ITILs total control, but the cloud says don't worry. What's an IT manager to do? Would using the cloud mean you could send your ITIL chiefs home early, since keeping close tabs on that cloud-based infrastructure would become unnecessary, if not impossible? Or does ITIL become even more important when applied to external service providers?
When assessing the impact of Cloud on ITIL (or better IT Service Management) it is important to realize whether you're an Cloud Service Consumer or an Cloud Service Provider. One of the processes where this difference is most visible is Capacity Management. If you're a consumer you don't have to worry about capacity at all (just make sure you have an UC), while as a provider this becomes much more difficult than in a traditional data center.
I think that most enterprises end up in some kind of hybrid situation, and that the CIO becomes a broker of IT services and translate those into real business services. Cloud will enable the definition of a Service Catalog in real business terms and move IT directly into the business...one of the characteristics of Cloud is making services available through Self Service Portals.
To give to a better answer, I must start out by stating that the first notion in this post is not correct. ITIL is not at all about total control. It is much more about ensuring that process account for that which is important to business value. ITIL would very much tell you that if there isn't value in it, don't bother doing it. In some cases this even means forgoing control.
Now on to your question. ITIL doesn't give two hoots about the "cloud" per se. ITIL has always been, both purposefully and necessarily, technology agnostic. Cloud technology is simply another type technology, and as much as cloud vendors and technology pundits who require buzzwords to make a living would tell you, the "cloud" is really not all that special in terms of technology and is most certainly not at odds with ITIL.
What ITIL is concerned with is those facets of operations that are important to protecting and increasing business value. The cloud is simply another technology in the IT tool bag to be governed by those processes and policies. True enough there are considerations the must be considered with the cloud, but when you look at the following list, is it really different for any other IT Service?
• Security
• Underpinning Contracts
o Capacity
o Availability
o Service Level Management
These are all things that should be considered with any IT Service, it is just that the emphasis on certain areas is shifted a bit when dealing with the cloud:
Security: Security is always a large concern but it generally becomes a central topic when discussing cloud usage. Bottom line is your data sits on someone else’s stuff somewhere out of your control. Quite simply your organization must make the call (for each service considered for the cloud) if that is palatable. What would ITIL say? ITIL would say understand the security measures and guarantees of the cloud provider, build a risk list for the service in question, and determine if the service is suitable for cloud usage. In the risk considerations don’t forget about key governance such as HIPPA or SOX. Let’s also go back to our statement of value and impart one more consideration. If the risk (real or perceived – perceived is important also) is close to the tolerable threshold, is the value of the cost savings from using the cloud really worth it?
Underpinning Contracts: The contracts for your cloud services are a vital area of consideration since direct control of the infrastructure that runs your services is now a contact component, not a component of internal operations. In reality, however, this is really not any different than services you already have. Take for example a service that requires a wide area network to run – we pretty much all have these. The availability, capacity and service levels of this wide area network completely underpin the ultimate potential and limitations of that service.
What does ITIL say? Be diligent in your underpinning contracts for your cloud services and ensure that they account for having adequate capacity and availability to meet the needs of the business services that they enable. Also paramount is that the service level agreements with the providers will meet or exceed the needs of the business, particularly any service levels IT may have with the business, or business may have with customers reliant on the cloud enabled service.
So as you can see in the end, ITIL still doesn’t give two hoots about whether it is a cloud enabled service or not. ITIL would propose you ask the same questions as you would of any other IT Service.
Comments