IT association paper warns of hidden cost when migrating to the cloud

In its Calculating Cloud ROI: From the Customers Perspective white paper ISACA warns that while cloud computing promises a low cost of entry and a quick return on investment (ROI), the ROI ‘can fall short of expectations if hidden costs are left out of the equation’.

“According to the hype, cloud computing makes it easy to offer IT users the same self-service that people love when they turn on their lights or air-conditioning—it’s limitless, on-demand and pay as you go,” said Marc Vael, International Vice President of ISACA. “But in reality, cloud computing is like every other IT innovation. Security, cost and complexity don’t disappear— they just need to be managed and accounted for.”

hide

In the white paper ISACA outlines five key costs that may go under the radar when moving quickly to cloud-based services. These are:

-The cost of bringing services back in-house due to regulatory change (e.g., stricter data privacy laws)

-The cost of implementing and operating countermeasures to mitigate risk

-Unexpected expenses involved in initial migration of systems

-Loss of internal IT knowledge providing competitive differentiation

-Lock-in with specific cloud provider or proprietary service model, which may slow down future adoption of open standards-based services.

The guidance from ISACA details a 12-step process that takes a frank look at the complexity of cloud computing options and the importance of making an informed decision about long-term costs and payback.

Organisations must balance the need to be accurate with the need to reach a decision, it advises. An overly complex ROI calculation can make it hard to understand why a decision was made or measure its effects, says the white paper. ISACA encourages firms to do as thorough a job as possible, but not to let ‘perfect be the enemy of good’.

It also stresses that the cloud is not right for every organisational need. The type of cloud service selected—and the decision to use cloud-computing services—depends on the specific enterprise’s risk appetite.

ROI is a good start, but other financial indicators should also be calculated, when considering the benefits of implementing the news IT system, the guidance continues.

ROI coupled with total cost of ownership (TCO), net present value (NPV), internal rate of return (IRR), or payback period will provide a more accurate financial picture across the lifespan of the cloud investment.

The IT association also points out that it is far easier and less costly to change a decision when it is still on the drawing board. The time an enterprise spends considering the ROI of various options and selecting the best fit for its needs is time well spent, it said.

The free whitepaper is available to download at www.isaca.org/cloud-ROI.

– Commercial Risk Europe is holding a Risk Frontiers—Cyber Risk seminar in Brussels on 27 September. To reserve your space email [email protected].