Cloud Governance Framework - Required Cloud Sourcing Capabilities

ICST Transactions
on e-Business Research Article

Transformation to Cloud Services Sourcing: Required IT
Governance Capabilities
Anton Joha1,* and Marijn Janssen2

1
EquaTerra, antonjoha@gmail.com
2
Delft University of Technology, m.f.w.h.a.janssen@tudelft.nl

Abstract

The sourcing of cloud services is a relatively new type of service delivery model in which an organization gets access to IT
services via a cloud service provider that is delivering services over the web to many users on a pay per use or period
basis. Even though the importance of IT governance is often underlined, there is limited literature available regarding the
required IT governance capabilities that public sector organizations need to have in place to successfully implement and
manage a cloud service delivery model. Using an existing governance framework of IT core capabilities as basis, the
required cloud computing capabilities are investigated using interviews and studying reports. The analyses helped to
identify 16 discriminating capabilities that are essential when effectively implementing and managing cloud services in the
public sector. Different factors, including the cloud service and deployment model, the strategic intent underlying cloud
sourcing, the degree and complexity of cloud sourcing and the IT governance structure, were found to influence the
relevance of cloud capabilities and the relevance might also change over time.

Keywords: Cloud computing, Public sector, IT core capabilities, IT governance, Outsourcing, Public sector, Sourcing.

Received on 14 December 2011; accepted on 05 February 2012; published on 05 September 2012

Copyright © 2011 Joha et al., licensed to ICST. This is an open access article distributed under the terms of the
Creative Commons Attribution licence (http://creativecommons.org/licenses/by/3.0/), which permits unlimited use,
distribution and reproduction in any medium so long as the original work is properly cited.

doi: 10.4108/eb.2012.07-09.e4

2011). Often, users pay a certain fee for the use of the
1. Introduction *

software or for a certain period that the software will be
used. Other forms are possible, but the essence of all
Government agencies are in different stages of forms is that no upfront investments are necessary from
development and looking for different ways to improve the user perspective. Cloud service providers host and
their service provisioning, while at the same time trying to provide access to software applications over a network.
reduce their costs due to severe budget cuts (Chen, 2003). This type of sourcing model enables the development of a
One way of restructuring IT and business functions is by service only once and provides it to many users. Within
using cloud computing. A cloud infrastructure consists of the public sector there is an opportunity for a similar shift
application services hosted on a distributed hardware and and there are already some notable and visible examples
providing a one point of access for users from anywhere of cloud services, including the use of office applications
at any time. Clouds can be viewed as a new type of provided by the cloud model and services to citizens
sourcing model in which IT-based services are provided which are hosted in a cloud. In both examples the
over communication networks to users, enabling for faster governmental agencies do not have to develop or maintain
implementation of software changes (Bennet et al., 2001) the services in-house and they rely on the cloud provider.
and allowing to get rid of the own installation, control and Cloud services can be provided by organizations within
maintenance of the IT function (Gonçalves & Ballon, the public sector, but also by private companies residing
outside the public sector, in this way providing at least
*
*Corresponding author. Email: antonjoha@gmail.com two ways of sourcing.

ICST Transactions on e-Business
1 July-September 2012 | Volume 12 | Issues 7-9 | e4

Joha et al.

It is often argued that cloud computing has implications categorized into three main service models (Dillon et al.,
for both businesses and management (Olsen, 2006) and 2010; NIST, 2011c):
cloud computing will change the relationship between • Cloud Software as a Service (SaaS). The public
buyer and seller (Sääksjärvi et al., 2005). Yet, the specific sector organization has access to a provider’s
IT governance capabilities required by public sector applications running on a cloud infrastructure. The
organizations to successfully source and manage cloud public sector does not manage or control the
services have remained unexplored. The goal of this paper underlying cloud infrastructure including network,
is to understand the cloud governance capabilities that are servers, operating systems, storage, or even
required when introducing and implementing a cloud individual application capabilities, with the possible
computing model in the public sector. This paper is exception of limited user-specific application
structured as follows. In the next section, the background configuration settings.
of cloud computing is discussed, including its relationship
with outsourcing and the governance framework of IT • Cloud Platform as a Service (PaaS). The public
core capabilities from Feeny and Willcocks (1998) that is sector organization has the ability to deploy onto the
used as basis to analyze the interviews and cloud infrastructure customized or acquired
documentation. In section three, the research approach is applications created using programming languages
presented, followed by an overview of the cloud and tools supported by the provider. The public
computing activities in the Dutch and US public sector. sector organization does not manage or control the
Section five discusses the findings and conclusions are underlying cloud infrastructure including network,
drawn in section six. servers, operating systems, or storage, but has control
over the deployed applications and possibly
application hosting environment configurations.
2. Background • Cloud Infrastructure as a Service (IaaS). The public
sector organization has access to processing, storage,
2.1. Cloud Computing networks, and other fundamental computing
resources and is able to deploy and run arbitrary
There is no agreement about a definition of clouds, software, which can include operating systems and
though there are some characteristics that are more or less applications. The public sector organization does not
agreed. These are that clouds offer resources on demand manage or control the underlying cloud infrastructure
(Rosenthal et al., 2010) from which application services but has control over operating systems, storage,
can be accessed over a network (Buyya et al., 2009). In deployed applications, and limited control of select
most clouds charges are paid per use, but there is no networking components.
consensus about this characteristic. Rosenthal et al. (2010) The cloud deployment model concerns the specific cloud
provide a set of features of cloud computing. Janssen and environment that is used to deliver cloud services to the
Joha (2010) add two additional characteristics based on users. Four deployment models are generally
the idea that a cloud is a distributed system that is distinguished in the literature (Dillon et al., 2010; Kundra,
presented as one infrastructure that provides services 2011; NIST, 2011c). A private outsourced cloud is a
based on service level agreements. These characteristics closed environment for a single organization hosted by a
are: third party, while a private in-house cloud is hosted
(1) Resource outsourcing internally (Kundra, 2011). A public cloud is owned by a
(2) Utility computing SaaS service provider that makes it available to the
(3) Large number of (inexpensive) machines general public, while a community cloud is shared by
(4) Automated resource management several organizations with common policies,
(5) Virtualization requirements, values, and concerns and can either be
(6) Parallel computing hosted externally by a third party or in-house (Dillon et
(7) Data access control al., 2010). Hybrid clouds can consist of combinations of
(8) Service level agreements the other cloud models. It is postulated that the different
A cloud consists of large farms of inexpensive servers forms and deployment models of cloud services will have
which are distributed over several locations. The basic an influence on the cloud capabilities that are required.
idea of the use of clouds is to shift the responsibility to
install and maintain hardware and basic computational
services away from the user to the cloud vendor 2.2. Clouds and Sourcing
(Rosenthal et al., 2010). The cloud vendor should ensure
security, scalability, availability, reliability and data Whereas there is relatively limited research literature
access control mechanisms. In a cloud there is a dedicated about cloud computing, there is a wealth of literature on
pool of hardware and virtualization software that can be outsourcing (Gonzalez et al., 2006; Lee et al., 2003). IT
used to support a variety of tasks and provide services to outsourcing is about the contracting out of certain IT
the cloud participants. Cloud computing can be functions to an external service provider that in return


Transformation to Cloud Services Sourcing: Required IT Governance Capabilities

provides the service for a certain period of time and for a area, (2) the technical area, (3) the business area and (4)
certain amount of money (Willcocks & Kern, 1998). the supply area. In the governance area, the role of IT
Business Process Outsourcing (BPO) is the situation in within the business is defined, combined with the
which a supplier takes over responsibility for one or more responsibilities of the IT department, the business
of an organization’s business processes (Borman, 2006). departments and the IT service providers in achieving that
Outsourcing arrangements address the relationship role, while the technical area is concerned with ensuring
between one client having one or more external vendors, that the business has access to the technical capability it
and in case a private cloud model is used, this is also the needs in order to translate the business requests and
case with sourcing cloud services. In case of a community requirements into IT specifications (Feeny & Willcocks,
or public cloud however, the arrangement generally 1998). The business area is about demand management
consists of many clients and one cloud vendor. Cloud and involves defining the business requirements in order
computing can thus be viewed as a type of sourcing to address the need for alignment between business and
arrangement, in which the cloud service providers can be technology. The supply area, finally, is about managing
viewed as a specific type of provider. There are various and monitoring the supplier in order to assure they deliver
ways of sourcing like inside or outside the public sector the required quality of the IT services.
and sourcing requires the use of capabilities for managing Feeny and Willcocks (1998) initially found nine
sourcing arrangements (Borman, 2006; Feeny & capabilities that enable a business to consistently address
Willcocks, 1998). the described four areas in order to exploit IT
successfully, now and in the future. In a later article to
validate the model, Willcocks et al. (2006) also found a
2.3. Governance Framework of IT Core tenth capability, IT project management, though no
Capabilities explicit definition similar to the other capabilities was
provided. These ten capabilities and their definitions are
Decisions about and around an (out)sourcing transitions depicted in table 1.
are part of a much broader framework called IT
governance. IT governance refers to the “patterns of
authority for key IT activities” (Sambamurthy & Zmud, Table 1. Governance Framework of IT Core
1999, p. 261) and IT governance mechanisms determine Capabilities (Feeny & Willcocks, 1998; Willcocks et
how communication, responsibilities and decision-making al., 2006)
structures are formalized (Weill & Ross, 2005). Important
attributes of IT governance are the roles and
responsibilities of the different actors involved (Weill and IT core Definitions (Feeny and
Ross, 2005) and the related capabilities that are core to the capabilities Willcocks, 1998)
business' future capacity to exploit and govern the 1) Leadership Integrating IS/IT effort with
demand and supply of IT successfully (Feeny & business purpose and activity
Willcocks, 1998; Mayer & Salomon, 2006). 2) Business Envisioning the business
Sourcing requires that that the end-user organization has systems process that technology makes
the necessary IT core capabilities to implement and thinking possible
manage the sourcing arrangement. The provider is at an 3) Relationship Getting the business
arm’s length which requires other capabilities than when building constructively engaged in IS/IT
having an own IT department. The IT core capability issues
concept is defined by Feeny and Willcocks (1998) and 4) Architecture Creating the coherent blueprint
planning for a technical platform that
their IT governance framework has been successfully
responds to current and future
verified in a couple of consecutive articles (Willcocks & business needs
Feeny, 2006; Willcocks et al., 2006). Willcocks and 5) Making Rapidly achieving technical
Feeny (2006, [p. 49]) define a capability as ‘a distinctive technology progress, by one means or
set of human resource–based skills, orientations, attitudes, work another.
motivations, and behaviors that have the potential, in 6) Informed Managing the IS/IT sourcing
suitable contexts, to contribute to achieving specific buying strategy that meets the
activities and influencing business performance’. interests of the business
Following Willcocks and Feeny (2006) we define a cloud 7) Contract Ensuring the success of
governance capability is a capability to effectively facilitation existing contracts for IS/IT
manage and govern the sourcing of cloud services, services
8) Contract Protecting the business'
measurable in terms of IT activities supported, and
monitoring contractual position, current
resulting business performance. and future
Feeny and Willcocks (1998) view IT capabilities as core 9) Vendor Identifying the potential added
to the business's future capacity to exploit IT successfully. development value of IS/IT service suppliers
Four main areas are defined that a company must 10) IT Project This capability was included in
successfully address over time: (1) the IT governance management a later paper (Willcocks et al.,


Joha et al.

2006). 4. Clouds Sourcing in the Public Sector
The Dutch cloud strategy was driven by the cloud
These ten capabilities are viewed from the perspective of strategies in the US. Both the Dutch and the US public
the end-user organization and not from the supplier sector consist of many organizations that have IT
perspective. In other research (Feeny et al., 2005; Lacity environments that can be characterized as difficult to
et al., 2006a; Lacity et al., 2006b) similar kinds of manage, heterogeneous, with duplicative systems with
frameworks have been defined with the capabilities low asset utilization, negatively impacting its ability to
relevant to outsourcing service providers. serve its citizens. There are several big public
organizations having large data centers and many small
organizations that find it hard to manage their IT services
3. Research Methodology and resources. The US government developed a decision
framework that was created to support agencies in
The research conducted in this paper has an explorative- migrating towards cloud services such as cloud-based
descriptive nature. Our goal is to develop an SaaS, PaaS and IaaS. The revenue model proposed was
understanding of the IT governance capabilities required based on the idea that users will only pay for the IT
for public sector organizations that want to successfully resources they consume, and would be able to increase or
implement and manage cloud services. This research decrease their usage to match their requirements and
takes the governance framework of IT core capabilities by potential budget constraints. Following the publication of
Feeny and Willcocks (1998) as a starting point, extending this strategy, each agency was required to re-evaluate its
and refining it for cloud computing. This model is useful technology sourcing strategy to assess the use and
as it finds its roots in outsourcing relationships and cloud implementation of cloud-based technology and
computing can be viewed as a type of sourcing application solutions as part of the budget process
arrangement, in which the cloud providers can be viewed (Kundra, 2011). In the Netherlands it was recently
as a specific type of outsourcing provider. Exploratory decided to create a public cloud infrastructure. The
research was chosen due to the need to investigate and rationale is based on the reduction of the 61 data centres
explore the IT governance capabilities required by public and the lowering of energy consumption which accounts
sector organizations for cloud computing arrangements. for 15 million annually (Hillenaar, 2010).
Interviews were conducted within the Dutch government
and these were complemented by studying international 5. Analysis and Discussion
case study reports and documents. Interviews allowed us
to explore and in-depth discuss the concept of cloud
computing, in this way creating a better understanding of 5.1. Cloud Governance Capabilities
the possible challenges and the required capabilities when
adopting and managing cloud services in the public Feeny and Willcocks’ (1998) governance framework of
sector. Thirteen interviews were conducted using open- IT core capabilities was used to identify the capabilities
ended questions, informed in many ways by our that are core for the implementation of a cloud computing
understanding of cloud services and outsourcing as service delivery model for the public sector. Table 2
presented in the background of this paper. The interviews shows each of the 10 IT core capabilities and how they
lasted between one and two and a half hours and the relate to the 16 identified cloud governance capabilities
interviewees included Dutch IT-managers, outsourcing that are required when sourcing and managing cloud
specialists, outsourcing and cloud decision-makers and services. The table also shows the typical role(s) involved
IT-experts from a variety of public organizations, in executing each cloud capability, as this was an
including the tax authority, social security agency, important indicator to identify the discriminating cloud
Ministry of the Interior and Kingdom Relations, capabilities. The relationship between a role and an
municipality association and two municipalities. In this individual can be clarified as follows:
way, a broad range of organizations and views were • One role can be fulfilled by one or more individuals;
covered. Interviewees covered persons in organizations • One individual can fulfill one or more roles.
that were already using cloud services as well as those
who are considering the use of cloud computing or did not
decide to use it.

Table 2. Identified IT Governance Capabilities for Sourcing Cloud Services



Redefined and Clarification of the IT governance capabilities for sourcing Typical
extended IT cloud services role(s)
IT core governance involved in
capabilities as capabilities for executing
defined by sourcing cloud each cloud
Feeny and services capability
Willcocks (1998)

1) Leadership 1) Cloud Defining the overall federal IT governance and strategy in terms Federal CIO,
Leadership of the organizational structures, the processes and the staffing agency
relevant to the cloud services, in order to address all the main executive
activities in the business, technical and supply areas and to
manage all potential (inter)dependencies between these areas.
2) Business 2) Cloud Defining the decentralized business strategy and the translation Business unit
systems Business of that strategy to a cloud strategy, where choices have to be CIO/manager,
thinking Strategy and made about the role and the priority of cloud services within the Head of IT
Policy organization, including the make or buy decision about sourcing
cloud services.
3) Relationship 3) Demand Defining business functionality and its dependencies, including Information
building Management the translation to IT/cloud specifications, demand forecasting manager
and interfacing with the end users.
4) Relationship Providing a single point of contact through which the business Relationship
Management organization can ensure that problems and conflicts are manager
resolved fairly and promptly, within a framework of agreements
and relationships.
4) Architecture 5) Architectural Creating the coherent blueprint for a technical cloud platform Infrastructure
planning Design and that responds to current and future business needs and architect
Standards maintaining the technical consistency and standards between
cloud information systems.
6) Data Ensuring data security, privacy, compliance, portability and Data
Security interoperability. architect,
Management cloud security
specialist
7) Application Responsible for software design, coding, testing and Cloud
Lifecycle configuration of customized cloud business applications, but application
Management also for cloud application maintenance and application developer
upgrades
5) Making 8) IT Network Given that the Internet and intranet are the main ways to Network
technology Management access cloud application services, the IT network management specialist,
work capability needs to ensure that potential network problems can infrastructure
be rapidly fixed. manager
6) Informed 9) IT/Cloud Tracking cloud market developments and suppliers and leading IT/cloud
buying Procurement the selection process for cloud services including negotiating procurement
about procurement terms and conditions with suppliers. officer
10) Risk and Monitoring and auditing potential risk/compliance issues Risk officer,
Compliance involved in sourcing cloud services. auditor
Management
11) Legal Providing support when entering into (new) agreements with Legal advisor
Expertise cloud service providers and making changes to existing
contracts, including handling all legal issues related to clouds.
7) Contract 12) User Support Providing support to users by means of training and by a (self) Service desk
facilitation service desk. employee
8) Contract 13) Contract Ensuring contractual compliance by the cloud providers on Contract
monitoring Management strategic and tactical level and managing any required contract manager
modifications, taking into account all the relevant aspects
including financial, legal, technical and business dimensions.
14) Service Managing the performance of the service delivery on tactical Service
Management and operational level as specified in the contractual manager
performance metrics, including performance management and
maintenance of the cloud service catalogue.
15) Financial Tracking, monitoring and reporting on the IT budget and Financial
Control ensuring that the cloud services meet the committed and controller
predefined financial goals.
9) Vendor The ‘vendor development’ capability was not distinguished as a


Joha et al.

development specific capability or role. Creating added value happens at
each level and role of the supply area and this specific
capability can be incorporated within all the other capabilities.
10) IT Project 16) IT Project Managing a project or a portfolio of multiple ongoing inter- Project /
Management and Portfolio dependent cloud projects that are executed internally and/or by program
Management cloud providers. manager

Five capabilities in Feeny and Willcocks’ framework the cloud service provider. Interviewed governmental
could almost be individually translated to the cloud representatives mentioned that this would enable
domain, though they needed some refinement, both in governments to better keep control over their privacy
terms of the terminology used for the capability as well as sensitive data, avoid potential security problems, ensure
for the definitions. In four instances, the capabilities authorization, identification and encryption, and to avoid
defined by Feeny and Willcocks (1998) have been split legislation and regulation risks by outsourcing this to a
into 2 or more different capabilities because of the special third party and nevertheless gain advantages of this
importance of these capabilities for cloud computing and development.
because of the distinct and different nature of these Agencies could bypass the federal or internal IT
capabilities in terms of roles. One capability in Feeny and department to acquire their own cloud services, which
Willcocks’ framework, vendor development, was not could create difficulties in data integration or service
distinguished as a specific capability or role. This interoperability in the future within the public sector and
capability is meant to ensure that added value is created therefore overall policy standards and guidelines need to
by IT outsourcing, but creating added value happens at be defined. The policy needs to be followed by agencies
each level and role of the supply area and this specific to ensure that the agencies comply to regulatory or legal
capability can therefore be incorporated within all the requirements, to enforce organization-wide consistency
other individual capabilities within the supply area. In the and to make sure that the agencies have guidelines in case
part hereafter the capabilities are discussed in more detail. they want to use cloud services. As such, the US
government published a federal cloud computing strategy,
Cloud Leadership providing a decision framework to support agencies in
Cloud leadership is about defining the overall federal migrating towards services such as cloud-based SaaS,
IT/cloud governance and strategy in terms of the PaaS and IaaS (Kundra, 2011).
organizational structures, the processes and the staffing, in
order to address all the main activities in the business, Demand Management
technical and supply areas and to manage all potential The demand management capability facilitates the
(inter)dependencies between these areas. It also includes dialogue between the business and the IT department
creating organization-wide support and strategic regarding cloud services and is responsible for defining
stakeholder management for implementing cloud services. the functional requirements with regard to the cloud
Interviewees indicated that the choice for cloud solution. The defined cloud policy has to be translated
computing is a decision that has a long-term and strategic into cloud functionality and the underlying specifications
impact, requiring significant organizational changes in and service levels with regard to the cloud services have
order to adopt and manage this new service delivery to be defined. This capability also includes demand
model. The US federal government created a 25-point forecast for the expected consumption and use of cloud
federal IT reform plan to address their new IT strategy, in services by the agencies, ensuring alignment with
which cloud computing was an important element corporate IT, controlling the decentralized cloud budget
(Kundra, 2010). and monitoring local cloud SLAs. Agencies could have
the possibility to directly buy services from the cloud
Cloud Business Strategy and Policy provider by means of a service catalogue, which is a
This capability is concerned with defining, integrating and document listing the portfolio of possible cloud services
aligning the business objectives with IT/cloud capability. that the agencies can buy from the cloud service
The overall business strategy from all of the decentralized provider(s) supported by the cloud outsourcing contract.
governmental agencies has to be translated to a cloud
strategy, resulting in an information policy, which takes Relationship Management
into account all the requirements and potential This capability involves managing the requirements and
(im)possibilities of the cloud solution. This also includes problems within the business units with regard to the
defining the sourcing strategy in terms of the decision to cloud services. Relationship management provides a
outsource or not and all the relevant strategic choices single point of contact through which the business
related to this decision including which cloud deployment organization can ensure that problems and conflicts are
models can be used. Although clouds can be outsourced resolved fairly and promptly, within a framework of
to a service provider, clouds can also be operated as agreements and relationships. It involves also handling
internal arrangements within the government. In such a requests from decentralized entities for action on issues
construction the internal IT department will function as that range from minor questions to very significant crises,



being the focal point of contact for business managers, processes to integrate cloud applications; defining
facilitating people relationships and devising processes processes and criteria for granting exceptions to the cloud
for conflict resolutions regarding the cloud delivery applications standards and defining architecture
model. components and interfaces based on application
architectural standards with regard to cloud computing.
Architectural Design and Standards
Through insight into technology, cloud service providers IT Network Management
and the requirements from agencies, the architectural In cloud computing, it is essential that the network
design and standards capability is about the development capacity is meeting the required standards as the Internet
of the vision of an appropriate technical cloud platform. and intranet are the main ways to access cloud application
Without such planning, the organization could end up services. IT network management is about ensuring the
with independent systems that might result in redundancy, quality of the network and local or remote servers. The
gaps between systems or the inability to integrate cloud cloud infrastructure should have the necessary capacity
systems. Cloud standards need to be determined with and processing power at all times. This network capability
regard to the technical platforms, e.g. networks, protocols, could be outsourced, but it was suggested by interviewees
resilience. Questions about standardization, security of the that it is important that potential network problems can be
architecture, the necessary flexibility and the integration rapidly fixed and to retain parts of this capability in-
with other components need to be addressed, but also the house. The main risk is that increasingly less operational
implications for the people using the technology. In the technology knowledge seems to be necessary in cloud
US federal government a lot of attention is paid to arrangements, while the dependency on the service
standards (NIST, 2011b) and there is a central group providers is increasing. The network dependency is also
involved with standards management responsible for recognized as such by the National Institute of Standards
establishing a framework and roadmap to define standards and Technology (NIST, 2011a) recommending that the
facilitating interoperability, portability and security of traditional IT skills required to manage devices that
cloud services. access the private cloud need to be retained, also for
managing special hardware or system requirements and
Data Security Management unique security needs for special projects.
The data security management capability involves setting
enterprise level data requirements regarding security, IT/Cloud Procurement
privacy and compliancy and enforcing policies for IT/Cloud procurement is responsible for analyzing the
protecting sensitive corporate and customer data from cloud service providers and leading the procurement
being shared, including managing all forms of virus process for the selection of a cloud provider till the
prevention and detection relative to public cloud services moment the contract has been signed. This includes
This also comprises the development of a framework for managing the Request for Proposal (RFP) process, which
sharing user identities and providing user access to includes the collection and verification of equipment and
sensitive data, including conditions under which service component requirements and SLA specifications,
providers, third parties and government agencies may development of the RFP, evaluation of the responses and
have access to the company’s data. The framework should giving recommendations for supplier selection to the
include authentication, authorization and use of physical agencies.
devices like digital signatures, encryption, social barriers, This also includes the responsibility for assuring that the
and monitoring by humans and automated systems. The cloud procurement is completed within the predefined
framework should be audited and updated regularly to timeframe and meets the identified cost objectives as well
address changing technology and service delivery as continuously analyzing the external cloud services
mechanisms. In the federal US government a central market.
security department was set up in order to identify,
aggregate, and disseminate security, privacy and Risk and Compliance Management
compliance issues, solutions and processes that could This capability needs to ensure that potential regulatory
impact the adoption and implementation of cloud and compliance risks are identified and also needs to
services. continuously confirm that the assurance methods adopted
by service providers are evolving to include, in addition to
Application Lifecycle Management SAS 70, the new Service Organization Controls (SOC)
Application lifecycle management is responsible for reporting model and other cloud security certifications.
software design, coding, testing and configuration of The cloud infrastructure should be secure and reliable.
customized business applications, but also for application Although contractually this might be arranged, public
maintenance and application upgrades. Activities include organizations do not want to be confronted with problems.
monitoring emerging cloud technologies and leading the Therefore regular audits, either internally by a separate
investigation and adaptation of new cloud application department, or externally, are necessary to determine if
technology, documenting the existing cloud application the cloud vendor’s infrastructure and support is compliant
architecture portfolio, setting formal policies and to the contract. These audits need to be part of risk and


Joha et al.

compliance management. Security policies, but also Contract management is about ensuring contractual
backup, recovery and contingency procedures and plans compliance by the cloud provider(s) on strategic and
should be regularly evaluated to account for potential tactical level and managing any required contract
cloud provider failure. Interviewees were suggesting that modifications, taking into account all the relevant aspects
clear agreements about data ownership need to be made including financial, legal, technical and business
including what will happen in case a SaaS provider goes dimensions. This includes contract administration,
bankrupt, is taken over by another company, or is monitoring compliance with terms and conditions, review
changing its strategic orientation and vision. and revision of contract changes, supplier negotiation and
The interviewees were very reluctant to move to a cloud contract interpretation for dispute resolution. Long term
model on a large scale without any assurances, because of sustainability is a key issue, as the bankruptcy or other
the dependency on the cloud provider, and as part of the problems of the cloud vendor could jeopardize certain
risk process, a careful migration strategy was therefore business operations. Data might simply not be available
suggested. The interviewees argued that applications and anymore in specific circumstances.
information that are of particular importance must initially The interviewees considered good contracts to be
be retained in-house and run on the own IT system, but essential, as this is an important instrument to avoid the
can be maintained by the cloud providers. In case of risks and accomplish the benefits of cloud computing.
dissatisfaction with what comes as part of the package Contracts are more complicated as it should be flexible
with the cloud provider, those applications can and demands instant scaling up based on pay per use on
immediately be taken over by the own staff. This means the one hand, whereas on the other hand long-term
less risks, but higher retained software costs for the client sustainability, software access and information storage
than may have been initially assumed, and those costs requirements need to be met. These short term and long
should be understood and be part of the initial business term interests might be conflicting, as the cloud provider
case justifying the use of cloud services. might require some kind of payment of longer term
commitments are part of the contract. Effective contract
Legal Expertise monitoring means holding suppliers to account on both
Legal expertise provides support when entering into (new) existing service contracts and the developing performance
agreements with cloud service providers and making standards of the services market. This includes developing
changes to existing contracts. Out of the interviews, it service level measures and service level reports,
became clear that the location of storage is an issue, as specifying escalation procedures and cash penalties for
Dutch governments often require that data will be stored non-performance (Kern and Willcocks, 2001).
within the Netherlands to ensure that the Dutch law will
be in effect to the SaaS providers. It is likely that new Service Management
agencies or authorities are required to verify and control The service management capability involves managing
that data does not cross national boundaries and that the performance of the service delivery on a tactical and
licenses are legal. In general the contract needs to take operational level as specified in the contractual
into account issues regarding data protection and performance metrics, including performance management
regulatory compliance, intellectual property concerns and and maintenance of the service catalogue, to ensure that
contingency in the event of business discontinuity caused performance targets continue to be met, users remain
by the service provider. Also the risks of non-performance satisfied, the expected service levels continue to be
and potential exit scenarios need to be contractually achieved and the services continue to be performed and
defined. delivered in the expected manner. This includes
monitoring, reviewing, managing, changing and reporting
User Support on all cloud service levels. The cloud provider is normally
Interviewees indicated that as cloud services are based on able to retrieve information regarding SLA compliance,
a hosted delivery model, users may find they do not have usage levels, account activity, etc. Further activities
access to the same level of service and support they would include, but are not limited to, ensuring that the cloud
get from their internal IT group or would get in an performance review system and the SLA metrics are
outsourcing arrangement. As such a (self) service desk maintained to be relevant to the outsourcing contract,
needs to be in place for any user support. Supporting and applying service level penalties if the cloud supplier
training users on new functionality delivered via the more performs below the service credit threshold and approving
frequent upgrades enabled by the cloud model requires change requirements.
skilled resources, but not all cloud providers will offer the
level of support required to meet end-user needs, Financial Control
especially during initial implementation efforts. As a Financial control is about tracking, monitoring and
result, public sector organizations must account, plan and reporting on the IT/cloud budget and ensuring that the
budget for all required support requirements. outsourced services meet the committed and predefined
financial goals. Relevant activities include directing and
Contract Management coordinating the organization’s financial IT planning and
IT/cloud budget management functions, recommending



benchmarks for measuring the financial and operating resources and team members. When implementing cloud
performance of the cloud supplier, monitoring the overall services also the (inter)dependencies with other IT/cloud
cost of the cloud contract, preparing financial analysis for projects need to be taken into account, managing multiple
contract negotiations with the cloud supplier, and projects as a portfolio. This capability was initially not
coordinating with the contract administration for payment included in Feeny and Willcocks’ IT capability
procedures and budget procedures related to the delivered framework as they considered project management not as
cloud services. a specific IT core capability but as an organizational one.
When verifying their model however, they also found this
IT Project and Portfolio Management capability to be distinctive to the IT function (Willcocks
IT project management is the application of knowledge, et al., 2006).
skills, tools, and techniques to plan and execute IT project Based on the analysis in the former section, Feeny and
activities that meet the predefined objectives in terms of Willcocks’ capability model could be refined and
planning, cost and quality (Project Management Institute, extended for cloud computing. In Figure 1, the sixteen
2000). Especially for cloud computing services, the distinguished cloud governance capabilities have been
transition and migration strategy and activities have been plotted within the governance, business, technical and
recognized as very important by the interviewees. This supply area.
capability includes identifying and planning project
activities, minimizing risk and managing the project, the

Figure 1. Cloud Governance Capability Model (based on Feeny & Willcocks, 1998; Willcocks et al., 2006)

Several interviewees mentioned that uncoordinated first and experiment on a small scale, the intricacies and
adoption and not having the appropriate capabilities in expertise needed could be discovered.
place could undercut the financial benefits of cloud
computing, and severely increase the risks. They indicated 5.2. Relevance of the Cloud Capabilities
the need to first find out which capabilities are required
and ensuring that investments can be made and Determining the relevance of the different capabilities is
organizational structures and routines are in place before important in order to determine which and how many
the cloud model can be used on a large scale. By individuals can fulfill the role involved in executing the
developing and implementing the required capabilities


Joha et al.

respective capability. When the relevance of a certain The need to manage an outsourcing arrangement increases
capability increases, it implies that either a higher quality proportionally with the degree of outsourcing in terms of
of the individual fulfilling that capability is required, or the size of the outsourcing deal(s) (Barthélemy, 2001;
that more individuals are necessary to fulfill that specific Kern & Willcocks, 2001). The more clouds have been
capability. When the relevance of a capability decreases, outsourced to multiple vendors and the higher the contract
it implies that this capability might be integrated with value, the higher the costs will be to transition the cloud
other related capabilities so that one individual can fulfill activities to a new supplier or to insource the activities
a role that covers multiple capabilities. There are different again. This implies that more control is needed, not only
factors identified that influence the relevance of the from contract management, service management and
capabilities in some way or another and these will be financial control, but also from the capabilities in the
discussed in the following paragraphs. governance area to mitigate the risks as much as possible.
When the variety and number of cloud projects increase,
Cloud Service and Deployment Model so will the complexity of the relationship with the cloud
The capabilities in the governance area were found to be vendor(s). An increase of complexity might well result in
relevant for all cloud service models. Leadership is an increase of the number of hierarchical levels and
required for all cloud implementations, and so is the IT requires further standardization of procedures (Kern &
project and portfolio management capability to Willcocks, 2001). The governance capabilities become
successfully implement the cloud solution taking into more important, because the organizational structures,
account all the (inter)dependencies. Legal expertise and processes and procedures need to become formalized and
risk and compliance management need to be in place in standardized as much as possible to improve the
order to ensure that as many legal and compliancy risks coordination. The technical area will also rise in relevance
are mitigated and minimized. The capabilities within the as the responsibility to provide the expertise for the
technical domain are more important in IaaS and PaaS technical standardization and integration of the different
arrangements than in SaaS arrangements, as the cloud cloud activities is within this area. It was suggested that
provider will be having more technical responsibilities in also in case of only in-house clouds, all 16 capabilities are
SaaS arrangements. The importance of the capabilities required, as public organizations will increasingly have to
within the supply area will therefore however increase in develop and professionalize their own internal
SaaS arrangements because of the increased dependency organization in such as way as if they would interact with
on the service provider. Also the capabilities within the the external market.
business area are more important in SaaS arrangements
given the critical business nature of the applications. IT Governance Structure
There are also differences between the control and An important organizational factor is whether the IT
capabilities required for private and public clouds, as in governance structure is centralized, decentralized or
the latter case there will be an increased emphasis on the federated, which was also found by Earl et al. (1996) and
capabilities within the supply area given the decreased Sambamurthy and Zmud (1999). In case of a centralized
control over a public cloud. IT governance structure, the capabilities in the technical
and supply area become more important as there will
Strategic Intent Underlying Cloud Sourcing typically be a focus on increasing standardization and
The strategic intent underlying cloud sourcing refers to efficiency. In case there is a decentralized IT governance
the benefits that are sought to be achieved by introducing structure, the capabilities in the business area will become
and implementing cloud services. In the US federal more important, as the IT function will be mainly
government all participating agencies can prioritize one or controlled by the decentralized business entities which are
more different strategic intents and according to their responsible for defining the cloud strategy and their
individual requirements, an appropriate cloud solution can specific cloud requirements. In a federated IT governance
be provided. In case the main focus is on cost reductions structure the control over the IT function is divided
and/or cost savings, the importance of the supply between central and decentral units, increasing the need
management capabilities such as financial control and for strong leadership and coordination (Hodgkinson,
contract management will increase to ensure that costs 1996). As such, the capabilities in the governance area
will be properly managed and the expected cost savings will increase in importance.
and reductions will be achieved.
In case the main focus is to improve the services to the
business by delivering more precisely on changing 5.3. Differences with regular IT Outsourcing
business requirements, the importance of the capabilities
within the business area will increase, as the functional There are several differences between the capabilities
requirements from a business perspective will have to be required for regular IT outsourcing services compared to
defined and translated to an appropriate cloud solution. those relevant for cloud sourcing. Given the dependency
on the service provider and that there are other risks
Degree and Complexity of Cloud Sourcing involved than in normal outsourcing arrangements, risk
and compliancy management and legal expertise are



important capabilities for cloud arrangements. These
risks, including security and privacy risks, also need to be Several interviewees indicated that uncoordinated
taken into consideration in the technical dimension with adoption of cloud computing and not having the required
additional capabilities such as data security management capabilities in place could increase the risks and undercut
and application lifecycle management. Some interviewees the financial benefits of cloud computing. As such,
indicated that cloud computing is changing the nature of governments need to adopt these capabilities when
the organization, providing more decentralized power to transforming their operations to cloud computing.
the business users and therefore also making the business Feeny and Willcocks’ governance framework of IT core
capabilities more important than in regular outsourcing capabilities framework was found to be appropriate to
arrangements. Because of this shift, it was also suggested customize it for cloud computing. Therefore we argue that
that certain capabilities within the supply domain, e.g. in general this framework will be useful as a starting
contract and service management, though relevant, were point, but further customization and detailing might be
less demanding roles than within regular outsourcing necessary to adopt it for a specific domain.
arrangements. Another important remark is that at some The analyses show that that there are differences between
point the cloud market will become more mature and the capabilities required for cloud services compared to
standardized in terms of legal contracts, security and those required for regular IT outsourcing services relating
compliance standards and that certain capabilities will to the fact that there are more uncertainties and risks
become less relevant over time when industry standards involved in cloud computing that need to be properly
and best practices become available. mitigated. Moreover, it was found that different factors
influence the importance of each of the cloud capabilities,
including the cloud service and deployment model, the
6. Conclusion strategic intent underlying cloud sourcing, the degree and
A cloud governance capability can be defined as a complexity of cloud sourcing and the IT governance
capability to effectively manage and govern the sourcing structure. The importance of the capabilities can also
of cloud services, measurable in terms of IT activities change over time.
supported, and resulting business performance. Different As the market for cloud services is still in its infancy and
core capabilities were required to manage the internal is expected to significantly evolve over the coming years,
cloud computing demand management process and the there are no best practices yet providing a definitive list of
external cloud service provider(s). These capabilities can required governance capabilities to manage cloud
be used by strategists and policy-makers to stimulate the arrangements and as such this model will need further
developments of capabilities needed by organizations to verification. Further quantitative research into the factors
manage their cloud providers. influencing the relevance and quality of these capabilities
Even though the importance of IT governance is often would also be of interest, including the question if, and to
underlined, there is very limited research literature what extent, the identified cloud governance capabilities
available regarding the required IT governance are different for private sector organizations.
capabilities that public sector organizations need to have
into place to successfully implement a cloud service
delivery model. This paper fills that gap by identifying the
IT governance capabilities that are required when References
introducing and implementing a cloud service delivery
model. Using the governance framework of IT core Barthélemy, Jérôme (2001). The Hidden Costs of IT
capabilities by Feeny and Willcocks (1998), 16 core cloud Outsourcing. Sloan Management Review, 42(3), 60-69.
capabilities are identified. These are: Bennet, K. H., Munro, M., Gold, N., Layzell, P. J., Budgen, D.
1) Cloud Leadership & Brereton, O. P. (2001). An Architectural Model for
Service-Based Software with Ultra-Rapid Evolution. Paper
2) Cloud Business Strategy and Policy
presented at the Proceedings of the 17th IEEE
3) Demand Management International Conference on Software Maintenance
4) Relationship Management (ICSM'01) Florence.
5) Architectural Design and Standards Borman, M. (2006). Applying multiple perspectives to the BPO
6) Data Security Management decision: a case study of call centres in Australia. Journal
7) Application Lifecycle Management of Information Technology, 21(2), 99-115.
8) IT Network Management Buyya, R., Yeo, C. S., Venugopal, S., Broberg, J. & Brandi, I.
9) IT/Cloud Procurement (2009). Cloud computing and emerging IT platforms:
10) Risk and Compliance Management Vision, hype, and reality for delivering computing as the
5th utility. Future Generation Computer Systems, 25(6),
11) Legal Expertise
599-616.
12) User Support Chen, H. (2003). Digital Government: technologies and
13) Contract Management practices. Decision Support Systems, 34(3), 223-227.
14) Financial Control Dillon, T., Wu, C. & Chang, E. (2010). Cloud computing: issues
15) Service Management and challenges. Paper presented at the 24th IEEE
16) IT Project and Portfolio Management International Conference on Advanced Information


Joha et al.

Networking and Applications. Retrieved Mayer, K. J. & Salomon, R. (2006). Capabilities, contractual
from http://xml.ice.ntnu.edu.tw/JSPWiki/attach/Focusardi/ hazards, and governance: Integrating resource-based and
Cloud%20Computing%20Issues%20and%20Challenges.p transaction cost perspectives. Academy of Management
df Journal, 49(5), 942-959.
Earl, Michael J., Edwards, Brian & Feeny, David F. (1996). NIST. (2011a). Draft Cloud Computing Synopsis and
Configuring the IS function in Complex Organizations. In: Recommendations. Retrieved 5 November, 2011,
Earl, Michael J., Information Management: the from http://csrc.nist.gov/publications/drafts/800-
Organizational Dimension, Oxford University Press. 146/Draft-NIST-SP800-146.pdf
Feeny, D. F., Lacity, M. & Willcocks, L. P. (2005). Taking the NIST. (2011b). NIST Cloud Computing Standards Roadmap.
Measure of Outsourcing Providers: Successful outsourcing Retrieved 5 November, 2011,
of back office business functions requires knowing not from http://collaborate.nist.gov/twiki-cloud-
only your company’s needs but also the 12 core computing/pub/CloudComputing/StandardsRoadmap/NIS
capabilities that are key criteria for screening suppliers. T_SP_500-291_Jul5A.pdf
Sloan Management Review, 46(3), 41-49. NIST. (2011c). The NIST Definition of Cloud Computing.
Feeny, D. & Willcocks, L. P. (1998). Core IS Capabilities fo Retrieved 5 November, 2011,
Exploiting Information Technology. Sloan Management from http://csrc.nist.gov/publications/nistpubs/800-
Review, 39(3), 9-21. 145/SP800-145.pdf
Gonçalves, V. & Ballon, P. (2011). Adding value to the Olsen, E. R. (2006). Transitioning to Software as a Service:
network: Mobile operators’ experiments with Software-as- Realigning Software Engineering Practices with the New
a-Service and Platform-as-a-Service models. Telematics Business Model. Paper presented at the IEEE International
and Informatics, 28(1), 12-21. Conference onService Operations and Logistics, and
Gonzalez, R., Gasco, J. & Llopis, J. (2006). Information systems Informatics, 2006 (SOLI '06).
outsourcing: A literature analysis. Information & Project Management Institute (2000). A Guide to the Project
Management, 43, 821-834. Management Body of Knowledge (PMBOK guide). Project
Hillenaar, M. (2010). Rationalisering en groen om ICT kosten te Management Institute, USA.
besparen. Retrieved 11 November, 2011, Rosenthal, A., Mork, P., Li, M. H., Stanford, J., Koester, D. &
from http://www.ratioconsultants.nl/?p=979 Reynolds, P. (2010). Cloud computing: A new business
Hodgkinson, Stephen L. (1996). The Role of the Corporate IT paradigm for biomedical information sharing. Journal of
Function in the Federal IT Organization. In: Earl, Michael Biomedical Informatics, 43(21), 342-353.
J., Information Management: the Organizational Sääksjärvi, M., Lassila, A. & Nordström, H. (2005). Evaluating
Dimension, Oxford University Press. the software as a service business model: From CPU time-
Janssen, M. & Joha, A. (2010). Connecting cloud infrastructures sharing to online innovation sharing. Paper presented at
with shared services. Paper presented at the Proceedings the IADIS International Conference e-Society 2005.
of the 11th Annual International Digital Government Sambamurthy, V. & Zmud, R. W. (1999). Arrangements for
Research Conference on Public Administration Online: Information Technology Governance: A Theory of
Challenges and Opportunities, Pueblo, Mexico. Multiple Contingencies. MIS Quarterly, 23(2), 261-290.
Kern, T. & Willcocks L.P. (2001). The Relationship Advantage: Weill, P. & Ross, J. W. (2005). A matrixed approach to
Information Technologies, Sourcing, and Management, designing IT governance. MIT Sloan Management Review,
Oxford University Press. 46(2), 26-34.
Kundra, V. (2010). 25 Point Implementation Plan to Reform Willcocks, L. P. & Feeny, D. (2006). IT outsourcing and core IS
Federal Information Technology Management. capabilities: challenges and lessons at Dupont.
Kundra, V. (2011). Federal Cloud Computing Strategy. Information Systems Management, 23 (1), 49-56.
Lacity, M., Feeny, D. & Willcocks, L. P. (2006b). The twelve Willcocks, L. P. Feeny, D., & Olson, N. (2006). Implementing
supplier capabilities: part II. Arlington, MA., USA: core IS capabilities: Feeny-Willcocks IT governance and
Cutter Consortium. management framework revisited. European Management
Lacity, M., Willcocks, L. P. & Feeny, D. (2006a). The twelve Journal, 24 (1), 28-37.
supplier capabilities: part I. Arlington, MA., USA: Cutter Willcocks, L. P. & Kern, T. (1998). IT Outsourcing as Strategic
Consortium. Partnering: The case of the UK Inland Revenue. European
Lee, J. N., Huynh, M. Q., Kwok, R. C. W. & Pi, S. M. (2003). Journal of Information Systems, 7(1), 29-45.
IT Outsourcing Evolution. Past, Present and Future.
Communications of the ACM, 46(5), 84-89.


Cloud Governance Framework - Required Cloud Sourcing Capabilities

More Related Content

What's hot (20)

Viewers also liked (11)

Similar to Cloud Governance Framework - Required Cloud Sourcing Capabilities (20)

Recently uploaded (20)

Cloud Governance Framework - Required Cloud Sourcing Capabilities