Cloud Maturity Study Reveals the Top 10 Issues Eroding Cloud Confidence

New Research by Cloud Security Alliance and ISACA Identifies Government Regulations, Exit Strategies, and International Data Privacy as Top Concerns

Rolling Meadows, IL, USA (27 September 2012)—Findings from a joint Cloud Security Alliance (CSA) and ISACA survey show that government regulations, exit strategies and international data privacy dominate the Top 10 areas where confidence in the cloud is lowest. A collaborative project by ISACA and CSA, the Cloud Market Maturity study provides business and IT leaders with insight into the maturity of cloud computing and will help identify any changes in the market. The report, released today, provides detailed insight on the adoption of cloud services among all levels within today’s global enterprises and businesses, including the C-suite. The study reveals that cloud users in 50 countries were least confident about the following issues (ranked from least confident to most confident):

1. Government regulations keeping pace with the market (1.80)
2. Exit strategies (1.88)
3. International data privacy (1.90)
4. Legal issues (2.15)
5. Contract lock in (2.18)
6. Data ownership and custodian responsibilities (2.18)
7. Longevity of suppliers (2.20)
8. Integration of cloud with internal systems (2.23)
9. Credibility of suppliers (2.30)
10. Testing and assurance (2.30)

While there are many positive indicators that support the planned adoption and perceived use and value of cloud services in the years ahead, there remains much progress to be made to engage and gain the buy-in among business leaders. “As a first step, we as an industry must still work to provide a clearer definition of what cloud is and how the many innovative and secure services can help positively impact today’s businesses,” said J.R. Santos, global research director at CSA. “But, we need to start at the top and engage senior management. Cloud needs can no longer be thought of as a technical issue to address, but rather a business asset to embrace.” The survey includes responses from more than 250 participants from nearly 50 countries, representing a global group of cloud users, providers, consultants and integrators from 15 industry segments. Participants, 85 percent of whom identified themselves as cloud users, were asked to rank on a scale of zero to five a number of considerations in cloud computing including:

• Use of cloud services and level of satisfaction
• Factors in making cloud decisions
• Level of cloud maturity
• Innovation in the cloud
• Expectations about the cloud
• Cloud support for business goals
• Forces that influence adoption and innovation
• Confidence and optimism in the cloud market

““One of the most interesting findings is that governance issues recur repeatedly on the list of the top 10 concerns. Cloud users recognize the value of this model, but are wrestling with such questions as data ownership, legal issues, contract lock-in, international data privacy and government regulations,” said Greg Grocholski, CISA, international president of ISACA. “As cloud services continue to evolve, it is critical that we work together as an industry to provide insights and recommendations on these issues so that service and solution providers can look to innovate and deliver what the cloud services market needs to advance and what enterprises need to succeed.” Results Overview Results of the study provide much insight on the progression of cloud adoption. For example, business enablers (score 4.08) rather than financial considerations (score 3.5) are the primary factors in making cloud decisions, with the least important factor being the ability to reduce the environmental footprint of the organization (score 2.67). The business enablement factors that most influence cloud computing decision making are related to the reliability and availability of services (mean score 4.59) and quality of service (score 4.29). Overall, respondents feel there is room for improvement when it comes to innovation in the cloud. Nearly one in four (24 percent) survey takers indicate that there is no or limited levels of innovation in the market. Forty-three percent of respondents believe there is a moderate level of innovation, while 33 percent report that the level of innovation in terms of products, services and business use is significant. “Survey results show that CIOs and IT management understand cloud best and are most involved in driving cloud innovation in their organizations. This limits cloud maturity and innovation since cloud continues to be viewed as a technical solution and not as a business enabler,” said Yves Le Roux, a member of CSA and the ISACA Guidance and Practices Committee. “Cloud can provide business-building innovation, but to get to that point, there needs to be more buy-in and a better understanding among business leaders and C-level executives of the cloud’s value and risk.” Nearly all respondents feel that cloud computing is far from reaching maturity, with only software as a service (SaaS) cautiously placed at the earliest state of growth level, with infrastructure and platform services still considered in the infancy stages. Still, the respondents remain moderately confident that cloud services are meeting service and strategy expectations and that problems are being addressed. Many rated cloud services as providing confidence in strategy and problem resolution (means score 3.47), indicating cautious optimism that cloud will advance in maturity and problems limiting its adoption will be addressed. The full survey report is available at www.isaca.org/cloud-market-maturity and https://cloudsecurityalliance.org/research/collaborate/#_isaca. ISACA and CSA will discuss the study’s findings and implications in a webinar on 11 October. Visit http://www.isaca.org/webinars to register. About Cloud Security Alliance The Cloud Security Alliance is a not-for-profit organization with a mission to promote the use of best practices for providing security assurance within Cloud Computing, and to provide education on the uses of Cloud Computing to help secure all other forms of computing. The Cloud Security Alliance is led by a broad coalition of industry practitioners, corporations, associations and other key stakeholders. For further information, visit us at www.cloudsecurityalliance.org, and follow us on Twitter @cloudsa. About ISACA With more than 100,000 constituents in 180 countries, ISACA (www.isaca.org) is a leading global provider of knowledge, certifications, community, advocacy and education on information systems (IS) assurance and security, enterprise governance and management of IT, and IT-related risk and compliance. Founded in 1969, the nonprofit, independent ISACA hosts international conferences, publishes the ISACA Journal, and develops international IS auditing and control standards, which help its constituents ensure trust in, and value from, information systems. It also advances and attests IT skills and knowledge through the globally respected Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified in the Governance of Enterprise IT (CGEIT) and Certified in Risk and Information Systems Control (CRISC) designations. ISACA continually updates and expands the practical guidance and product family based on the COBIT framework. COBIT helps IT professionals and enterprise leaders fulfill their IT governance and management responsibilities, particularly in the areas of assurance, security, risk and control, and deliver value to the business. Follow ISACA on Twitter at @ISACANews. Contact Kari Walker for the CSA ZAG Communications 703.928.9996 [email protected] Kristen Kessinger ISACA 847.660.5512 [email protected]