IT operating models in the cloud - a question of responsibility

When companies are considering the use of public cloud services, it is particularly important to understand and implement the underlying responsibility and operating model. The focus here is upon security and compliance issues, as well as upon which tasks are implemented by the company itself or, if applicable, by the public cloud provider.

The responsibilities for the workloads vary depending on whether the workloads are hosted as SaaS (Software-as-a-Service), on PaaS (Platform-as-a-Service), on IaaS (Infrastructure-as-a-Service), or On-Premises in a local data center.

Thus, enterprises that host their workloads in an on-premises data center are responsible for the entire stack themselves. In contrast, when moving to the cloud, part of the responsibility is transferred to the cloud provider. The following diagram illustrates the areas of responsibility of enterprises and public cloud providers according to how applications are deployed.

Even though the terms on the graphic have been used in the the IT world for decades, they are put to a fundamentally different use in the cloud context: For example, entirely different paradigms apply to the cloud operating model, which are depicted below.

We define the cloud operating model here to address questions like these and relate it to IT outsourcing with an IT service provider and the collaboration model:

A cloud operating model represents the set of processes and procedures that define how technologies are utilized in the cloud.

When cloud technologies didn't exist, technology teams created operating models to leverage technology's benefits for the business. Enterprise IT operating models were already focused on business strategy, staff structuring, change management, operations management, governance/compliance, and security. However, for most operating models, workload stability was the top priority.

Moving the operating model to the cloud now means that the same people and processes can focus on a different level of operations:

• When staff no longer concentrate on server uptime, success metrics change.
• When security no longer depends on the four walls of a data center, the threat profile changes.
• When procurement is no longer a barrier to innovation, the speed of change management changes.

The cloud operating model is thus clearly less about workload stability and more about ensuring operational consistency and enabling speed and flexibility in operations.

Speed and flexibility can be positively influenced in particular via the collaboration model with the IT service provider. And as soon as a collaboration model is discussed, the idea of outsourcing is not far away. However, outsourcing in the context of the public cloud is understood differently than in the case of classic on-premises services.

Control & stability vs. speed and results

Cooperation with external parties usually lies between two poles: either each activity is issued to a partner or the company carries out all activities itself. In between, there is the option of defining co-management of IT. Regardless of the choice of collaboration model, the question that needs to be answered is how much control and stability versus speed and results the operating model should allow: Self-management, for example, can achieve high flexibility and speed, as the workloads are entirely in the hands of the customer. At the same time, this can result in a loss of stability and control, which is what a secure and robust operation is all about. It is ultimately a trade-off between Control & Stability vs. Speed & Results.

Co-management with DevOps and Shared Responsibility

Many customers choose to co-manage their IT landscapes in the public cloud when faced with this trade-off.

Whereas in the past, risk transitions and strict responsibilities were defined on the basis of classic outsourcing using standards such as ITIL, in the DevOps or shared responsibility model, the company and the service provider grow together to form a single unit, so that the transitions are sometimes difficult to recognize. The idea is quite simple: the company and the service provider work together in a solution-oriented manner on faults, service requests or changes - in other words, the company and the service provider jointly implement the operation.

Co-management in particular can generate many advantages:

• Focus on core competencies and the core business
• Know-how transfer between the service provider and the customer
• Access to new technologies and innovations
• Cost advantages, especially through increased efficiency
• Less administrative work
• Higher capacities
• Higher quality
• Higher flexibility

Essentially, the question arises as to which activities the company itself, the IT service provider, or even the hyperscaler are responsible for. The question should also consider which business area and corporate functions a company relies on an IT service provider. Specifically, this question must be answered for each application.

The following six steps can help:

1. Evaluate whether the activity is part of your core competencies.
2. Evaluate the suitability for outsourcing the activity/s
3. Evaluate the reasons for issuing the activity/s
4. Evaluate all relevant quantitative costs
5. Evaluate all applicable qualitative costs
6. Check the capabilities of the suppliers

After reviewing these items, a right decision can be made for an appropriate operating model. When outsourcing activities to a partner, many advantages but also disadvantages can be generated. In addition, it should be checked whether the operating model can change over time. Thus, before providing the cloud architecture, it must be checked how the cloud operation is to be designed. The topics of strategic orientation, personnel structure and GRC requirements (governance, risk and compliance) should be defined here in order to be able to implement the future cloud operating model and to save costs with the help of the implemented operating model.