Cloud complexity: The need for resilience · 2 The Economist Intelligence Unit Limited 2016 Cloud...

Sponsored by

A report from The Economist Intelligence Unit

Cloud complexity: The need for resilience

© The Economist Intelligence Unit Limited 20161


Preface 2

Introduction 3

Resilience and the cloud 5

The building blocks of cloud resilience 8

Conclusion: mindsets and partnerships for resilience 12

Appendix: survey results 13

Contents

1

2

3



Cloud computing has helped reduce costs

and boost productivity at many organisations,

but its broader use brings both benefits and

risks. These risks extend well beyond security

breaches into a lack of oversight of complex,

often fragmented systems that, if not

managed well, limits an organisation’s ability

to capture new opportunities and to adapt

and respond to new technology or regulatory

controls.

How should Chief Information Officers

leverage the cloud’s potential? How can they

fortify their company’s continuity and agility in

the cloud? What key challenges must be

overcome to succeed on this journey? Like all

big changes, a successful shift to cloud

computing requires a shift in both mindsets

and strategies, processes and partnerships

across and outside a company.

This report by the Economist Intelligence Unit

(EIU) on behalf of Sungard Availability Services

explores these and other critical questions as

companies expand their cloud use.

The findings and views in this report do not

necessarily represent the views of the sponsor.

The author is Peter Moustakerski; Carolyn

Whelan edited the report. We would like to

thank all the executives who participated on

the record and anonymously.

Interviewees

l Kristin Darby, chief information officer,

Cancer Treatment Centers of America

l Dom Guinard, co-founder and CTO,

EVRYTHNG

l Tanuja Randery, president UK & Ireland,

Schneider Electric

l Harsh Sinha, vice president, Engineering,

TransferWise

Preface

In March of 2016, the EIU, for a research programme sponsored by Sungard Availability Services, polled

304 executives evenly dispersed across France, the United Kingdom and the United States on their

organisational resilience and technology adoption. Respondents hail from a number of industries,

including IT and technology (15%), financial services (13%), professional services (8%), manufacturing

(7%) and 15 other sectors (collectively 57%). Those polled hold the titles of chief information officer

(50%), senior vice president (12%), vice president (15%) or head of IT (23%). The companies they

represent earn between $50m and $500m (45%), or more than $500m (55%) in annual revenue.

Who took the survey?



Organisations today operate in an

increasingly interconnected and information-

rich world. Innovations like big data and

dynamic pricing create unprecedented

opportunity for businesses to launch novel

products and services, conquer new markets

and better engage customers. But the same

developments bring new risks and

challenges—from security breaches and

service interruption to managing fragmented

IT systems, vast data troves and the dizzying

speed of change.

Cloud computing is perhaps the most

prominent example of recent disruptive

technologies that are reshaping corporate

strategies and IT capabilities. Cloud use is now

almost universal among organisations—and

only expected to grow. In the EIU survey, 78% of

executives agree that their use of cloud

computing will increase in the next three years

(see Figure 1); nearly two-thirds (65%) say that

more than half of their organisations’ systems

are now cloud-based versus the just 6% who say

that one-quarter or less of their systems are in the

cloud. “Companies are no longer considering

whether to migrate to the cloud, but rather

what … and how best to migrate,” notes Tanuja

Randery, president, UK & Ireland at French

electronics conglomerate Schneider Electric.

The move to the cloud is a logical one.

Cloud solutions help organisations add new IT

capabilities and applications at lightning

speed, often at a lower lifetime cost. But the

cloud can introduce more external players

and potential breakage points that demand

responses to both innovation and regulation

at a faster pace than many IT organisations

can meet.

Introduction

Source: Economist Intelligence Unit, 2016.

Strongly agree

Somewhat agree

Neither agree nor disagree

Somewhat disagree

Strongly disagree

France

United Kingdom

United States

All respondents

Figure 1. To what extent do you agree with the following statement: “Our use of cloud computing will increase in the next three years”? (% respondents)

40 39 20 2

34 38 21 4 3

45 38 14 4

39 38 18 3 1



Against this backdrop of change and

uncertainty, “organisational resilience” is

emerging as a critical lever of a successful

cloud expansion. BSI, the business standards

company, defines resilience in its newly

published BS 65000 standard as the ability to

both quickly bounce back from a major

disruption and to “anticipate, prepare for,

respond and adapt to events—both sudden

shocks and gradual change” to survive and

prosper.

In fact, as Lyndon Bird, technical director at

BSI points out in a recent Continuity Central

article, the field of Business Continuity

Management is reorienting its focus to

organisational resilience. Business continuity

strives to prepare an organisation for effective

responses to sudden, major disruptions with

minimal business impact. The business

continuity agenda has also traditionally

resided within the risk and compliance

function which has struggled to gain broader

buy-in from other functions—primarily because

it has been considered by other functions

across the broader organisation as “not their

problem”.

Organisational resilience, by contrast,

alters the management posture from a

reactive one to proactively anticipating and

preparing for future disruption—and not just

sudden cataclysmic ones, but also gradual

strategic shifts. This more complex and

difficult goal is intricately linked to an

organisation’s overall business strategy and

requires broader mobilisation of corporate

capabilities across an organisation—from

human resources managers to department

heads to those who oversee supply chains.

They will need to organise everything ranging

from business processes to internal controls to

capture value and mitigate the risk inherent

in cloud opportunities. Thus, the resilience

agenda is reaching the highest levels of an

organisation.



The same shift in executive focus is taking

place within cloud computing. As executives’

experience and comfort level with the cloud

grow, they are refocusing their attention

beyond continuity onto the strategically

important objective of resilience.

This trend is clearly shown in the EIU survey.

Nearly three-quarters (72%) of survey

respondents say the importance of

organisational resilience will increase over the

next three years (see Figure 2), a sentiment

expressed even more strongly in the US (78%).

Notably, the more advanced a company is

in its adoption of cloud technology, the

stronger its focus on resilience appears to be.

Respondents in the EIU survey who believe

their organisation is ahead of its competitors in

cloud adoption are nearly three times as likely

as the rest to also say they are ahead in their

organisational resilience to technology risk.

Indeed, according to respondents in the EIU

survey, companies that are ahead of the

competition in cloud adoption also tend to

outperform their competitors in profitability

and innovation. (See Figure 3).

On the other hand, the focus on resilience

does not look to be linked to a company’s

cloud exposure. Survey respondents with just

1-24% of their IT assets in the cloud were just as

likely to say that resilience will grow in

importance as those who say that 75-99% of

their IT systems are in the cloud (68% vs 70%).

To be sure, this is not a shift away from

business continuity, which, like cloud

computing, also focuses on the availability

and security of IT assets—even more so in the

Resilience and the cloud1


Strongly agree

Somewhat agree


Somewhat disagree

Strongly disagree

France

United Kingdom

United States

All respondents

Figure 2. To what extent do you agree with the following statement: “The importance of organisational resilience will increase over the next three years”? (% respondents)

22 45 27 7

24 49 21 7

32 46 16 5 2

26 46 21 6 1



age of the cloud. Security risks still top the list

of cloud computing challenges identified by

respondents in the EIU survey (see Figure 4),

and are the most frequently named barrier to

further technology adoption.

The most commonly cited risks are security

breaches and leaks of confidential

information (53% say they are extremely or

moderately concerned about this risk),

disruptions caused by cyber-attacks (52%)

and potential failure to deliver product or

services (46%). Two recent examples of

high-profile security failure cases: breaches of

federal workers’ personnel files at the US

government’s Office of Personnel

Management and patient record breaches at

CareFirst Networks.

“Both cloud providers and enterprises are

getting smarter about security,” observes Ms

Randery of Schneider Electric. Indeed, no

executive interviewed by the EIU for this report

could recall any recent major disruption or

incident pertaining to data security or service

availability within their cloud systems. This

reflects, perhaps, a growing view that data,

systems and processes may be more secure

with a large cloud provider than within a firm’s

own walls.


Ahead of competitors in cloud adoptionOn par or behind competitors in cloud adoption

Ahead of competitors in responsiveness to market demands

Ahead of competitors in rate of innovation

Ahead of competitors in corporate profitability

Ahead of competitors in organisational resilience

Figure 3. In your opinion, how does your company compare to its closest competitors in the following areas? (% respondents)

77 29

74 26

71 26

68 25


Private cloudPublic cloudHybrid cloud

Cost of maintenance

Loss of control

Regulatory constraints

Lack of standardisation

Lack of flexibility

Lack of processes

Access to information by outsiders

Security risks

Don’t know

Figure 4. What are the top two challenges of your cloud computing approach? (% respondents)

30 21 25 23 16 23 23 24 27 20 22 12 23 34 10 21 19 20 20 31 27 35 31 48 21 3



“It is much easier today to provide 100%

uptime, so the cloud is actually a better

place for security,” seconds Dom Guinard,

co-founder and CTO of technology

company EVRYTHNG. He notes that cloud

providers such as Amazon and Microsoft

have invested heavily to address the security

and stability challenges of their cloud

environments, so companies are better off

offloading these risks and responsibilities to

large-scale providers. “On-premise is more

risky,” Mr Guinard cautions.

As the use of the cloud expands, executives

are taking a more holistic and sophisticated

approach, embedding the narrower goal of

business continuity within the broader, more

challenging and strategically relevant

objective of organisational resilience. Ms

Randery sums it up elegantly: “Resilience … is

not just about uptime and security; it is

increasingly about agility, speed,

multiplication and being more innovative.”



As organisations shift their focus from

continuity to resilience, they will need to

master the five key capabilities that follow.

Although some of these building blocks are

rooted in business continuity, they will need to

be reshaped and reprioritised inside and

outside a company to adapt to the new

opportunities and risks that the cloud brings.

1. Specialised and regulatory requirements.

Migrating to one company-wide cloud

solution with broad functionalities and an

impact on all corporate functions is often

difficult or impractical. A cloud system for a

particular functional area (such as research &

development), for discrete events (like games

or conventions) or for a specific geography

may be wiser—with tailored services and

safeguards to better meet data sovereignty,

security or latency needs. This is also easier for

organisational change management

because cloud capabilities address core

demands.

To meet more stringent demands for

oversight and control, Ms Randery predicts

that specialised but adaptable solutions that

serve particular functions or geographies will

grow. “Specialised is easier to outsource,” she

notes. “It facilitates a greater level of

migration and creates greater organisational

resilience.”

But the push towards specialisation

demands different approaches based on, for

example, specific risks or regulations.

In retail, for instance, the regulatory focus is

on maintaining the privacy and confidentiality

of customer data and compliance with the

Payment Card Industry Data Security

Standards (PCI DSS) to protect credit

cardholder information.

PCI DSS compliance is also critical for

financial services, as is adherence to the US

Gramm-Leach-Bliley Act, which requires

financial institutions to establish standards for

protecting the security and confidentiality of

their customers’ non-public personal

information.

In healthcare, the US federal Health

Insurance Portability and Accountability Act

(HIPAA) requires healthcare organisations to

maintain the confidentiality of electronic

health information that can be linked to an

individual patient (also known as electronic

protected health information, or ePHl). As

Kristin Darby, chief information officer at

Cancer Treatment Centers of America

(CTCA), notes, HIPAA/ePHI compliance in the

cloud is a particular challenge.

“Many specialised application vendors are

simply forcing their existing desktop versions

onto a cloud platform, without having

ensured the integrity and interoperability of

data, functionalities and workflows,” Ms Darby

notes. The main barrier to greater cloud

2 The building blocks of cloud resilience



adoption among healthcare companies

today is the “shortage of cloud providers who

can meet the industry’s unique requirements

around compliance and availability and can

provide single tenancy at an affordable cost”,

she adds.

2. Systems integration and governance.

Today’s cloud ecosystem is a mix of cloud

types, multiple cloud providers, many cloud

instances and specialised systems and

applications native to individual departments.

“We are concerned about application sprawl

and loss of organisational resilience due to the

ease of use and implementation of cloud-

based solutions, especially when done without

enterprise awareness,” cautions Ms Darby.

The “sprawl” Ms Darby references, if

unchecked, will pose a significant resilience

risk to organisations and has pushed CTCA to

add more process controls to contain this

growth. As Ms Randery of Schneider Electric

points out, “Data fragmentation is good from

a risk perspective, but who’s watching all

that? When you have multiple cloud

providers, how do they talk to each other?”

More-advanced cloud users are already

recognising, and many are addressing, the

importance of oversight, connections and

accountability. Respondents who say their

organisations are ahead of competitors in

organisational resilience are more likely to

prioritise their efforts to strengthen internal

processes and integrate new and legacy

systems (see Figure 5).

3. Data and process re-engineering. Among

the greatest challenges companies face after

moving assets to the cloud is connecting

existing data sets, business processes and

workflows to the newly adopted technology.

First, executives must ensure that the data

and systems they are moving are clean,

organised and ready for migration. “How do

you outsource a mess? What … if you don’t

fully understand your own existing data and

legacy systems?” Ms Randery of Schneider

Electric asks.

More important, for greater resilience,

proper alignment and flexing of the day-to-

day workflow and business processes are

critical to capture and monetise the

efficiencies, productivity and increased

resilience cloud computing promises. As Harsh


Ahead of competitors in organisational resilienceOn par or behind competitors in organisational resilience

Figure 5. Where will your organisation prioritise its efforts to ensure organisational resilience over the next three years? (% respondents)

Enhancing cloud computing

Adopting new technologies

Strengthening systems against cyber attacks

Strengthening internal processes

Providing redundant and backup infrastructure

Integrating new and legacy systems

Monitoring internal staff behaviour

Increasing the organisation’s reliance on third-party technology providers

50 44

43 39

39 41

41 38

34 41

38 30

30 36

25 28




Private cloudPublic cloudHybrid cloud

Cost savings

Maintaining control

Regulatory compliance

Standardisation

Flexibility

Improved processes

Access to information by employees

Enhanced security

Don’t know

Figure 6. What are the top two benefits of your cloud computing approach? (% respondents)

27 29 28 28 24 19 17 18 14 15 22 16 27 28 43 29 40 26 15 13 22 41 26 28101

Sinha, vice president, Engineering of money

transfer company TransferWise, points out,

“Companies need to re-architect to move to

the cloud.” Often the heavy lifting required

may prompt a company to keep legacy

systems in house—or, sometimes, to shut them

down altogether.

Indeed, lack of processes is a top

challenge to cloud adoption for one-fifth of

respondents in the EIU survey. To shore up

resilience after cloud expansion, companies

will need to work closely with partners to

ensure that everyday processes seamlessly

connect with the new cloud interface. Done

well, the payoff is clear. Between 26% and 40%

(see Figure 6) of EIU survey respondents say

improved processes are a top benefit of their

cloud use, perhaps attributable to the greater

access, speed, agility and collaboration the

cloud enables.

4. Ongoing service and maintenance. As with

any new IT platform or service, moving to the

cloud is not a one-and-done deal. Keeping

systems updated, running and bug-free, and

responding to user queries, feedback and

service needs are perhaps more important

than the initial migration. “You have to make

sure you have enough people doing the right

things: patching systems, overseeing the

physical security of IT assets, linking your

organisation with that of the cloud provider,”

says Mr Guinard of EVRYTHING.

This upkeep and customer service can be a

significant challenge. But addressing this early

can pay dividends. “Cloud can be a little bit

impersonal,” remarks Ms Randery of Schneider

Electric. “On-the-ground support for users is

very important.” Ensuring the right level of

service and support both in-house and

through a cloud provider for both

implementing cloud solutions and shoring up

organisational resilience is critical.

5. People and skill sets realignment.

Successful adoption of any technology

ultimately hinges on the human element. The

right mix of skills, a smooth transition to new

technology and a prompt embrace of a more

agile and evolving process and culture by

stakeholders will help companies reap the

expected value from new cloud

implementations.

“Technology is easier,” cautions Mr Sinha of



TransferWise. “The bigger resilience challenge

is organisational. Companies need to retool

their people for cloud computing. It requires

significant change management.” But the

extent of the challenge very much depends

on an organisation’s culture.

“You need different people,” seconds Mr

Guinard of EVRYTHING. System administrator

skills were most valued before; now

developers who manifest agility and speed

are in demand. Unfortunately but

understandably, these skills are also valued by

start-ups and are costly. Longer term, to build

resilient cloud-based capabilities, companies

will need to better understand the human

needs of those who are implementing and

maintaining their cloud-based strategy.



The rapid march into cloud computing has

increased and will continue to increase the

complexity and speed of change of IT

ecosystems. In this often fragmented and

always fluid environment, a different

mindset— shifting focus from continuity to

resilience—is needed to capture the

efficiency, agility and economic gains

promised by the cloud; anticipating or

responding to negative disruptions will also be

required.

IT executives must rethink strategies,

re-engineer operating models, retool talent

and reinvent governance and decision-

making. To do so, they will need to engage

more stakeholders across an organisation.

They will need to forge partnerships to better

anticipate and address risks, to avoid

disruption and to adapt to dynamic market,

technology and regulatory environments.

Conclusion: mindsets and partnerships for resilience3



Appendix: survey results

Percentages may not

add to 100% owing

to rounding or the

ability of respondents

to choose multiple

responses.

Security concerns

Affordability of technology

Government regulations

Lack of technology standards, such as a lack of consensus on which cloud solutions to use across agencies and departments

Lack of budget

Organisational culture, such as inertia to change

Insufficient technology skills among staff

Poor appreciation by senior management of the benefits of technology

Poor technology infrastructure

Low priority of migration to technology-based service delivery

Siloed organisations and budgets

In your opinion, what will be the greatest barriers to broader technology adoption in your organisation over the next three years? Please select the top three. (% respondents)

50

34

31

27

26

25

25

23

20

20

19

All (100%)

Most (75% - 99%)

Over half (50% - 74%)

Some (25% - 49%)

Few (1% - 24%)

What portion of your organisation’s systems are cloud-based (public and private) today? Select one. (% respondents)

4

18

43

29

6



Software as a service (SaaS)

Infrastructure as a service (IaaS)

Platform as a service (PaaS)

Business Process as a Service (BPaaS)

Which type(s) of cloud computing services does your organisation currently use? Please select all that apply. (% respondents)

67

53

47

40

Private cloud computing

Public cloud computing

Hybrid cloud computing

We don’t foresee using cloud computing in the next three years

Over the next three years, what will be your primary approach to cloud computing? Please select one. (% respondents)

43

22

33

1

Enhanced security

Flexibility

Improved processes

Cost savings

Maintaining control

Standardisation

Access to information by employees

Regulatory compliance

Don’t know

What are the top two benefits of your primary approach to cloud computing? Please select two.(% respondents)

33

33

30

28

24

17

17

16

1



Security risks

Cost of maintenance

Regulatory constraints

Access to information by outsiders

Loss of control

Lack of flexibility

Lack of processes

Lack of standardisation

Don’t know

What are the top two challenges of your primary approach to cloud computing? Please select two.(% respondents)

39

26

25

25

22

21

20

18

2

Much stronger

Somewhat stronger

Neither stronger nor weaker

Somewhat weaker

Much weaker

Don't know

Corporate profitability

Cloud computing adoption

Organisational resilience to technology risk

Rate of innovation

Responsiveness to market demands

In your opinion, how does your company compare to its closest competitors in the following areas? Rate on a scale of 1 to 5, where 1=Much stronger and 5=Much weaker. (% respondents)

17 28 29 16 8 2

13 31 29 16 10 1

13 30 27 21 9 1

16 30 26 20 6 2

13 37 24 16 10 1

CIO

Head of IT

CEO

COO

Chief Digital Officer

Other C-suite executive

Risk management executive

In your organisation, who is involved in identifying business continuity risks? Select all that apply. (% respondents)

37

57

19

16

17

8

25



CIO Head of IT CEO COO Chief Other Risk Digital C-suite management Officer executive executive

Ultimate responsibility for technology risk

Who should bear this responsibility

In your opinion, who within your organisation is ultimately responsible for managing technology risk? Who do you believe should be responsible? Please select one in each column. (% respondents)

23 36 11 6 6 4 15

26 28 9 7 11 5 14

1. Major risk 2. High risk 3. Medium risk

4. Low risk 5. No risk Don't know

Legacy systems

Cloud computing

Big data and analytics

The Internet of Things

Mobile devices

Bring your own device (BYOD)

Social networking

Which of the following uses of technology, in your opinion, pose the biggest risk to your organisation’s business continuity over the next three years? Please rate on a scale of 1 to 5, where 1=Major risk and 5= No risk. (% respondents)

6 20 34 26 13 3

10 24 31 22 13 1

8 24 29 25 13

7 19 31 29 13 2

9 25 31 23 11 1

14 20 33 20 9 4

11 23 29 25 11 2

1. Extremely concerned

2. Moderately concerned

3. Somewhat concerned

4. Slightly concerned

5. Not at all concerned

Failure to deliver products or services due to technology disruption

Security breaches of confidential or “leaked” information

Disruption caused by a cyber attack

Disruption caused by an employee

Disruption caused by a vendor, contractor or other external employee with access to technology at your organisation

Reliance on third-party technology providers

How concerned are you about the following risks to your company’s reputation over the next three years? Rate on a scale of 1 to 5, where 1=Extremely concerned and 5=Not at all concerned. (% respondents)

11 35 27 22 5

21 32 25 19 3

19 33 28 16 4

10 32 28 23 7

12 34 29 21 6

10 29 35 19 7



Enhancing cloud computing

Adopting new technologies

Strengthening systems against cyber attacks

Strengthening internal processes

Providing redundant and backup infrastructure

Integrating new and legacy systems

Monitoring internal staff behaviour

Increasing the organisation’s reliance on third-party technology providers

Don’t know

Where will your organisation prioritise its efforts to ensure organisational resilience over the next three years? Please select three. (% respondents)

46

41

40

39

38

33

33

27

1

Strongly agree

Somewhat agree


Somewhat disagree

Strongly disagree

Our company has a written cloud computing policy

Our use of cloud computing will increase in the next three years

Security concerns will limit the full potential of cloud computing at our organisation in the next three years

Our organisation has clearly defined roles and responsibilities for organisational resilience

The importance of organisational resilience will increase over the next three years

Over the next three years our company will likely face a reputational risk event due to technology failure or compromise

Please rate your level of agreement with the following statements: Please select one in each row. (% respondents)

24 44 25 6 2

40 38 18 3 1

16 42 25 15 2

32 39 20 9

26 46 21 6 1

12 40 26 18 4



IT

What is your main functional role? Select one. (% respondents)

100

France

United Kingdom

United States

In which country are you personally located? (% respondents)

33

34

33

Chief Information Officer

Senior Vice President

Vice President

Head of IT

Which of the following best describes your title? (% respondents)

50

12

15

23

$50m to $100m

$100m to $250m

$250m to $500m

$500m to $1bn

$1bn to $5bn

$5bn to $10bn

$10bn or more

What are your organisation’s global annual revenues in US dollars? (% respondents)

9

16

19

35

15

4

2

What is your primary industry? (% respondents)

IT and technology

Financial services

Professional services

Manufacturing

Automotive

Consumer goods

Retailing

Construction and real estate

Telecoms

Energy and natural resources

Healthcare, pharmaceuticals and biotechnology

Logistics and distribution

Education

Entertainment, media and publishing

Chemicals

Transportation, travel and tourism

Government/Public sector

Agriculture and agribusiness

Aerospace and defence

15

13

8

7

6

6

5

5

5

5

5

4

3

3

3

3

3

2

1



Whilst every effort has been taken to verify the

accuracy of this information, neither The Economist

Intelligence Unit Ltd. nor the sponsor of this report can

accept any responsibility or liability for reliance by

any person on this report or any of the information,

opinions or conclusions set out in the report.

Co

ver:

Sh

utt

ers

toc

k

London20 Cabot SquareLondon E14 4QWUnited KingdomTel: (44.20) 7576 8000Fax: (44.20) 7576 8476E-mail: [email protected]

New York750 Third Avenue5th FloorNew York, NY 10017United StatesTel: (1.212) 554 0600Fax: (1.212) 586 0248E-mail: [email protected]

Hong Kong1301 Cityplaza Four12 Taikoo Wan RoadTaikoo ShingHong KongTel: (852) 2585 3888Fax: (852) 2802 7638E-mail: [email protected]

GenevaBoulevard des Tranchées 161206 GenevaSwitzerlandTel: (41) 22 566 2470Fax: (41) 22 346 93 47E-mail: [email protected]

Cloud complexity: The need for resilience · 2 The Economist Intelligence Unit Limited 2016 Cloud...

Documents

Transcript of Cloud complexity: The need for resilience · 2 The Economist Intelligence Unit Limited 2016 Cloud...