Manage Learn to apply best practices and optimize your operations.

Crafting a cloud computing strategy that covers cost and compliance

Our CIO columnist consults his peers about a cloud computing strategy that addresses cost, compliance and security concerns. Does cloud computing fit into his business needs?

Not to sound too much like some old guy grousing about the actions of those "young whippersnappers," but I have seen IT fads come and go. Some years ago, right after Al Gore invented the Internet, there was a wave of application service providers (ASP) and managed service providers (MSP). Some of these survived through the years, but many faded away because the market -- and we are the market -- was just not ready to accept somebody else running our applications and services.

Niel Nickolaisen
The Real Niel
Niel Nickolaisen

The current market excitement is cloud computing. For an old-timer like me, the buzz around cloud computing reminds me of the ASP/MSP fad. If cloud computing is for real, however, I don't want to miss out, so I am trying to objectively determine if a cloud computing strategy will help me generate business value.

I am approaching my cloud computing strategy analysis in the same way I gather answers to many of my IT questions: I am asking my network of nerds. Over the years I have kept the contact information for about 200 of my CIO peers. This network is an invaluable resource, one with experience and reach far beyond my own.

To get a better sense of the realities of cloud computing, I sent an email to my network to find out which services they either already had moved or were considering moving to the cloud.. I also asked them about the value proposition that made a cloud computing strategy compelling. On the other hand, if they were not considering cloud offerings, I wanted to know why.

I learned that quite a few of my CIO peers have moved their email and spam filtering into the cloud, saving their bandwidth for legitimate email traffic. Several have been bold and brave enough to move their entire email infrastructure into the cloud. A smaller group is actively moving storage, backup and recovery into the cloud. They have found this lowers both acquisition and support costs dramatically as it actually improves service levels. In addition, they like the flexibility of adding and subtracting services and users on demand.

Those not pursuing a cloud computing strategy yet most often cite cloud security as their primary concern. If their critical data exists on someone else's cloud infrastructure, how can they be sure who is accessing and safeguarding it?

Others balk at the cloud computing cost model -- myself included. I paid for my email infrastructure long ago, but if I were to now shift to a cloud email model, I would be spending new money rather than merely paying for ongoing support. If a cloud service can get its price close to my ongoing support costs, however, I will make the jump.

I also contemplate how cloud services could complicate or simplify regulatory compliance. My most dreaded current Sarbanes-Oxley Act task is poring over and responding to SAS70 audit reports from my normal service providers.

I do think cloud computing is here to stay, rather than being just the latest in a long line of IT fads. It's not because cloud services are better, but because our attitudes have changed, our markets are more fluid and the demands on technology are higher than ever. By implementing and succeeding with virtualization, moreover, we have accepted the idea that we don't need to match a service to a server. These demands, as well as our virtualization experience, have lowered our cultural resistance to the idea of remote systems that aren't entirely in our control.

Right now, early adopters of a cloud computing strategy are blazing the trail, and cloud service providers are working through security, data management and pricing model issues. In parallel with that, I am experimenting with storage in the cloud by moving some of my company's non-critical archival data. We also are backing up our remote offices in the cloud. These pilots are giving us the context so that we can implement other cloud services when the timing, security and pricing model are right.

I hope this cloud computing strategy keeps me off the list of the old guys who won't change a thing.

Niel Nickolaisen is CIO at Western Governors University in Salt Lake City. He is a frequent speaker, presenter and writer on IT's dual role enabling strategy and delivering operational excellence. Write to him at

Dig Deeper on Cloud computing for business

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.