Best Practice in the Cloud: An Introduction Using ITIL® to Seize the Opportunities of the Cloud

The purpose of this white paper is to introduce the challenges of managing an IT environment in a cloud setting. It identifies the benefits of cloud computing and the potential unintended consequences – and how ITIL provides the foundations for best practice in a cloud environment.

This paper is intended for:

• IT service management (ITSM) professionals already using ITIL in a cloud environment
• ITSM professionals who understand ITIL and its benefits, and want to adopt and adapt ITIL for their cloud requirements
• IT service providers consuming cloud services
• Cloud service providers.

1.1 USING A BEST-PRACTICE APPROACH FOR THE CLOUD-ENABLED FUTURE

The advent of cloud computing models is one of the hottest topics in enterprise IT, and arguably in business as a whole.

By enabling organizations to source IT services, infrastructure and applications on a flexible pay-per-use basis, and to provision and retire them as appropriate in line with changing business volumes and needs, cloud computing opens the way to major benefits across the organization. These include new levels of agility, cost variability, responsiveness to change, speed to market and a reduction in overall lifecycle costs.

A new role for ITSM

Cloud provisioning brings opportunities to maintain and enhance ITSM’s relationship with the business. It is the responsibility of ITSM to understand the needs of the business and source appropriate services to meet those needs. ITSM must respond to business needs while simultaneously sustaining the bedrock of IT security and control, and empowering the organization to innovate faster in response to opportunities and risks.

Cloud computing can change the role of ITSM within an organization. The role of the service provider becomes more complex, with ITSM becoming an informed customer acting on behalf of the business.

The attractions of the cloud

The benefits that the cloud presents for ITSM and the organization as a whole mean that many CIOs, along with other leaders in IT and the business, are eager to adopt cloud models. Rather than making and maintaining IT services in house, IT wants to procure them externally at a cost that is aligned with usage. Business units are also attracted by this move to a more flexible and responsive form of IT provisioning. At its simplest, the cloud means they can order up a service and start using it from Day 1.

The flexibility offered by the cloud enables IT service providers to play a more strategic role in the business. ITSM has the opportunity to move beyond its traditional focus of cost-cutting and become revenue-generating – for example, by entering new markets, commercializing innovative products and services, or offering more compelling customer-value propositions.

IT organizations have begun to apply cloud capabilities in a manner that opens up the opportunity landscape in areas other than operational excellence. Rather than constraining strategic opportunities, they are making explicit contributions in areas of product leadership, customer intimacy, operational excellence and adaptive delivery (see Figure 1). These terms are explained below:

• Adaptive delivery Focuses on the configuration of services around a product rather than the product itself (e.g. service offerings at the right time and place, responsiveness to customer urgency). Retail companies, for example, have gained improved delivery responsiveness in the face of market demand fluctuations through the application of cloud capabilities.
• Operational excellence Focuses on optimizing the production and delivery of services or products, thereby enabling competitive pricing or distinctive capabilities (e.g. improving costs, improving reliability, optimizing processes, standardizing service).
• Product leadership Helps strategic business units (SBUs) enhance their customers’ use or application of their product, thereby making rivals’ products obsolete (e.g. improving products (goods and services), innovation, rapid commercialization, maintaining an entrepreneurial posture, pursuing new solutions or markets). Cable companies, for instance, have gained improved product capabilities by redeploying cable content through commercial cloud solutions.
• Customer intimacy Focuses on long-term relationships with customers rather than customer transactions (e.g. meeting demands with greater precision, decentralizing the organization, segmenting markets). Financial service firms, for example, have encountered the shortcomings of monolithic operating models (gained through consolidation efforts) delivering similar services to trading desks as they would to a retail bank, but frustrating both. Through the use of cloud capabilities, these firms are delivering services more specific to each SBU without surrendering the cost structures.

The challenges of the cloud

As well as clear benefits, cloud computing presents some challenges. Major corporations have already experienced some of the risks associated with cloud computing – including infringements to data regulations, wide levels of data duplication and system conflicts.

Mistakes in putting business services, especially mission-critical services, in the public cloud could result in major market issues, incidents and downtime, and less reliable services. The ease and speed with which a vast array of cloud services can be bought and provisioned creates an insidious trap for those organizations that fail to think through the full implications. Server virtualization is a good example of this.

When virtualization came on the scene, buying it was an obvious and easy choice for most IT functions. It enabled IT to cut costs by consolidating physical machines into virtual machines – simultaneously boosting hardware utilization and addressing issues such as server sprawl. Virtualization showed itself to be a legitimate solution for a set of complex problems.

It seemed like an obvious and simple solution. The drawback, as usual, lay in the immutable law of unintended consequences. If virtualization was treated solely as a technology issue, it had the potential – alongside solving some problems – to create a new problem, by adding a further layer of complexity to every process and function across the organization, from fixing breakages to running helpdesks.

The underlying issue was that, in the rush to virtualize their hardware, many IT organizations had failed to ask how they would govern and manage the new environment. As a result, they ended up simply replacing physical server sprawl with virtual server sprawl. So the benefits realized with one hand were effectively taken away with the other.

Learning lessons

Fast-forward to the expanding wave of cloud services targeting a comprehensive array of organizational functions, ranging from enterprise resource planning (ERP) to customer relationship management (CRM) to human resources (HR).

This means taking a holistic view that looks beyond the immediate cost opportunities of the cloud, and encompasses the need to maintain rigorous management, control and visibility over the full ITSM lifecycle – whether it’s utilizing cloud services or not. Organizations that fail to do this, and instead think about the cloud in a narrow and siloed way, will find themselves giving back a lot of the gains through unforeseen problems around costs, duplicated effort, serviceability, flexibility and availability.

Focusing on the service issues, not just IT

The key to avoiding these pitfalls is to take account of the underlying service challenges and solutions, not solely those around technology. For a global organization, the business issues that the cloud is used to address will vary between different areas of the organization – a diversity that serves to underline the need for a service management-focused approach to delivering and consuming cloud services.

For example, some geographies or divisions may want to use the cloud for CRM, others for ERP integration, still others for selected business support processes, and some for experimenting with social media. These activities cannot all be micro-managed by the central business, which would actually hinder their responsiveness to local business needs. But, without reducing their effectiveness or the resulting benefits, these diverse cloud programmes can be required to comply with an overarching management framework that ensures consistency and visibility.

1.2 GOVERNANCE FOR CLOUD COMPUTING

What is governance?

Definition: governance Ensures that policies and strategy are actually implemented, and that required processes are correctly followed. Governance includes defining roles and responsibilities, measuring and reporting, and taking actions to resolve any issues identified (ITIL Glossary).

Governance is the single overarching area that ties IT and the business together, and services are one way of ensuring that the organization is able to execute that governance. Governance is what defines the common directions, policies and rules that both the business and IT use to conduct business. Many ITSM strategies fail because they try to build a structure or processes according to how they would like the organization to work instead of working within the existing governance structures.

Changing the organization to meet evolving business requirements is a positive move, but project sponsors have to ensure that any changes are accepted and approved through a defined governance process. Failure to do this will result in a break between the organization’s governance policies and its actual processes and structure. This results in a dysfunctional organization, and a solution that will ultimately fail.

Service governance and management structures

A key component of a cloud architecture is service governance. Service governance defines, communicates and automates the policies, standards and principles applied to the service provider in providing cloud services. Governance is defined and enforced through the cloud architecture, financial management for IT services and service portfolio management. The service strategy phase of the lifecycle is key in defining the standards, governance, models and content of a cloud architecture.

The game-changing shift to cloud computing means that the ITSM function now, and in the future, will need to adapt and grow its own best practices, such as ITIL, to enable it to handle the increased complexity and flexibility that comes with cloud enablement. ITIL provides the best-practice foundations on which to build cloud capabilities. Organizations can adopt and adapt ITIL best practice to suit their cloud requirements. Crucially, developing this new type of ITIL-based management is not an option for IT. Instead, it’s an absolute necessity if ITSM is to maintain its relevance and influence in the organization.

In a world where any business unit can buy new cloud services at will, there is a real risk of IT being bypassed and losing relevance. To avoid this disintermediation, ITSM must understand both the technology itself and the business issues it is being used to address. And ITSM must then go on to apply this understanding in order to strike the right balance between rigorous management and the nimbleness that cloud solutions can offer.

To achieve these outcomes, IT will need to create governance and management structures that are appropriate across all aspects of the environment – including processes and workflows, governance policies and cloud service evaluation and selection. And it will need to tie these together operationally by applying capabilities in operating model design.

ITIL is not a complete, ready-made answer for cloud environments. But what ITIL does provide is a proven framework that can be supplemented and refined with cloud-specific content, thus repositioning and readying ITSM for the cloud journey.