embracing cloud kpmg

8/2/2019 Embracing Cloud Kpmg

1/52

Governance

Cloud

Flexibility

PublicInvestment

ServersMigrate

Big DataWeb-based

Speed-to-market

llaboration

Competitive Advantage

Efficiency

Innovation

Users

Measurement

Applications

CRMCost savings

Deployment

Tax

Analytics

Customer management

dels

Compliance

Risk mitigation

Providers

Agility

Consistents

Transformation

Enterprise

Evaluate

Hybrid PrivateOpen Standards

Integration

e

Implementation

KPIs

Evolve

Change Management

Security

Risk

KPIs

volution

Third Party

KPMG INTERNATIONAL

Embracing theCloud

Global forces shaping theservice provider market

kpmg.com

Global Market

Cloud Providers
http://www.kpmg.com/http://www.kpmg.com/


2/52 2011 KPMG International Cooperative (KPMG International), a Swiss entity. Member rms o the KPMG network o independent rms are aliated with KPMG International. KPMG International provides no client serv ices. All rights reserved.


3/52

ContentsForeword 1

Executive summary 2

Introduction 5

Core challenges mean core opportunities 6

Outcome: business transormed 7

Cases in point 9

Where are we going and what are we spending? 16

Adopting cloud services 25

Has total cost o ownership been evaluated properly? 27

Functionality is essential; 30it is a question o good enough vs. perect.

Tax in the equation, a relevant variable 36

Who should lead cloud eorts? 37

Conclusion 40

Insights & implications 41

Interviewees 45

Additional reading 46

2011 KPMG International Cooperative (KPMG International), a Swiss entity. Member rms o the KPMG network o independent rms are aliated with KPMG International. KPMG International provides no client serv ices. All rights reserved.


4/52

The impact, opportunity and risk o cloud.

Its here.

Its now.

Find out what your peers are doing today.



5/52

Embracing the Cloud: Global orces shaping the service provider market | 1


Foreword

We are pleased to present KPMGs 2011 Global Cloud Survey report. This is the rst year that KPMGhas conducted a global survey o over 900 executives in 15 countries. The survey examines threedistinct perspectives that o senior business unit executives, senior corporate IT executives,and cloud service provider executives. The survey analysis identies the interplay, includingcommonalities and dissonance, among these three sets o participants.

The objective o this publication is to identiy cloud adoption barriers and opportunities as well asprovide insight into the orces shaping the cloud market. For many, clouds promise is more than justa shit in IT strategy; it could lead to a undamental transormation o a companys business model.

For providers o cloud services and or companies that are considering moving delivery o theirproducts to the cloud this analysis provides critical insight into how users are approaching theircloud buying and implementation decisions. Undoubtedly, the ull story will unold at dierent ratesacross companies around the world, as some move cautiously and others make a bold dash.

Based on our experience and the interviews with cloud providers and users, the ollowingrecommendations will help cloud providers increase the success o their clients move towards cloud:

Educatecustomersandprospectsonthebenetsofcloudbeyondtheeconomics.Theadvantages

o the cloud model appear to be understood by enterprises, but only at a high level. Organizationsneed help getting started by translating the cloud into organization-specic competitiveadvantages.

AssistclientsindevelopingnewKPIstomeasuretheirinvestment.Berealisticoncostsavingsclaims; back up examples with proo.

Beproactiveaboutthechallengesclientswillfacefromrapidandmultiplecloudinvestmentsand

deployments.

Ensure,asacloudprovider,youhavechangedyourbusinessmodelinkeyareassuchasrevenue

and billing, customer management, risk & compliance, and tax structures.

Cloud is opening the door to transorm business and drive innovation inside and outsideorganizations. As the cloud business and technology models continue to evolve, cloud serviceproviders have the opportunity to assist their clients in the development o a comprehensive cloudstrategy.

We trust you will nd this publications insights and guidance o value.

Sincerely,

Gary MatuszakGlobal Chair, Technology,

Media & Telecommunications

Tom LamoureuxGlobal Advisory Leader,

Technology


6/52

Executive summary

Transform your business with the cloud.This drumbeat haspunctuated most technology and business conversations overthe past ew years. Fueled by hype, many cloud advocatescan discuss at a high level how they can transorm businessmodels, but ew have the insights o what companies aroundthe world are actually doing to benet rom the cloud or howto create and deploy a strategy that is truly transormative.

Much has been discussed about the business and operationalchallenges surrounding cloud adoption including security,total cost o ownership, and the intersection with businessstrategy and operations. As companies in a variety o

industries are beginning to address the impact o cloudintegration with other applications and data, these companiesalso ace the challenge o organizational redesign and changemanagement, compliance, taxes, and security.

KPMG International and Forbes Insight conducted a globalsurvey in 2011 to assess global cloud adoption trends. Thesurvey included more than 900 executives rom 15 countries.Respondents represented end-users, executives in IT andbusiness unctions, and cloud vendors.

From all angles, the responses showed increased readinessto accept and exploit the benets o cloud. And while the

cloud continues to have many denitions, our report highlightswhere it is going, underscoring that this seemingly simpleand fexible solution can create complexity i not managedproperly.

The real transormative impact o the cloud

Cloud istransormative in that it is creating new businessopportunities as companies harness its power to ecientlyacilitate new revenue, services and businesses. It is breakingdown barriers in the supply chain, as well as creating moreeective and timely interaction between clients and suppliers.It is delivering speed, agility and cost reduction to IT and other

unctional areas within the enterprise. The transormativeimpact o cloud can readily be seen across the enterprise inareas such as HR, CRM, and IT inrastructure.

Many early adopters have implemented the cloud in areasthat are sel-contained, primarily in areas that are not rie withcomplexity and multiple applications, and that do not requireintegration with core enterprise applications or inrastructure.Others have pushed orward more broadly in new, start-up orevolving businesses, oten with increased speed over theirsister organizations burdened with legacy systems. And whilethere are notable ground-breakers pushing cloud to the edge,the majority has ocused on controlled implementations toimprove the odds o success.

Key fndings include:The cloud is commonplace, but its scope varies widely.Over hal o the businesses and government enterprisessurveyed have already conducted either a ull (24%) or partial(35%) cloud implementation o some unctions. The vastmajority has tested these new technologies and processes,and they are using them on a small scale. Some typical areaso cloud implementation are or email, sales managementand other available Sotware as a Service (SaaS) oerings.The research notes that in 2011, 19% o the respondentsindicated spending on cloud represents 10% or more o totalIT expenditures with 65% citing 10% or less.

Early investment centers on Sotware as a Service (SaaS).Again, the majority o early adopters are using basic, availabletools in the cloud. O the respondents, 46% o plannedimplementations are in a SaaS environment. However,signicant numbers o end users are also exploring the useo Inrastructure as a Service (IaaS) and Platorm as a Service(PaaS) models.

Cloud environments have the potential to transorm

business and operating models. Eighty-seven percent say,at the very least, the coming change will be signicant. Thisview is consistent among companies o all sizes and whetherthe respondents work within IT unctions or business units. It

is not a surprise that cloud providers believe that business andcorporate IT executives underestimate the degree o changethat could result rom cloud adoption.

81% o businesses are either planningtheir initial adoption, are in early oradvanced stages o experimentationor have ull-on cloud implementations.

2 | Embracing the Cloud: Global orces shaping the service provider market



7/52

Approximately 45% o therespondents are either not evaluatingthe tax implications o cloud or dontknow i these actors are beingevaluated.

The vanguard already resides in the cloud. Right now,81% o businesses are either planning their initial adoption,are in early or advanced stages o experimentation or haveull-on cloud implementations. While the scope may becontrolled, and the approach measured, there is indeedactivity. Remarkably, respondents at one in 10 businessessay they are already running their core IT services usingcloud technology, although this number varies widely bygeography.

Substantial cost savings are on their way. Cloud user inthe business and IT unctions, as well as cloud providers

believe cloud environments wil l deliver cost savings. Theprevailing wisdom points to economies o scale, meaningthe cost o each unit o computing value within a cloudenvironment will all dramatically over time. As or businessprocesses, executives believe innovation will lead tostreamlining. But an intriguing nding is this: while providerspromote up to 30% savings, most business executiveswould be happy with 10%15% savings.

Opportunities exist to overcome barriers to success.Executives are particularly intrigued by potential gainsin areas such as speed to solution and widespreadaccessibility as well as fexibility, scalability, security and

advanced technology.

Buyers are concerned by risks o provider perormance,

downtime and data security. Recent headlines exposingcompromised data and temporary shutdowns remain rontand center or many potential adopters. However, providerinput suggests that such ears are overstated and that inreality, the cloud will be a saer, more secure and more reliableIT environment than these customers have ever known.

Private clouds will dominate the most critical unctions.Many actors drive the decision over public or private cloud.Industries with the strongest adoption o private cloudsare nancial services, healthcare and diversied industrials(averaging 45% o respondents), with nancial services andhealthcare acing heavy regulatory and compliance issuesthat are exacerbated, though not impossible in the cloud.Organizations custom-congured applications and inrastructurealso contribute to the need or private cloud solutions versusthe standardized solutions among public clouds.

Business unit executives and CIOs views diverge when

it comes to cloud leadership. IT executives see migrationto the cloud as their initiative; and, consequently, they believethat it should be led by the Chie Inormation Ocer. In theminds o business executives, however, the natural leader ocloud-based initiatives should be the CEO. Not surprisingly,post-implementation expectations are similar. Ultimately,responsibilities will likely be shared with relative infuencedepending on the services in question: businesses will tendto control ownership o applications; IT executives will tend tomanage inrastructures. Unless this trend is managed properly,organizations will ace new silos and integration challenges.Enter the Chie Integration Ocer as the traditional CIOs role

expands to break down potential silos and integrate internal andexternal business needs, systems and partners.

Ignoring tax issues raises concern. Approximately 45% othe respondents are either not evaluating the tax implicationso cloud or dont know i these actors are being evaluated.Ignoring tax issues has never changed the responsibility o thepayer, which makes taxation a critical issue or those wishingto evaluate all implications o the cloud environment.




8/52


2011 KPMG International Cooperative (KPMG International), a Swiss entity. Member frms o the KPMG network o independent frms are afliated with KPMG International. KPMG International provides no client services. All rights reserved.


9/52

Introduction

Web-based beginnings

The most common and easily recognizable cloud examples are web-based servicesor email, Customer Relationship Management (CRM) and web hosting. Manyare simple consumer applications, while businesses are considering ar moresophisticated systems. For businesses, cloud services are oten developed in oneo two ways:

Privateclouds,wheretheapplications,dataandnecessaryinfrastructureare

dedicated to a single party that retains direct management oversight; and

Publicclouds,wheredataandapplicationsofnon-relatedpartiesmayresideon

the same servers and are more likely to be primarily managed by a third party.

Hybrid clouds, as the name suggests, are combinations o these two methods.Whether public, private or hybrid, the actor that most commonly signies a cloudsolution is a users ability to obtain as-needed services rom the internet based onfexible volumes o resources.

The cloud marketplace has been evolving or years, as many traditional applicationservices and inrastructure hosting providers migrate to a cloud model. This maturity

is creating a viable market or enterprises looking at service delivery options. Thefexibility and agility provided by the cloud is appealing, and it can be managed todeploy signicant competitive advantage.

DefnitionsKPMG used the ollowing denition o the cloud computing or the purposes othis survey.

IaaS:(e.g.,infrastructuretraditionallyprovidedbyservers,desktopsand

network equipment instead delivered over the internet and can be scaled upor down as needed)

PaaS:(e.g.,softwaredevelopment,storageandhostingareaccessedasaservice over the internet)

SaaS:(e.g.,on-demandapplicationsprovidedthroughaninternetbrowser,

eliminating the need to install, run and maintain programs on internal systems)

BPaaS:(e.g.,businessprocessoutsourcing(BPO)isprovisionedusinga

cloud computing model; bundled with SaaS/PaaS/IaaS and delivered overthe internet

Whether public, privateor hybrid, the actorthat most commonly

signies a cloudsolution is a usersability to obtain as-needed services romthe internet based onfexible volumes oresources.




10/52

Core challengesmean core opportunities

As enterprises rst approach the cloud, their tendency is to perceive the work asprimarily IT-centric. But in reality, understanding the cloud requires a much broaderview. In many situations, the cloud is being driven by an ecosystem o participants.So it becomes vital to think o the evolution o cloud environments in terms o threebroad sets o people and principals: service providers, business users and IT users.

Another challenge is that size matters. Smaller organizations, with less legacy IT

inrastructure and ewer constituents, are able to more rapidly and aggressivelyinvest in deploying cloud capabilities. Any cloud implementations requirecooperation, agreement and compromise along with intensive ocus and hard work.The challenge going orward will be to balance objectives, needs and wants againstreal capabilities and risks. As such, coordinating and harmonizing the advancemento the cloud represents a massive undertaking. But the rewards can be signicantand transormative.

To the cloud: three constituencies

Geography

Geography

Industry

Company size

Business

Users

IT Users

Service Providers

Core

Challenges

The challenge goingorward will be tobalance objectives,

needs and wantsagainst real capabilitiesand risks.




11/52

Outcome: business transormed

Transormation a distinct change in the way business solves problems and gearsor growth is coming. The survey o end-users shows that a signicant number ocompanies believe ast-evolving cloud capabilities will heavily impact business models.While cloud-driven cost reductions may hold the most promise (hal o survey participantsexpect as much), the impact on the business model could be much more extensive.Indeed, nearly a third o respondents, 32%, believe the arrival o cloud environments will

drive nothing short o a undamental change in their business models. And nearly our in10 users (39%) expect cloud will change interactions with customers and suppliers. Only12 percent o respondents elt cloud would have no impact on their business models.Consequently, 88% eel some kind o business model change will occur.

Cloud calls or executives to challenge their thinking, to look at old problems in anew light, and to create new opportunities. KPMG rms have observed severalrecent examples where organizations are converting historical business models intorevenue opportunities through cloud. One example is a company selling goods andservices that identies additional need-based sales opportunities related to a keyproduct. The company is developing a new business model to package and deliverthis inormation to its clients via a new cloud-based model, thereby driving a newrevenue stream. Similar examples are seen worldwide.

It will fundamentally change

our business model

It will change our interaction

with customers and suppliers

It will provide management with

greater transparency on transactions

It will reduce costs

It will accelerate time to market

No significant impact

Other

32%

39%

32%

50%

35%

12%

1%

Which of the following best describes the impact of cloud on your business model?

0 10 20 30 40 50 60

Multiple responses allowed.

Source: KPMG International, 2011, Clarity in the Cloud

Cloud calls orexecutives to challengetheir thinking, to look at

old problems in a newlight, and to create newopportunities.




12/52

Cloud, more than any new technology since the internet, is seen as the harbingero transormation. The ndings are consistent regardless o company size (thosewith annual revenues above and below US$1 billion as well as between IT andnon-IT executives). Even companies with a large installed base o sotware or otherelements o enterprise IT anticipate a highly signicant degree o change as a resulto cloud adoption.

Regional dierences

Executives rom Asia are signicantly more likely to describe the changes stemmingrom cloud environments as driving a undamental shit in their business models.For example, organizations in emerging markets or those that have not investedheavily in legacy inrastructure can leaprog the competition technically by adopting

the latest available systems and capabilities via the cloud model.

0 10 20 30 40 50 60

It will fundamentally change

our business model

It will change our interaction

with customers and suppliers

It will provide management with

greater transparency on transactions

It will reduce costs

It will accelerate time to market

No significant impact

Other

Global average (medium)

50%49%

45%57%

39%40%

30% 49%

32%33%

27%37%

Which of the following best describe the potential impact of cloud on your business model/operations?

32%

12%13%

15%6%

1%2%


13/52

Cases in point

More than the data alone, it is instructive to delve into the people and companieswho are working with cloud today. In these cases, executives are seeing manybenets as they learn rom their cloud implementations.

More options in Italy

Silvio Sperzani, CIO o ENEL, Italys largest and Europes second largest electric

utility, says that cloud environments are moving rapidly, From buzzword tosomething real. For now, his group is just beginning its analysis o the potentialbenets o a cloud environment. Still, Sperzani is already convinced that cloudmigration, will lead to a more fexible IT service model and more options inbusiness processes.

Preparing new processes throughout Europe

Massimo Milanta, CIO at UniCredit, one o Europes most geographicallywide reaching banks, with an international presence in approximately 50 markets,believes that cloud environments will have a proound impact on business processes.The cloud, he explains, will provide the means to speed up prototyping o newproducts or applications or customers. Meanwhile, Milanta sees cloud migration as

a means to accelerate the adoption o new, more ecient and eective processesand technologies. Though we realize we have much to do beore we can take ulladvantage o these developments, we are starting to prepare now. We are now ullyengaged in the journey rom IaaS to PaaS, which we would consider the real cloud,using it as a tool to be quick-to-market and the standardization o environments.

Strategic advantage in global advertising

At advertising and communications agency JWT India, Sunil Mehta, CIO, believesthat the whole point o investing in a cloud environment is to achieve strategicadvantage. We want to make certain that we are always in a position to takeadvantage o any next-generation applications, says Mehta. Achieving a stateo continuous transition to the most ecient processes and technologies will be

easier within the cloud, he adds.

Cost reductions and strategic benefts or fnancial frms

Anil Jaggia, CIO o HDFC Bank, one o Indias largest nancial services providers,says that cost reductions rom the cloud will be signicant. However the strategicbenets are ar and away more vital than the cost savings. He adds, Agility beingable to quickly and eciently provision or deprovision; being on the oreronto innovation and being able to transition quickly: these are the objectives worthattaining.




14/52

Legacy systems tendto ossiy, restrictingestablished businessesand preventing themrom pursuing that nextnew idea. Pat Howard, IBM Partner and

VP Global Services

Extremely important

Important

Neither important nor unimportant

Unimportant

Extremely unimportant

How important are strategic factors in driving your organizations adoption of a cloud environment?*

Figures may not add up to 100% due to rounding.


*Strategic factors (e.g., business process transformation, linkage to business partners, speed to market, focus on core competencies)

33%

3%

2%

44%

19%

0 10 20 30 40 50



Enormous innovation or IBM and its clients

From a provider standpoint, IBM Partner and Vice President or Global Services PatHoward believes that, i anything, business and IT executives are underestimating thelikely strategic impact o cloud migration. Howard says these new technologies andprocesses are leading to a period o enormous innovation and competitive disruption.All thats coming opens up strategic possibilities that just were never there beore,notes Howard. Legacy systems tend to ossiy, restricting established businessesand preventing them rom pursuing that next new idea. However, within a cloudenvironment, Howard believes companies will be able to achieve greater agility orexample, by being better able to quickly organize to serve new customers, developproducts or deliver services.

Overall, says Howard, I dont believe everyone yet ully realizes how much thisstimulates innovation; how many opportunities will be presented; how many newchallenges will need to be addressed; and how much change is coming.

In much the same vein, SAP Senior Vice President Dr. Bernd Welz notes, Cloudmigration is shiting all aspects o the competitive landscape across all industries.

Demand driven supply chain retail

A KPMG retail client is using cloud as a supplier network, reducing data latency

between and among suppliers. In some cases, the client has reduced lead timeson inormation exchange rom 30 days to 1 day, and the suppliers are able to modiythe exchange o material accordingly yielding signicant benet or all parties in theprocess. So as demand changes at the store, all parties can see and act upon thechanges. Leveraging the cloud as a community platorm can signicantly reduceinormation latency resulting in more product getting to the right place at the righttime with less inventory through the supply chain.


15/52

Without legacy systemsand processes, start-up rms and emergingbusinesses in maturerms can be ready orcloud-based applicationsand platorms.

Enabling innovation and investments technology

KPMG recently worked with a large client to support its emerging, or start-up,businesses. Innovation is one o the undamental pillars o this companys corporatestrategy as it acquires and/or incubates companies that design, develop, and marketnext-generation products.

Historically, each new business worked autonomously to design its own operationsprocesses and to source and deploy enabling technologies. The company oundit was spending too much time and money on technology development anddeployments when it should have been ocused on its go-to-market strategies.Its goal was to design, develop, and implement a common set o operationalbusiness processes and an enabling IT architecture that a new business could

plug and play. The process and IT architecture needed to be fexible and scalable,supporting various e-commerce business models with a high degree o re-use o itscore processes and unctionality. In addition, standardized reporting was needed toenable the corporate entity to understand the perormance o each new business its protability, its growth potential, and its challenges or limitations.

The incubator model oers particular advantages or broad cloud deployment.Without legacy systems and processes, the greeneld is immediately ready ordeployment o cloud-based applications and platorms. Ready-made applicationsand architecture will be available or businesses as they enter the market. Thescope is broad rom the user access, to cross-enterprise applications (sales,marketing, customer services, order management, accounts receivable andpayable, inventory management and purchasing), and to identity access. The

need or supporting resources is reduced. At the same time, the larger businessreporting, compliance and data needs will be met, and relevant inormation can beed back into the core nancial and operating systems.




16/52

The real value isthat cloud opensstrategic avenues,including levels o

optimization, notavailable beore.



IBM INTERVIEW

Pat HowardVice President andGBS Global Cloud Leader,IBM

What do you see as the value behind

cloud services?

The real value is that cloud opens up strategic avenues that

werent there before. Across the enterprise, there will be a

level of optimization, market responsiveness and agility that

businesses just couldnt achieve in the past.

Between SaaS, IaaS, PaaS: where do

you see the most potential?

I dont partition my thinking as such from the perspective

of a business enterprise. The way I view it, cloud services are an

enabler around efficient business outcomes.

The scripture reads: the era of the cloud will unfold extreme

innovation in years to come. Cloud can be a key enabler of

new business models that will require changes in corporate

governance and can lead to more efficient outcomes where

businesses will receive greater value from IT.

At this time there is investment in cloud infrastructure and services.

In the future, business innovation will drive the investment and the

technology acronyms will be a forgotten memory.

What is driving the cloud buying

decision?

Nothing happens without the economics. But what are the lowest

price points on the planet? Cloud can lead to that discovery.

Technically, asset utilization and shared service models areunderstood the value is there. And overall, I think the customer

should expect savings.

The real value is that cloud opens strategic avenues including

levels of optimization not available before. Cloud buying decisions

are beginning to take into consideration this new agility to

respond to market opportunities.

From an optimization perspective, strategically, greater cost

efficiency should filter into operations, compressing cycle times

to respond to hot new ideas. The economics are the baseline.


17/52

Are there industry adoption dierences?

Industry dimension is huge!

The consumer products industry is a great example. The model hasnt changed in 100 years

until now. Consumer hyper-personalization is creating a remarkable tsunami of data. Tracking

consumer preferences, merging products and customer databases and integrating social media

and related information systems is making Big Data analytics in the cloud a great opportunity.

The industry is thinking about data differently and cloud and analytics will enable the industry

to capture new opportunities and be more proactive than in the past.

In the financial services and insurance industries companies are gaining more efficiencies.The government industry is also adopting cloud services.

Who is driving the cloud buying decision?

The buying decision should be based on the specific capability. The CIO should own the

decisions related to storage and cloud infrastructure. The decisions related to business

functions and governance should be made jointly between the business functions and IT.

The functions have been pushing due to the consumerization of IT and they are getting the

additional benefits of cloud services. The CIO and IT teams have been more conservative.

Business units are challenged with the speed it takes their current IT to do things. Does

anyone believe all problems go away with cloud-delivered capability? No.

Business capability considerations are critical. The verticalization of business processes within

the cloud, such as end-to-end order management processes, has great potential for increased

efficiency and agility.

Any other thoughts?

The cloud adoption story will unfold at different rates. For some it might be a breakaway, theyll

grab the opportunity and dash for the goal line. For others, they will adapt services in increments.

There has to be a starting point and this is hard work. Ive been through a couple of cycles and

there are many elements to consider such as the creative process, the technical dimensions, and

assessment of the impacts on customers, vendors and the sales force. There is a new way to think

about IT and the changes in the way IT functions. The absence of a coherent strategy is a problem.

Cloud adoption is real and it creates strategic opportunities that have not existed before. I dont

believe everyone yet fully realizes the potential of cloud to stimulate innovation or, for that matter,

how many new challenges will need to be addressed or how much change is coming.

Watch out for the business model innovators with a comprehensive cloud strategy.




18/52

Dr. Bernd WelzSenior Vice PresidentSAP OnDemand

SAP INTERVIEW

Where are you in terms o cloud

development?

Most of our customers have a hybrid solutions landscape.

Our customers need choice. So we have to offer a range of

processes, services and infrastructure.

What trends are you seeing in implementation?

OnDemand might be the most frequent path to the first

meaningful implementation. But we believe the value of a

solution is much greater if its an integral part of the whole,

and what customers soon learn is that further integration is

vital. So we are designing all of our point solutions to make

sure they will fit together well with broader installations.

Who is driving implementation?

These point solutions tend to be purchased by the line of

business themselves. But larger corporations have very tight

IT processes, so at some point, it is vital that the IT group

becomes more closely involved.

Are you noticing any dierences by industry?

Not really. Cloud computing is in fact shifting all aspects ofthe competitive landscape in so many industries that Id have

to say all industries are getting involved.

The dierencein the overall riskprole o the cloudis like that betweenfying in an airplaneand driving in a car.We eel saer in ourcars when we all

know, statistically,we are ar saer inthe airplane.




19/52

How important are reduced costs to cloud adoption?

Cost is one factor. But also, the time it takes to get a solution up-and-running

is equally important. Especially for small-to-medium enterprises (SME),

recruiting and managing IT takes time. So getting rid of those hassles is

important.

And one of the beauties of cloud services is that you can start small, then

make changes as you go. So instead of large, complex and even risky process

initiatives, you can continuously change the solution that you have over time.

What do you see as the key inhibitors to cloud adoption?

Its trust. Any data center at any company can go down from time to

time. Now if that was a server of a mid-market company, it wont be in

the newspapers you will never hear about it. So theres already risk in

running your own servers.

But by comparison, the risk of a cloud provider failing materially for any

extended period is substantially lower. So the difference in the overall risk

profile of the cloud is like that between flying in an airplane and driving in

a car. We feel safer in our cars when we all know, statistically, we are far

safer in the airplane.




20/52

Where are we going andwhat are we spending?

As weve seen, signs o growing comort and amiliarity with cloud environmentsare everywhere. Today, 40% o the businesses surveyed are currently evaluatingthe cloud (19%) or using/testing the technology (21%). KPMG rms have observedlarge organizations migrating email, CRM, components o HR, point o sale,hosting, and other applications to a cloud environment. Several are using the cloudto enable new business models to develop in and around existing businesses,

resulting in additional revenue streams. More oten than not, early migrations aretargeted or areas o limited complexity. Another 13% o enterprises are beyondthe testing stage and are now transitioning core business processes. Even morestriking, one in ten enterprises are already running core IT unctions in the cloud.

As highlighted in the Executive summary, 81% o businesses are either planningtheir initial orays (within the next year), are in early or advanced stages oexperimentation, or have ull cloud implementations in place. And companies withmore than US $1 billion in revenues appear to be leading the way.

0 5 10 15 20 25 30

Evaluating

Using/testing aspects

Embraced/transitioning

Running all core IT services on the cloud

Plan to implement in next year

Plan to implement in next 2 years

Plan to implement in 2+ years

Not considering

Dont know

What is the status of your organizations current use of a cloud environment?

24%

25%

16%

12%

12%

11%13%

14%

7%

8%

8%

10%

13%

13%

3%

3%3%3%

5%

5%

10%

6%

4%4%

4%

13%13%

18%

8%11%

11%

11%

20%

21%21%

19%

Global Americas EMA ASPAC



Heavily regulatedindustries, such asnancial services

and healthcare,demonstrate a strongerlikelihood o adopting aprivate cloud.




21/52

0 5 10 15 20 25 30

Evaluating

Using/testing aspects

Embraced/transitioning

Running all core IT services on the cloud

Plan to implement in next year

Plan to implement in next 2 years

Plan to implement in 2+ years

Not considering

Dont know

What is the status of your organizations current use of a cloud environment?

< US$1b

17%

15%

11%

4%

3%

6%

8%

8%13%

2%4%

10%

8%

12%

14%

23%

22%22%

> US$1b





Other dierences arise among varying geographies. For example, only 7% ocompanies rom the Americas are already running all core applications in the cloud,compared to those 13% rom Europe, Middle East and Arica (EMA) and 11% romAsia Pacic.

Companies today are starting out with the basics the most undamental, low

risk and rmly established cloud capabilities. A good example is again, JWT India.According to CIO Sunil Mehta, We have been in the cloud now or over oneyear. The company began with the migration o email management to MicrosotExchange. At rst, says Mehta, People were anxious, and to no small degreerustrated, as the shit required us to make many changes and adjustments. Andwhile operational challenges still remain, says Mehta, overall, we are very pleasedwith the results and will continue to examine new opportunities in the cloud.

Many companies have taken such initial steps and are likely poised or moreinvolved phases o cloud adoption. Conditions are such that IBMs Howard believesthat in the coming year or two, Were going to see the adoption curve turn into ahockey stick dramatic growth.


22/52

0%

12%

35%

610%

1120%

More than 20%

Dont know

What is your estimated budget for cloud as a percentage of annual IT expenditures?

9%

13%

24%

11%

20%

13%

19%

6%

17%

16%

17%

24%

5%

6%

End 2011



End 2012

0 5 10 15 20 25

This view is borne out by the surveys statistics, which show that executives expecttheir budgets or cloud products and services to grow signicantly as a percentageo annual IT expenditures. For example, 17% o enterprises will have more than20% o their budgets dedicated to cloud-based services by the end o 2012, uprom 6% in 2011. Such growth, says Howard, will be driven by many actors, notleast o which is the numerous early success stories coming to light. Companies,says Howard, know that their competitors are eyeing this and they realize theycannot aord to get let behind.



In looking or urther clarity on what these numbers mean by region, the ollowingcharts indicate that uptake is considered to be higher in Asia Pacic comparedwith Europe or the Americas. By 2012, Asia Pacic respondents expect to spend22% o their total IT budgets on cloud, compared to 13% and 18% in Europe andthe Americas, respectively. The greatest uncertainty about budget allocated tocloud is in the Americas and Europe, where about 18% o respondents share thatuncertainty, compared with 11% in Asia Pacic.


23/52

Americas Region:What do you estimate your organization will budget for cloud as a

percentage of your annual IT expenditures in each of the next 2 years?

11%

13%

10%

3%

7%

6%

21%

20%

21%

18%

18%

18%

22%

11%

Americas 2011



Americas 2012

0 5 10 15 20 25

Don't know

More than 20%

11-20%

6-10%

3-5%

1-2%

0%

EMA Region:What do you estimate your organization will budget for cloud as a


7%

14%

11%

26%

20%

19%

25%

13%

13%

17%

20%

3%

8%

4%

0 5 10 15 20 25 30

Don't know

More than 20%

11-20%

6-10%

3-5%

1-2%

0%

EMA 2011



EMA 2012




24/52

Global (all respondents):What do you estimate your organization will budget for cloud as

a percentage of your annual IT expenditures in each of the next 2 years?

13%

24%

20%

13%

19%

16%

5%

24%

6%

11%

17%

17%

8%

5%

Global 2011 Global 2012

0 5 10 15 20 25

Don't know

More than 20%

11-20%

6-10%

3-5%

1-2%

0%



ASPAC region: What do you estimate your organization will budget for cloud as a


6%

14%

26%

21%24%

22%

11%

12%

14%

18%

7%

13%

3%

7%

ASPAC 2011



ASPAC 2012

0 5 10 15 20 25 30

Don't know

More than 20%

11-20%

6-10%

3-5%

1-2%

0%



As or deployment models, respondents currently plan to rely most oten on a privatecloud. This is particularly true o end-users rom companies with revenues greater thanUS$1 billion, in which 47% plan to deploy a private cloud model. There are industry-specic dierences in the adoption o private vs. public cloud. Not surprisingly, heavily

regulated industries, such as nancial services and healthcare, demonstrate a strongerlikelihood o adopting a private cloud. Additionally, mature manuacturing rms andretailing rms are opting or private clouds in stronger numbers.


25/52

Private

Public

Hybrid

Community

No cloud

Dont know

IT vs. non-IT organizations:What type of cloud environment does your

organization use/intend to use?

46%

39%

30%

30%

33%

33%

17%

15%

5%

8%

8%

15%

IT Non-IT

0 10 20 30 40 50



Private

Public

Hybrid

Community

No cloud

Dont know

Companies by revenue size:What type of cloud environment does your organization

use/intend to use?

All < US$1b > US$1b

41%

30%

33%

34%

34%

16%

15%

17%

7%

5%

8%

13%

11%

16%

31%

30%

39%

47%

0 10 20 30 40 50






26/52

All sectors:What type of cloud environment does your organization use/intend to use?

41%42%

42%42%

33%

30%42%

31%37%

25%29%

16%26%

18%26%

35%6%

16%17%

21%23%

11%

11% 16%11%

4%13%

15%28%

7%7%

5%2%

7%12%

6%8%

9%3%

8%22%

14%5%

8% 10%19%

21%9%

21%24%24%

15%11%

37%44%

46%20%

22%30%

31%22%

34%31%

28%

45%45%

46%34%

46%31%

29%

11%

All Sectors



Technology Financial Services

Diversified Industrials/Manufacturing Retailers Government

Healthcare and Pharma Consumer Goods Manufacturers

Energy and Natural Resources

Food and Drink Manufacturers

AcademiaCommunications & Media

0 10 20 30 40 50

Dont know

Cloud is not/will not be used by my organization

Community cloud (a rules-based environment

shared by organizations with similar needs,

perspectives or requirements, such as

geography, industry, supply chains, etc.)

Public cloud (a shared environment

used by many organizations)

Hybrid cloud (a combination

of public and private cloud)

Private cloud (a closed environment for a single

organization hosted by a third party)




27/52

Public clouds lag. For now.

Fewer respondents consider either a public cloud or a community cloud a rules-based environment shared by many organizations and groups.

However, this is something that could change over time as trust in public cloudmodels increases. Outsourced services like payroll and HR have been on a sharedserver or many years. Eventually, people may become less concerned with a publiccloud as they are today.

While ewer companies may consider a public cloud, to make an inormed choicethey may nonetheless need to understand how a public model operates. Manyimportant actors are nancial. Buyers considering a private cloud need to askwhether they want to take ownership o the equipment or access the usage in

the manner o a public cloud. Ultimately, many wonder what is really gained indeploying a private cloud. Economics are dependent on the individual situation, andpros and cons exist or both. Many will compromise into some orm o both models,depending on the application.

Examples o how organizations are using the cloud to transorm their businessesexist throughout the world. To better dene practical usage o the cloud, we oer aew examples.

Private vs. public cloud fnancial services

One KPMG client in the nancial services industry was acing signicant marketpressures, regulatory pressures and security issues. The IT organization was trying

to help new products get to market quickly with agile processes while acingpressure to reduce costs. The environment was complex and highly heterogeneous,which led to high support and maintenance costs.

To evaluate and prepare or the cloud, the company began by determining whattype o cloud would best suit their needs. They assessed their readiness or changeby looking at governance, process, compliance and technical architecture. Theylooked at applications, and most importantly, they assessed the people, processand technology critical to operationalizing within the cloud.

Based on security and technical actors, they chose a private cloud, and the costsavings justied the move orward.




28/52

Outsource IT frst, cloud next energy

Another KPMG client, a large energy company, had outsourced much o its IT

unction several years beore. The size o that project and the scale o change

it required led to a painul process that ultimately did not result in the savings

expected. Nonetheless, having reviewed the lessons learned rom this experience,

company leadership decided it was ready or a large-scale cloud migration.

In some respects, this company sees the promise o cloud as being similar to that

o outsourcing. Motivated by the ability to ocus on its core competencies and on

growing the business, this organization has ound viable options in the market to

handle the capacity o its thousands o servers.

The business intends to migrate more than 50% o its inrastructure assets to a

cloud environment. The migration is targeting the most modern applications andinrastructure; legacy and old line applications continue to present challenges in

a cloud environment. As with the adage: one rock moved tends to uncover an

unanticipated issue or problem as the testing o the legacy applications continue.

Successul migration o non-core applications to a cloud inrastructure should enable

the company to reach its goal, control its costs and help it grow aster.




29/52

Adopting cloud services

About hal o end-users (46%) say their most likely investments will be in cloud-delivered Sotware as a Service (SaaS). However, at 35% and 34% respectively,Inrastructure as a Service (IaaS) and Platorm as a Service (PaaS) also gureprominently in corporate cloud investment.

46%

35%

35%

34%

41%

32%

33%

9%

14%

10%

16%

9%

10%

48%

45%

0 10 20 30 40 50

SaaS

PaaS

My organization does not have plans

to invest in a cloud environment

Dont know

Which of the following cloud environments will your organization most likely invest in?

Total Users (n = 805) Users (IT) (n = 237) Users (Business) (n = 568)

IaaS

SaaS (Software as a Service): Software and applications to run various business operations over a network.

Examples include: salesforce.com, Google Docs, mobile me, Microsoft Office Live

IaaS (Infrastructure as a Service): Renting shared computing infrastructure, such as servers, storage, processing capacity,

database and other peripherals. Examples include: amazon.com, rackspace

PaaS (Platform as a Service): A platform that enables developers to write applications to run on the cloud.

Examples include: force.com, Google App Engine, Windows A zure






30/52

Which of the following cloud environments will your organization most likely invest in?

46%

47%

38%

55%

44%

9%

10%

11%

7%

14%

16%

16%

9%

Global Americas



EMA ASPAC

0 10 20 30 40 50 60

35%

34%

28%

27%

33%

33%

49%

SaaS

IaaS

PaaS

My organization does not have plans

to invest in a cloud environment

Dont know

SaaS (Software as a Service): Software and applications to run various business operations over a network.

Examples include: salesforce.com, Google Docs, mobile me, Microsoft Office Live

IaaS (Infrastructure as a Service): Renting shared computing infrastructure, such as servers, storage, processing capacity,

databases and other peripherals. Examples include: amazon.com, rackspace

PaaS (Platform as a Service): A platform that enables developers to write applications to run on the cloud.

Examples include: force.com, Google App Engine, Windows Azure

The chart below highlights regional dierences in cloud service model investments.Underscoring Asia Pacics enthusiasm or the cloud, these results indicate astronger than average anticipated investment in SaaS, IaaS and PaaS models thanexpected in the Americas or EMA.




31/52

Has total cost o ownership beenevaluated properly?

Three-quarters orespondents go on tosay that cost savings/reductions are essentialbeore they will take anysignicant steps towardthe cloud.

Cost savings are generally a required outcome o cloud migration. Traditional thinkingis that cloud has the potential to signicantly reduce IT costs as companies are ableto shit rom large capital expenditures to ongoing operational outlays. Putting manyinrastructure and development initiatives in the hands o third parties also has thepotential to reduce sta costs.

In migrating to the cloud, three-quarters o respondents (77%) say that economicactors are important (40%) or extremely important (37%). That is, these companieswill not migrate to a cloud environment without meaningul savings. Worth noting isthat equal percentages o IT and non-IT executives, 75% in both instances, maintainthis view regarding the importance o cost.

Key cloud cost drivers, many hidden

Total cost o ownership is a critical aspect o migrating to the cloud. While costsavings, potentially signicant, are typically advertised and assumed, extensive,well-documented evidence does not exist to veriy that companies have realizedsuch savings. It is critical that buyers closely scrutinize potential and claimed cloudcomputing savings across the liecycle o a cloud deployment. In this process, it isimperative to consider actors that may drive cost and risk assessments, such as:

Costsofintegrationintolegacysystems

Customizationandconguration

Ongoingusertrainingandretrainingand

Supportcosts.

Extremely important

Important


Unimportant


37%

40%

19%

3%


Examples of economic factors include: cost savings, shifting capital expenditures to operational expenditures.


2%

How important are economic factors in driving your organizations adoption of a cloud environment?

0 10 20 30 40 50




32/52

Overheadandcomplexityofmanagingmultipleclouddeployments

Serviceprovidermanagement/relations

Security

Controlsandassurance

Organizationalprocesschangetoadapttocloudstandardization

Supplyanddemandchallengesresultoverestimatingcomputingneeds

Taximplications

Reduced costs, says SAPs Dr. Bernd Welz, are a prominent eature o a cloud-based approach. The total cost o ownership o hardware and sotware, includingstang costs, should be without question, lower within a cloud environment. Suchlower costs should in turn translate into lower IT overhead allocations or businessunits.

But other cost benets are also evident. Consider a start-up or rapidly expandingenterprise. Recruiting and maintaining IT sta takes time and eort and leads tohigher ongoing costs, says Welz. Companies must retain enough IT personnel tohandle peak periods o eort, resulting in excessive stang costs. Overall, saysWelz, relative to the traditional approach to enterprise IT, companies should expectthe cloud to be a lower cost solution.

Voicing an even stronger message on economic benets is IBMs Howard.Nothing happens i the economics arent there, says Howard. But in this case,

cloud environments are poised to deliver a step change. Look at the potentialimprovements in asset utilization and shared services models and you recognizethe price point or each unit o IT value delivered is about to plunge. To Howardsthinking, I believe corporations [cost reduction] expectations should be rightthrough the ceiling.

Expectations gap

An intriguing nding o the parallel studies is the gap in expectations between end-users and providers o cloud services. Both end-users and providers were asked:what threshold o savings would be necessary to prompt the shit to a cloud-basedenvironment? Looking at IT costs alone, 45% o end-users say they could bepersuaded with savings o merely 1% to 10%. By comparison, providers tend to

believe that end-users will demand much more. While only 10% o users say theywould need savings o 25% or more, the gure rises to 19% or providers.

The realization: this question is about perception, not providers actual costs, and

providers may actually be overestimating the degree of savings end-users may

demand. Each party needs to take steps to understand pricing requirements and

total costs.

Providers think thethreshold needed or ITsavings is signicantlyhigher than users do.




33/52

What percentage reduction in IT or Non-IT costs do you generally believe would be needed?

IT Costs (n=565)

Providers

Users



Non-IT Costs (n=551)

IT Costs (n=91) Non-IT Costs (n=88)

45%

42%

31%

33%

34%

28%

37%

31%

10%

15%

19%17%

12%

14%

13%

19%

0 10 20 30 40 50

110% reduction

1125% reduction

More than 25% reduction

Dont know

Percentagereduction

in

IT

and

Non-IT

costs




34/52

Functionality is essential; it is aquestion o good enough vs. perect

Executives meanwhile insist that cloud environments should score equally highmarks on technical and unctional capabilities. Eight o ten users (80%) maintainthat unctional actors such as speed to solution and widespread accessibility are either important (43%) or extremely important (37%). Similarly, 79% say thattechnical actors such as fexibility, scalability, security, and advanced technology areeither important (42%) or extremely important (37%).

For cloud-delivered products and services to take hold, says Michael Sylvia,Distinguished Engineer & Director at IBM, end-users have to see the value too.IBM provides cloud-based services both internally and externally. With regard toother IBM business units, Sylvia says cloud services are being very well received.

Development and testing

Take or example the provisioning o development testing environments orprogrammers. In the past, sotware developers would approach the IT teamwith highly detailed requests speciying a range o programs, releases and othervariables. Responding, says Leslie Gordon, Vice President, Oce o the CIO atIBM, could take as long as a week and it was labor intensive. Today, however,IBM oers its sotware developers a cloud-delivered, sel-service provisioning tool.Developers dont have as many options, says Gordon, but they can requestsomething thats close enough to what they need and have it in an hour. This rapidlevel o deployment, however, assumes that contractual constructs are in placeand that ideally the user organization is able to adequately manage this level o on-demand consumption.

In addition, developers can make their requests any time o the day or night.Moreover, they can pause their work, save their projects and remove them rom theserver, thereby reducing internal ee allocations and reeing up resources that canbe used to support other developers.

Sel-sourced environments

Initially, Gordon and Sylvia believed that the existence o the new provisioning toolmight reduce the number o requests or manually congured test environments byas much as 40% or 50%. But in practice, 80% 90% o test environments are nowsel-sourced through the cloud. As Sylvia explains, it turns out that developers aremore interested in agility than they are in getting their environments perect. AddsGordon,theyre willing to settle or good enough as opposed to perect i they canget it ast and that translates into eciency all around.

Functionality is also o critical importance to ENELs Sperzani. And it is or thisreason, the executive maintains, that mission critical processes are not likely to behanded over to a cloud provider. We have a ew that are unique to our business andwhere we are very sophisticated in-house. We are already running these processesat a low cost, explains Sperzani.

Still, the executive believes there will be ample opportunity to benet romcloud service providers in specic niches. There will be a layer within ourprocesses where someone may be better than we are. This is particularly true o

It turns out thatdevelopers are moreinterested in agility than

they are in getting theirenvironments perect.




35/52

inrastructure. Sperzani continues, Basically, I see this as a possibility to buy

inrastructure or varying volumes as a service... Inrastructure tends to be very

rigid. I like the idea o something much more exible.

Leading edge technologies

SAPs Welz says that access to such leading-edge technical/unctional capabilities,

is one o the most attractive aspects o the envisaged cloud environs. But or cloud

providers, IT is what we do, says Welz. As such, the very business model o cloud

providers depends on the delivery o seamless, ultra-efcient, stable and exible IT

services. Moreover, providers can take advantage o scale to continuously invest

in and refne their technologies and processes assuming they are proftable, o

signifcant scale, and fnancially sound enough to withstand a dynamic marketplace

because not every cloud provider will survive in the longer term. So to the extent

a greater share o IT operations is ceded to specialist providers, organizations can

share in scale economies that would not otherwise be available.

At UniCredit, Interoperability is key, says CIO Massimo Milanta. UniCredit is in the

early stages o assessing the cloud. The executive is already assuming that costs

within a cloud ramework should be signifcantly lower than within a traditional

IT department. So the real questions or UniCredit, says Milanta, are technical in

nature. And the early answers are that, or now, the lions share o the banks current

IT ootprint is not yet cloud ready. The group could probably migrate a discrete

unction or two, such as email management, into the cloud right now. But overall,

much more would need to be done beore any larger, more critical or material

systems could be transitioned. Says Milanta, We are just a couple o years into

transorming our inrastructure rom many platorms to something much more

standardized. Once that work is urther along, we can

or us, we are preparing or the cloud, but it will be a lo

take another, closer look. So

ng journey.

The role o CIO needsto evolve rom ChieInormation Ofcer

to Chie IntegrationOfcer, to lead andintegrate the businessmore tightly withenabling technologiesand to ensure theinteroperability o anincreasingly disparateset o applications andinrastructure.




36/52

Extremely important

Important


Unimportant


How important are technology factors in driving your organization's adoption of a cloud environment?

37%

42%

16%

3%

1%

Examples of technical factors include: flexibility, scalability, simplicity, security, advanced technology



0 10 20 30 40 50

Extremely important

Important


Unimportant


How important are functional factors in driving your organization's adoption of a cloud environment?

37%

43%

16%

3%

1%

0 10 20 30 40

Examples of functional factors include: speed to solution, functional capabilities, everywhere accessibility


KPMG anticipates that the role o the CIO will change signicantly as organizationsstruggle with the dynamic integration needs that cloud models present. A new,or evolved C-position, Chie Integration Ocer, will be needed to integrate thebusiness more tightly to technology and to ensure the interoperability o anincreasingly disparate set o applications and inrastructure.




37/52

What do you believe are the top challenges or concerns your organization faces in

adopting a cloud environment?

44%

29%

20%

18%

16%

15%

15%

14%

13%

13%

13%

12%

9%

8%

2%

0 10 20 30 40 50

Other

Dissatisfaction with

offerings/pricing by vendors

Lack of customization opportunities

Difficulty making a business case

for adopting a cloud environment

Not sure the promise of a cloud

environment can be realized

Lack of confidence in ability of cloud

vendors to perform

Response time

Regulatory compliance

Measuring ROI

Availability

Loss of control over data with respect

to customers

IT governance

Difficulty integrating cloud

with existing systems

Performance

Security



Security and perormance concerns

While cloud may promise signicant benets, it also has its risks. Depending onthird-party providers raises the stakes or many users, particularly when theyare accustomed to overseeing and managing critical issues such as security andperormance. Importantly, security is a challenge inside and outside o the cloud.Breaches across the spectrum o providers, organizations and global corporationsexist in and out o the cloud.

When asked about the top challenges/concerns they aced in adopting a cloudenvironment, 44% o end-user respondents cited security, and 29% expressedconcern about overall cloud perormance. One th o companies cited concerns overinteroperability or integration. Arguably, the interoperability and integration issues

will create more challenges over time as organizations look to better leverage internaland external data and inormation. Other key concerns include IT governance, loss ocontrol over customer data and availability.




38/52

Some of the key risks and challenges in adopting cloud

Cloud adoption requires a careful examination of the potential operational risks and challenges in addition to the technology questions.

Financial Managementand Tax

Movement from CapEx to OpEx model impacts existing budgeting, forecasting, and reporting processes

CapEx to OpEx model and changes in the character and source of service impacts tax considerations

Outdated tax laws and regulations create uncertainty when characterizing the various cloud transactions

Cloud ROI and cost/benefit analysis are complicated by need for knowledge of existing cost of delivery

and future use of service.

Operational

Cloud adoption introduces rapid change in the organization

Cloud sourcing may impact existing organizational roles and could require new skills or make others redundant

Business resiliency/disaster recovery needs and plans will change and require updating.

Security and

Privacy

Data may be stored in cloud (1) without proper customer segregation allowing possible accidental or

malicious disclosure to third parties and/or (2) in a legal jurisdiction where the rights of data subject

are not protected

Loss of governance of critical areas, e.g., vulnerability management, infrastructure hardening, or physical security

Weak logical access controls due to cloud vendors IAM immaturity.

Data &

Technology

Risk of creating independent silos of information perpetuate the problem of data integrity, quality, and insight

Business can bypass the IT function to implement technology solutions, posing challenges for IT governance

Cloud delivery models dramatically change how IT delivers technology services to support business requirements

Cloud adoption opens the four Data Center walls to external IT Services providers, creating new risks.

VendorManagement

Lack of clarity of ownership responsibilities between cloud vendor and user company

No prevalent standards for vendor interoperability

Extensive reliance on CSPs.

Regulatory and

Compliance

Lack of visibility into the Cloud Service Providers (CSPs) operations inhibits analysis of its compliance

with pertinent laws and regulations

Complexity of records management/records retention creates challenges

Lack of industry standards and certifications for cloud providers creates risks.

Security in the cloud presents unique actors to consider ranging rom externaldata storage, to multi-tenancy, use o the internet and the need to integrate back tointernal applications. Can you encrypt your data suciently to be able to trust a thirdparty managing this critical inormation? Will your data governance model allow or acloud migration?




39/52

Virtually all interviewees maintain that security is paramount. However, as HDFCBanks Jaggia explains, the real issue is whether data is held in a public or privatecloud. I we stay in a private cloud with standard security measures and rewalls,and no co-mingling o data, I do not see security as a key issue. Moreover, as longas the cloud is private, I do not believe it will be an issue or regulators, who areotherwise aggressive in policing privacy and related issues in the banking industry.Perormance issues the importance o cloud providers avoiding downtime andmaintaining agreed-to service levels also gure prominently among both end-userand provider interviewees.

However, in the case o both security and perormance, providers participating insurvey interviews say that such concerns are in some ways overblown. Considerseveral recent episodes o prominent cloud-providers experiencing signicantdowntime. As SAPs Welz explained, Any data center at any company can go downrom time to time. And i its a server o a mid-market company, it wont be in thenewspapers you will never hear about it. Theres risk in running your own servers.

By comparison, says Welz, the risk o a cloud provider ailing materially or anyextended period is substantially lower. So the overall risk prole o a cloudenvironment versus in-house IT, says Welz, is like that between fying an airplaneand driving a car. We eel sae in our cars when we all know, statistically, we arear saer in the airplane.

Compliance isnt that important, until it is

Responsibility or compliance remains with the customer, not the cloud vendor, so

care and discretion are warranted. End-users will need to keep a close watch onthe reliability and controls put in to place by the scores o would-be cloud serviceproviders. This vigilance will be especially important or business executives whoare accountable or managing the risks o potential security breaches and overallperormance. As JWTs Mehta explained, his company is Sarbanes-Oxley-compliant(SOX). So i we are going to allow anyone to host our applications or data, we willneed to know i they in turn are SOX-compliant. And our clients will want to knowtoo. So in truth, says Mehta, cloud-based services will need to be more rmlyestablished as accepted, sae and reliable beore we proceed with anything ogreater signicance.

As a result, reporting standards are changing. Statement on Accounting Standards70 (SAS 70) reports do not review and account or the collocation o data, and assuch, new Service Organization Control (SOC) reports, specically SOC 1, SOC 2 andSOC 3 are now ocusing on issues prevalent within the cloud, such as collocation.The SOC reports now include a test o security, not available beore through SAS 70.

Interestingly, in a cloud environment, end-users attempting to audit their transactionsand processes may nd them co-mingled with others and unable to provide an audito their transaction as beore. Please see the Issues and Implications section atthe end o this report or suggestions o topics to cover during the review process oevaluating cloud.

Cloud-based serviceswill need to be morermly established asan accepted, sae andreliable set o businessprocesses.

The risk o a cloudprovider ailing mateor any extended peis substantially lowe(than in-house IT).

riallriodr

y




40/52

Tax in the equation,a relevant variable

Only respondents in the United States were asked their views on taxes withrespect to the cloud. Interestingly, almost 45% o both providers and users eitherhave not considered cloud-related tax issues or dont know i their organizationshave done so. KPMG rms experience shows that organizations operating in thecloud should address critical actors such as a migration rom capital expenditures

to operating expenditures, character and sourcing o income, implications ointercompany charges and the impact o using third parties or services rather thaninternal employees. These issues are manageable, but they should be addressed toreduce the risk o tax exposure. Importantly, organizations that proactively manageand plan or the tax issues associated with operating in the cloud may unlocksignicant value or their organization.

Yes, from a tax strategy perspective

Yes, in terms of compliance and reporting

Yes, in terms of strategy,

compliance and reporting

No, we have not consideredtax separate from other business decisions

Dont know

24%

24%

20%

23%

23%

31%

18%21%

21%

10%

21%

25%

26%

26%

17%

20%

17%22%

20%

21%

Have you considered the impact of cloud migration on your organizations taxes?

Total Users U.S. Total Users U.S. Users (IT) U.S. Users (Business) U.S. Total Providers

0 5 10 15 20 25 30 35

16%14%

14%

8%16%

Figures may not add up to 100% due to rounding





41/52

Who should lead cloud eorts?

It is critical that IT, thebusiness, audit, risk,compliance and taxteams are consultedwhen migrating to thecloud.

Traditionally, cloud is seen as an IT issue, but many organizations would like to seeadoption driven by corporate strategy, not IT. The transormative impact o cloud willundoubtedly require leadership rom the business.

Asked which executive should lead eorts toward cloud adoption, about our-in-10end-user survey respondents cited either the Chie Inormation Ocer (25%) orChie Technology Ocer (14%). Similar percentages chose strategic and operationalC-suite executives, including the CEO (23%), COO (11%), and CFO (7%).

As might be expected, a respondents opinion on who should lead cloud adoptionmay depend on the persons current responsibilities. Those involved in technologyare more likely to turn to the CIO; those in operations and strategy point to theCEO. This survey did not ask about everyone who should contribute to the cloudconversation. While it inquired about the leaders, it is critical that IT, the business,audit, risk, compliance and tax teams are consulted when migrating to the cloud.

It is also important to dierentiate between dierent orms o leadership. A CEO,or example, along with a board o directors and an audit committee, might lead insetting the overall cloud agenda and dening levels o investments, but the CEO

should not lead operationally. Clarity around the transormative nature o cloud cancome rom across the C-suite. Business unit executives may take charge o deningbusiness requirements and benets, with IT executives dening and managing thetechnical architecture and leading cloud oerings technical vetting eorts.

In your opinion, who in your organization should lead the process of cloud adoption?

23%

7%

11%

25%

14%

1%

1%

13%

5%

0 5 10 15 20 25

Other

General counsel

Line of business heads

Other C-level executive

CTO

CIO

COO

CFO

CEO



2011 KP

embracing cloud kpmg

Documents