Cloud computing service value: A message to the board

Von Solms, R.; Viljoen, M. Article Cloud computing service value: A message to the board South African Journal of Business Management Provided in Cooperation with: University of Stellenbosch Business School (USB), Bellville, South Africa Suggested Citation: Von Solms, R.; Viljoen, M. (2012) : Cloud computing service value: A message to the board, South African Journal of Business Management, ISSN 2078-5976, African Online Scientific Information Systems (AOSIS), Cape Town, Vol. 43, Iss. 4, pp. 73-81, https://doi.org/10.4102/sajbm.v43i4.483 This Version is available at: https://hdl.handle.net/10419/218501 Standard-Nutzungsbedingungen: Die Dokumente auf EconStor dürfen zu eigenen wissenschaftlichen Zwecken und zum Privatgebrauch gespeichert und kopiert werden. Sie dürfen die Dokumente nicht für öffentliche oder kommerzielle Zwecke vervielfältigen, öffentlich ausstellen, öffentlich zugänglich machen, vertreiben oder anderweitig nutzen. Sofern die Verfasser die Dokumente unter Open-Content-Lizenzen (insbesondere CC-Lizenzen) zur Verfügung gestellt haben sollten, gelten abweichend von diesen Nutzungsbedingungen die in der dort genannten Lizenz gewährten Nutzungsrechte. Terms of use: Documents in EconStor may be saved and copied for your personal and scholarly purposes. You are not to copy documents for public or commercial purposes, to exhibit the documents publicly, to make them publicly available on the internet, or to distribute or otherwise use the documents in public. If the documents have been made available under an Open Content Licence (especially Creative Commons Licences), you may exercise further usage rights as specified in the indicated licence. https://creativecommons.org/licenses/by/4.0/ S.Afr.J.Bus.Manage.2012,43(4) 73 Cloud computing service value: A message to the board R. von Solms* and M Viljoen School of ICT, Nelson Mandela Metropolitan University, PO Box 77000, Port Elizabeth 6031, Republic of South Africa [email protected] Received September 2011 This paper aims to alert the board to their duty of adding value to the organizations they represent by recognizing opportunities presented by new developments in information technology. Cloud computing is one such development, which is associated with opportunities and benefits. The service value that can be achieved by using this computing model will be influential in the adoption of cloud computing services. Service value is determined by the warranty and utility associated with that service. Thus, if an organization can associate itself with the utility and warranty on offer via cloud computing, it should consider the adoption of these services. Cloud computing is discussed in terms of service value. This promotes an understanding of factors to be considered when making decisions about the adoption of cloud computing. This material is based upon work supported financially by the National Research Foundation. *To whom all correspondence should be addressed. Introduction Information Technology (IT) plays an integral part in the operation of many businesses today. In view of the critical role of IT, the board of an organization has the responsibility of ensuring that it is governed in a sound manner. In line with governance principles, the board is responsible for ensuring that new opportunities related to innovative IT developments are recognized and acted on, so that value is added to the organization they represent. A relatively new development in IT is cloud computing. There are significant benefits and opportunities associated with this computing model. In order for the board to make a responsible decision with regard to the adoption of cloud computing, the value that can be achieved with this development in IT will need to be analyzed. The IT Infrastructure Library (ITIL) describes how service value can be realized in terms of utility and warranty. This paper discusses the board’s responsibility with regard to IT governance. In particular, it describes cloud computing in relation to ITIL’s description of service value, in order to promote a clearer understanding of factors to be considered when decisions are to be made regarding the adoption of cloud computing. In this day and age, when IT governance is part of the mandate of the board of every organization, it is imperative that proper guidelines be provided to assist the board with these critical decisions. Executives’ IT related responsibilities IT is no longer merely a technical concern which merely involves IT staff. It has become an integral part of all business. The board of an organization, not the IT staff, is ultimately and jointly responsible for ensuring that IT is used in a manner that supports business objectives; and that it is well governed, secure and compliant. Business executives and directors should be aware of the opportunities presented by new IT developments; and they should act accordingly. The following paragraph provides more information on this matter. The board of an organization has the responsibility of ensuring that sound corporate governance is practised in the organization. According to the OECD Principles of corporate governance (2004), a key fiduciary requirement of the board is the duty of care. This requires that the board should always “act on a fully informed basis, in good faith, with due care and diligence.” Since information and IT have become vital to the functioning of most organizations, IT governance is an essential part of all corporate governance. The board is, therefore, required to practise the duty of care with regard to IT. The fact that members of the board may fail to understand the importance and impact of IT on the business has, however, been identified as a problem in the exercising of effective IT governance (Nolan & McFarlan, 2005; Posthumus, von Solms, & King, 2010). Specific responsibilities that the board has with regard to IT governance are highlighted by: The King Report on Corporate Governance for South Africa 2009 (IoDSA, 2009), hereafter referred to as King III, the Board Briefing on IT Governance (ITGI, 2003) and the ISO38500:2008 standard for Corporate governance of information technology. Some of these responsibilities are summarized in the list below. The board of directors should:  Give strategic direction that is in the best interests of the organization. Part of this mandate includes the 74 S.Afr.J.Bus.Manage.2012,43(4) assessment of business opportunities (OECD, 2004; IoDSA, 2009).  Ensure that opportunities associated with new IT developments are recognized and acted on (ISO, 2008; ITGI, 2003; IoDSA, 2009).  Ensure value delivery from IT (IoDSA, 2009; ITGI, 2003) (IoDSA, 2009; ITGI, 2003).  Ensure that IT risks are adequately addressed (IoDSA, 2009; ITGI, 2003).  Ensure compliance with applicable IT laws, rules, codes, standard, guidelines and leading practice (ISO, 2008; IoDSA, 2009).  Remain accountable for enforcing and monitoring effective IT governance, even when the responsibility for the provisioning of IT services has been delegated to another party (IoDSA, 2009). From the above, it is clear that the board is responsible for ensuring that opportunities presented by developments in IT are recognized and exploited in a manner that adds value to an organization and is secure and compliant with regulations, policies, standards and best practice guidelines. In carrying out their responsibility in this regard, the board will delegate duties to other staff. Managers at all levels throughout the organization should, therefore, work together to ensure that IT governance is effectively accomplished. Opportunities related to new developments in IT should, therefore, be of interest to business executives, and not just to IT staff. The board has the responsibility of exploiting new business opportunities, including IT opportunities that can possibly add value to the organization. One such opportunity is cloud computing. Cloud computing Simply explained, cloud computing is a computing model which allows one to access an IT service over a network, as or when it is needed, without worrying about the technical details of how the service is provided. It can be likened to using a shared form of transport instead of one’s own car, when needed. There are times when one’s needs are best met by using one’s own car; but using shared transport may, on occasions, better suit one’s needs. To illustrate this point, it may be more convenient for one to ride to work in one’s own car; however, if one is planning a trip from Johannesburg to Cape Town one may, in fact, decide to use a means of public transport, such as an aeroplane. In the same way, at times it is best for one to have one’s own computer with programs installed on it. There are, however, cases when one would derive substantial benefit from accessing IT resources, such as certain programs or services, over a shared network (using cloud computing). This analogy for cloud computing explains cloud computing in a very simplified manner. A more comprehensive definition of cloud computing is, in fact, provided by the National Institute of Standards and Technology (NIST). NIST (Mell & Grance, 2009) defines cloud computing as “a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.” This model is characterized by five essential characteristics, three service models, and four deployment models. These are depicted in Figure 1. NIST describes each of these characteristics, service models and deployment models in more detail. For the purpose of this article, though, only the different deployment models are of interest; and these are described in more detail in the paragraph below. Cloud computing can be deployed by using private, community, public or hybrid models. The deployment models used for the implementation of cloud computing will affect the level of direct control that organizations have over cloud computing services.  A public cloud describes when IT resources, which are owned and managed by a third-party vendor, are accessed by the general public or by a large industry group over the internet. Public clouds provide the lowest level of direct control by user organizations. The reduction of start-up costs and benefits of freeing up the organization’s own IT staff to focus on IT solutions for business problems may, however, be more easily achieved with this model. To use the transport analogy again, a company may at times find it cheaper and easier to use the public transport system to move employees to certain destinations and back, rather than purchasing and using vehicles for the organization for this purpose. For example, if a number of employees from a company in Johannesburg at times have to go for meetings in Cape Town, it would probably be more economical and easier for the company to use the national airlines for this purpose, rather than having a company plane. The company does not, however, have control over the airline, and therefore, has no way of controlling matters, such as the number of delays or the flight schedules. S.Afr.J.Bus.Manage.2012,43(4) 75 Broad Network Access Rapid Elasticity Measured Service On-Demand Self-Service Resource Pooling Software as a Service (SaaS) Platform as a Service (PaaS) Infrastructure as a Service(IaaS) CommunityHybridPrivatePublic Essential Characteristics Service Models Deployment Models Figure 1: Cloud computing defined. Adapted from (CSA, 2009) (CSA, 2009)  A private cloud is formed when IT resources are virtualized, so that they are available as a pool of resources that can automatically be provisioned on demand within a single organization. A private cloud belongs to only one organization, and is managed either by the user organization or by a third party. The cloud can exist either on or off the premises of the associated organization. The organization implements and manages the cloud directly. The organization, therefore, has a high level of control and transparency; and it is, therefore, more easily able to effectively govern such a private cloud. The use of a private cloud can be likened to a company providing a shuttle service for transporting employees to and from work. This may initially cost the organization more than if all the employees were to get to work using the public transport system, but the organization is in complete control of the system. They can, consequently, arrange the times and routes for the shuttle. When there is a failure in the public transport system, such as when a strike in the bus or taxi sector occurs, the organization’s shuttle service can still operate without any problems. A community cloud supports a community of users, and can be managed, either by the organizations or by a third party of their choice. This could be compared with a number of companies that get together and hire a bus company to transport employees from a certain outlying area to and from work.  Organizations may also opt for hybrid clouds. With this model, two or more clouds are linked in a way that allows data or application portability. For example, an organization may decide to run certain components of applications in a public cloud, but keep others that use more sensitive information or are more central to the operation of the organization, in a private cloud (Mather, Kumaraswamy, & Latif, 2009, p. 25). To use the transport analogy, this may be likened to the probable scenario where organizations make use of both public transport and their own shuttle system. Organizations may, for example, shuttle employees to certain predefined areas, after which employees must use public transport, such as a bus or taxi to get home. When making decisions about using cloud computing, organizations would have to decide on a deployment model that would meet their specific needs. This section has thus far provided an explanation of what cloud computing is. The following subsection highlights two factors that might motivate business managers to consider cloud computing implementation. Some challenges with cloud computing can then be enumerated. Cloud computing opportunities and challenges The following two paragraphs highlight two factors that might motivate business managers to consider cloud computing implementation: 1) Cloud computing is expected to change the way organizations operate; and 2) This is a computing model, which is associated with obvious business benefits. Some challenges associated with cloud computing are here mentioned. 1. Cloud computing is having an impact on organizations. Indications are that cloud computing is a computing model that should not be overlooked, as a mere new hyped technology. According to the results of a survey by KPMG (Chung & Hermans, 2010) “…the view of a vast majority of decision-makers, is that cloud computing is the future model of IT, and it is definitely not a hype that will subside.” This survey has found that a significant percentage (58 percent) of the participating organizations are already using some cloud computing services; or, they are expecting to adopt cloud computing within the next 12 months. Various other predictions and surveys support these 76 S.Afr.J.Bus.Manage.2012,43(4) findings (The Open Group, 2011; Bitcurrent, 2011; Focus Market Research, 2011; Gartner, 2011). Companies, such as Amazon, Google, Microsoft, Sun, and others, have made an effort to enter the cloud market as cloud-service providers (Mather, Kumaraswamy, & Latif, 2009, p. 214). Cloud computing is obviously not a computing paradigm, which is going to single-handedly transform organizations. Using cloud computing services may not even be a viable option for some organizations. The chances are, however, good that at least some of your competitors will use cloud computing even if you personally do not. Cloud computing is, therefore, a new IT development which is worthy of consideration. 2. Cloud computing is associated with obvious business benefits. The business opportunities associated with the benefits that can be achieved with cloud computing comprise another factor which drives interest in cloud computing. These benefits include: Cost savings, improved flexibility, improved scalability and greener computing (Du & Cong, 2010; Nawrocki, 2011; Shivakumar & Raju, 2010; ISACA, 2009, p. 6; Nelson, 2009; Fingar, 2009, p. 27; Porta, Karimi, Plakskon, & Sharma, 2009, p. 3; Mather, Kumaraswamy, & Latif, 2009, p. 26; Chung & Hermans, 2010, p. 25). These are significant benefits which may provide opportunities to improve the way an organization operates. Clearly, the potential benefits associated with cloud computing will not always be achieved by organizations. Keeping in mind the responsibilities of executives with regard to IT, executives should, however, recognise and investigate opportunities that arise from developments such as cloud computing. There are, however, various challenges associated with cloud computing. KPMG’s survey (Chung & Hermans, 2010, p. 28) found that issues of primary concern in the use of cloud computing include security, legal, privacy and compliance-oriented issues. The Cloud Security Alliance (CSA) is an organization which aims to promote the use of best practice by providing security assurance within cloud computing. It has identified 13 areas of concern for cloud computing (CSA, 2009b, p. 26). These include issues relating to governance and risk management, legal and electronic discovery, compliance, audit, portability and interoperability. These issues are of material concern to the board which is ultimately responsible for, amongst other things, risk management and compliance. Thus, although cloud computing offers a number of opportunities and benefits, one needs to consider the associated concerns carefully when considering the use of such cloud-based services. Cloud computing and governance responsibilities In the previous section it was highlighted that: The board is responsible for ensuring that opportunities presented by developments in IT are exploited in a manner that adds value to an organization and is secure and compliant with regulations, policies, standards and best practice guidelines. It is vital to bear in mind that IT services, regardless of the manner in which they are provided, remain crucial organizational assets. They remain the responsibility of the board, from a governance point of view. Cloud computing may result in opportunities for organizations to experience benefits, such as cost savings and improved scalability. For this reason, it is imperative that the board should recognize these opportunities. But, they will only act on these opportunities if this can be done in a secure and compliant manner. The opportunities associated with cloud computing should also only be exploited if they will add value to an organization. Thus, it is the duty of the board to continuously seek ways and means to add value to the organization. Cloud computing can potentially add much value on how IT services can be afforded. The IT Infrastructure Library (ITIL) particularly highlights a number of aspects related to value. These will be discussed in the next section. Service value ITIL is the most widely accepted framework of best-practice guidance for IT service management in the world. According to ITIL (Office of Government Commerce, 2007, p. 17), value is the combination of utility and warranty. Utility is referred to as “fitness of purpose.” It is communicated in terms of: 1) Outcomes supported; and 2) Ownership costs and risks avoided. Warranty is related to “fitness for use.” Whereas utility involves what the customer gets, warranty involves how the service is delivered. ITIL explains that warranty “ensures the utility of the service is available as needed with sufficient capacity, continuity and security” (Office of Government Commerce, 2007). To illustrate these principles in a simple manner, an analogy can be used. If one considers purchasing a software program one would consider not only whether the program would allow one to accomplish an intended task in an easy-to-use, efficient manner (utility), but also whether one would be able to use this program with assurance. It should not be “full of bugs.” This would prevent one getting the support one needs; and the program would not negatively affect the performance of one’s computer (warranty). To acquire good value from a service, both utility and warranty are necessary (Cartlidge, Hanna, Rudd, Macfarlane, Windebank, & Rance, 2007). ITIL represents this relationship graphically in Figure 2. As seen in this figure, to achieve balanced value from services, there must be good levels of both utility and warranty. IT services which either have high utility and low warranty, or vice versa, would have unbalanced value, according to ITIL. Value is “highly dependent on the customer’s perceptions” (Office of Government Commerce, 2007, p. 31). According to ITIL, an organization’s perception of value is influenced by the attributes of a service that indicate value, experiences with such attributes, relative endowment of other organizations and the image or actual position in the market of the organization (IoDSA, 2009; IT Governance Institute, 2007). S.Afr.J.Bus.Manage.2012,43(4) 77 When a service has regulatory requirements associated with it, the value of the service is influenced by whether or not there is a warranty that the service will be provisioned, in such a way, as to ensure compliance. For the purpose of this paper, warranty refers to ensuring that services are provided with the appropriate levels of availability, security, capacity, continuity, internal compliance and regulatory compliance. Utility refers to providing services that support the desired outcomes and remove any constraints in accomplishing certain tasks. Well-governed organizations are directed in such a manner that IT is used to meet business objectives and to add value (IoDSA, 2009; IT Governance Institute, 2007). It is, therefore, not surprising that the determination of service value is an important consideration when making decisions. Well-governed organizations plan to create value. Value is communicated in terms of utility and warranty. Both are necessary to achieve good value. These issues will be discussed in more depth in the following two subsections. Low impact on business outcomes but with high certainty (unbalanced value) Possible Solution High impact on business outcomes but with low certainty (unbalanced value) Utility Warranty Low value with warranty bias Low value with utility bias Possible Solution High value with warranty bias High value with utility bias Zone of balance Figure 2 Value communicated in terms of utility and warranty. Adapted from (Cartlidge, Hanna, Rudd, Macfarlane, Windebank, & Rance, 2007) Utility in the cloud As mentioned earlier, utility consists of outcomes supported and constraints removed. This section discusses how cloud computing generally influences these two areas that are related to utility. It is likely that organizations that choose to make use of cloud computing services would do so because of an associated constraint reduction. They are, therefore, expecting utility in terms of limitations removed by using cloud computing services. Constraint reductions can be realized in various ways. Similarly, organizations may consider cloud computing on the basis of expectations that certain outcomes would be supported. Outcomes supported and constraints removed are obviously closely linked. Often a benefit can be described in terms of both constraint reduction and outcomes supported. Therefore, although this section discusses perceptions of constraints removed and outcomes supported separately, it is acknowledged that these areas may overlap significantly. Surveys by KPMG (Chung & Hermans, 2010), F5 Networks (2009) and Sanhill (Pemmaraju & Rangaswami, 2010) highlight some of the primary benefits in terms of limitations reduced that most organizations expect when using cloud computing services. These include constraint reductions in terms of:  Reduction of costs;  Improved flexibility or agility; and  Better scalability. The extent to which benefits, in terms of constraints removed, are realised in practice will influence the perceived value of cloud computing services. Factors, such as the size of an organization, the organization’s in-house IT expertise, the cloud-deployment model and the choice of cloud-service provider (CSP), may all impact on these benefits. Performance or outcomes supported by cloud computing services also affect the utility of these services. Whereas constraint reduction relates to utility in terms of decrease of loss, outcomes supported relates to utility in terms of increased gain by an organization. According to the KPMG survey, cloud computing does not fare as well in this area as it does in supporting constraint reduction. The survey shows 78 S.Afr.J.Bus.Manage.2012,43(4) that only a small percentage of organizations using cloud computing are experiencing  Better functionality,  Improved security, or  Advanced technology. In addition, over half of the respondents in the KPMG survey noted that integration with existing IT systems and security needs improvement (Office of Government Commerce, 2007, p. 33). It is noteworthy that participants in the surveys represented relatively large organizations. It can be argued that small, privately owned businesses without a large IT budget or much IT expertise may acquire more utility in terms of outcomes supported from cloud computing than would larger organizations. Warranty in the cloud Factors that contribute to the warranty of a service have already been mentioned, and include the levels of availability, security, capacity, continuity and internal and regulatory compliance that can be guaranteed in the provision of the service. The manner in which warranty is achieved may vary greatly, depending on the environment in which an organization plans to operate. Furthermore, warranty is not necessarily always negatively affected by the adoption of cloud computing. For example: In a small organization with a low IT budget, little in-house IT expertise and an insecure environment, the use of cloud computing may definitely improve service warranty by using services provided by CSPs who have more experience and expertise in providing such a service. In an organization with a controlled environment, the perception is, however, generally that the less direct control the organization has over the service, the lower the level of warranty. For example, consider an organization that is well governed, implementing various structures, policies, procedures and guidelines to ensure compliance and high levels of service availability, security and continuity. Such an organization has various controls in place to ensure that IT services can be provided with a high level of warranty. They have a high level of control over each service together with an exact knowledge of how security, availability, compliance, and continuity of these services can be implemented, monitored and reported. When using a public deployment model for cloud computing, however, the organization may no longer be able to ensure availability. Internet outages, network problems and problems with the CSP may affect the availability of such a service. In addition, unless the organization has a contractually enforceable service level agreement (SLA) with a CSP, they may have little way of ensuring service continuity. Compliance, capacity and security issues may, similarly, affect the warranty by reducing the level of direct control the organization has over the services. The KPMG survey found that 76% of the respondents indicated that their main concern associated with the use of cloud computing was security. Likewise, a survey by CA found that security was one of the primary drawbacks of cloud computing. Interestingly, the KPMG survey found that respondents were more concerned about the lack of transparency than the lack of security measures. The KPMG survey also indicated that the public sector and financial services (organizations which typically have strong control environments) are less likely to adopt cloud computing (Chung & Hermans, 2010, p. 23). In public organizations legal issues (regulatory compliance) can inhibit the adoption of cloud computing. Financial service organizations are likewise slow to use cloud computing – probably because of perceived issues with regard to security and compliance. Cloud computing service value Based on the aforementioned, the following issues become apparent: 1. Users will have to experience real benefits associated with cloud computing for this computing model to be widely adopted. As stated earlier, ITIL highlights the fact that service value is highly dependent on perception. Surveys, referred to previously, have shown that organizations generally perceive a high likelihood of constraints (such as cost and rigidity) being reduced by the use of cloud computing. If organizations do not achieve any of the real benefits, which they are anticipating while truly implementing cloud computing solutions, this would negatively impact on the general perceptions of utility in the cloud. This would negatively impact cloud adoption in general. 2. Users would have to be confident of high levels of warranty with cloud computing solutions, if these are to be widely adopted. Another important factor in the adoption of cloud computing is the perception of warranty associated with the cloud. Services with low levels of warranty have either low or unbalanced value; and they are, therefore, not likely to be widely used. Some of the warranty-related concerns that users have with cloud computing have already been discussed previously. Figure 3 shows statistics of some of these concerns graphically. These concerns would have to be addressed, in order to improve perceptions of warranty in the cloud; and thereby, positively impact cloud adoption. 3. Cloud-deployment models that have a higher perceived level of warranty are currently – and will continue to be – the most widely adopted solutions. The type of cloud-deployment model used affects the level of control an organization has over cloud services. The level of control that organizations in a controlled environment have over IT services is likely to affect the organization’s perception of warranty. The clouddeployment models with the highest level of control by organizations, and therefore, the highest perceived level of warranty, are likely to be the most widely adopted cloud models. Figure 4 shows the findings of a survey on the type of cloud-deployment models being S.Afr.J.Bus.Manage.2012,43(4) 79 considered for use in government agencies (Lockheed Martin; LM Cyber Security Alliance; Market Connections, Inc., 2010). As can be seen in the figure, private and hybrid clouds are generally more likely to be adopted than public clouds. Community and hybrid clouds offer organizations more direct control over resources than do public clouds. Private clouds are completely internally controlled and governed; thereby, making it possible to ensure warranty more readily. These are currently the most popular deployment models for government agencies and other organizations (Lockheed Martin; LM Cyber Security Alliance; Market Connections, Inc., 2010; Pemmaraju & Rangaswami, 2010). Public clouds, on the other hand, offer organizations very little direct control of services. They are currently the least popular deployment model for government agencies. 4. Improved perceptions of warranty with public clouds would positively impact the adoption of this deployment model. Organizations are still wary of public clouds, but as perceptions of warranty improve, the cloud adoption of this deployment model is likely to improve. A survey of government agencies indicates that trust in the cloud improves with use (Lockheed Martin; LM Cyber Security Alliance; Market Connections, Inc., 2010). It is, therefore, also likely that the perception of warranty of cloud computing will improve with use. It can therefore be concluded that: 5. The adoption of public clouds will accelerate in time, on condition that perceptions of utility and warranty can be maintained by CSPs. 8% 12% 17% 28% 6% 5% 5% 19% Fear of unauthorised access to or leak of our proprietary information Fear of unauthorised access or leak of our customers’ information Features and general maturity of model Other Security defects in technology itself Unpredictable costs Vendor lock-in Business viability of provider Figure 3 Cloud Computing Concerns. Adapted from (Davis, 2010) Figure 4 Adoption of services by deployment model. Adapted from (Lockheed Martin; LM Cyber Security Alliance; Market Connections, Inc., 2010) 80 S.Afr.J.Bus.Manage.2012,43(4) The deductions mentioned in this section allow for a highlevel understanding of general trends and concerns likely to affect cloud computing adoption. These insights, in turn, can assist board members in making decisions on the adoption of cloud computing services in their organizations. When considering the adoption of a cloud computing service, board members can ask the following general questions:  What real utility can be achieved by the use of this cloud computing service? Benefits of cloud computing are sometimes hyped. By using this service, can we expect reductions in costs, more business flexibility, and more scalability? Have other companies been using this service? Have they experienced real business benefits?  How is my business going to be assured of adequate levels of warranty with this cloud computing service? Will there be a contractually enforceable SLA with the CSP? If I use the cloud to provide this service, will we still be able to demonstrate due care and due diligence with regard to the security of the organization’s information? Will we still be legally compliant, if this service is provided using cloud computing?  Considering the information we have gathered regarding the utility and warranty of this cloud computing service, is the use of this service likely to add value to the organization? Which clouddeployment model (public, private, hybrid or community) is going to provide us with the best balance of utility and warranty?  Adoption of cloud computing is likely to accelerate if CSPs demonstrate the ability to provide utility and warranty. Therefore, if adoption of a specific cloud computing service does not seem feasible at the moment, what is our plan to ensure that we will benefit fully from developments in cloud computing in the future The deductions and questions in this section give board members a foundation from which they can make informed decisions regarding the adoption of cloud computing services. Bodies such as the National Institute of Standards and Technology (NIST, 2011), the European Network and Information Security Agency (ENISA, 2009) and the Cloud Security Alliance (CSA, 2009a) provide more detailed guidelines that may need to be considered in more detail if the decision is made to implement cloud computing services. Conclusion Cloud computing is a computing model with tremendous potential for benefitting organizations around the world. The board has the responsibility to recognize and act on opportunities presented by such new IT developments – in a manner that will add value to the organization. To determine whether a development in IT, such as cloud computing, would add value to an organization, it is necessary to understand what service value is and how it can be achieved. Considering the relatively new concept of cloud computing in terms of how service value is determined, according to ITIL, has allowed us to arrive at some interesting conclusions on the factors that are likely to impact the adoption of cloud computing services. For cloud computing to become a lasting computing model with real value, CSPs are going to have to demonstrate that organizations can derive real utility from cloud solutions, and that they will have the ability to provide users with guaranteed levels of necessary warranty. Boards which carefully weigh these factors to determine the value that can be achieved by cloud computing in their organizations, will demonstrate that they are aware of the importance of their responsibility in ensuring that opportunities presented by developments in IT are recognized and exploited in a manner that will add value to an organization, and is secure and compliant with all the regulations, policies, standards and best-practice guidelines. References Breeding, M. 2009.‘The advance of computing from the ground to the cloud’, Computers in Libraries', 29(10), 22 - 25. Cartlidge, A., Hanna, A., Rudd, C., Macfarlane, I., Windebank, J., & Rance, S. 2007. An Introductory Overview of ITIL V3. UK: itSMF. Chung, M., & Hermans, J. 2010. KPMG's 2010 Cloud Computing Survey. Netherlands: KPMG. CSA. 2009a. ‘Cloud security alliance’. [online] http://www.cloudsecurityalliance.org/ Retrieved January 25, 2010 CSA. 2009b. ‘Security guidance for critical areas of focus in cloud computing V2.1’. https://cloudsecurityalliance.org/guidance/csaguide.v2.1.pdf Retrieved January 25, 2010 Davis, M. A. 2010. ‘Global threat, local pain: 2010 strategic security survey’. InformationWeek. [online] http://www.informationweek.com/news/galleries/security/vu lnerabilities/226700232 Retrieved 12 February, 2011 ENISA. 2009. Cloud Computing Information Assurance Framework. [online] http://www.enisa.europa.eu/ Retrieved 18 January, 2010 F5 Networks. 2009. Cloud Computing Survey Results June - July 2009. F5 Networks. Fingar, P. 2009. Dot.Cloud: the 21st Century Business Platform Built on cloud Computing. Tampa, Florida, USA: Meghan-Kiffer Press. Fox, R. 2009. Library in the clouds. OCLC Systems & Services: International digital library perspectives, 25(3), 156-161. Harada, Y. 2011. Study on Cloud Security in Japan.[online] http://www.isaca.org/Knowledge- Center/Research/Documents/Cloud_Sec_ITGIJapan_23Feb 2011.pdf