about their responsibilities when they have outsourced (part of) their IT environment to the cloud.

The jurisdiction of cloud computing is still a challenge for (large) organizations (Ward & Sipior, 2010). It is unclear what jurisdictions apply to the organization and what an organization needs to do in order to comply with the relevant rules and regulations.

(27)

consumer with a discount every period and consider it cost of doing business if they want to keep claiming that they “guarantee” high availability and reliability (Durkee, 2010).

An obstacle for organizations that are not fully migrating to cloud computing is that there are integration risks (Ernst & Young, 2011a), which might require expert knowledge if a new cloud computing system needs to be integrated in the current business processes or legacy systems (Brodie, 1992; Rettig, 2007). - Security and transparency: besides the traditional security threats an organization had to deal with, they

now also have additional security risks that come from inside the provider’s organization. “Cloud computing gives attackers novel abilities; implicitly expanding the attack surface of the victim” (Ristenpart et al., 2009).

There is a lack of transparency on the side of the provider (Durkee, 2010), which makes it difficult for the consumer to trust the provider that they adhere to the agreed upon processes for maintenance, backup and security.

The risks and issues that are summed up in the list above can for the most part be attributed to risks associated with the outsourcing of the IT environment in general. These risks associated with the outsourcing of the IT environment are reflected in the seven deadly sins identified by Barthélemy (2003) and were identified while he was conducting an in-depth analysis of 91 outsourcing efforts made by European and North American firms:

(28)

3.4 Information Technology investment

3.4.1 Introduction

Information Technology, or IT, are all forms of technology to create, store, exchange, and use information (Pearlson & Saunders, 2009). Information Systems, or IS, combine this technology, people and processes within an organization to produce and manage information.

Information systems and its maintenance / management are part of information technology and are important to organizations since they form a large part of an organization’s expenditure (Prahalad & Hamel, 1990; Rettig, 2007). These information systems can bring cost savings through efficiency and automation (Gill, 2011). Furthermore, a well implemented IS can act as a catalyst for innovation and competitive advantage (Prahalad & Hamel, 1990). An IS can enhance an organization’s current capabilities, as well assist an organization in developing new capabilities (Drnevich & Croson, 2013). Valuation of IT investments is a challenging task because they are characterized by high-level uncertainty and rapidly changing conditions (Angelou & Economides, 2008).

During the past two decades there has been a shift (early 1990s) from not being able to recognize organizational benefits (Velcu, 2007) (output, performance, et cetera) from (large) IT investments, to the recognition that IT investments are beneficial to firm’s performance (late 1990s). Later research focused on the timing and causes of the benefits derived from IT investments (Velcu, 2007). Research indicates that high levels of IT investments have had mixed results (Hu & Huang, 2005). According to DeMarco, (2005) IT projects are not achieving goals and are at risk because of inadequate project planning.

Development of the business case for cloud computing