Cloud Management and Governance: Adapting It Outsourcing to External Provision of Cloud-based It Services

—Outsourcing is a strategic option which complements IT services provided internally in organizations. The maturity model for IT service outsourcing (henceforth MM-2GES) is a new holistic maturity model based on standards ISO/IEC 20000 and ISO/IEC 38500, and the frameworks and best practices of ITIL and COBIT, with a specific focus on IT outsourcing. MM-2GES allows independent validation, practical application, and an effective transition to a model of good governance and management of outsourced IT services. Cloud computing is a new model for provisioning and consuming IT services on a need and pay-per-use basis. This model allows the IT systems to be more agile and flexible. The external provision of cloud-based services as part of Cloud computing appears as an evolution of traditional outsourcing, due to the emerging technologies related to the provision of IT services. As a result of technological developments, traditional outsourcing and external provision of cloud-based services, share common characteristics, but there are also some differences. This paper adapts MM-2GES to external provision of cloud-based services, from the point of view of the customer. This way, the applicability of the model can be implemented in organizations that have both models traditional IT outsourcing and cloud-based services provided externally, in order to achieve excellence in governance and management of all kind of IT services provided externally to organizations.


INTRODUCTION
One thing to change about Information Technologies (henceforth IT) at university level is the deeply rooted approach which exists, or which used to exist, called infrastructure management.This kind of management has evolved into a governance and management model more in line with the times, which is a professional management of services offered to the university community [4].It is for this reason that in recent years a set of methodologies, best practices and standards, such as ITIL, ISO 20000, ISO 38500 and COBIT, have been developed to facilitate IT governance and management in a more effective and efficient way.
These methodologies, which are appropriate and necessary to move from infrastructure management to service management, see a lack of academic research.For that reason it is inadvisable to use these frameworks on their own, and it is advisable to consider other existing frameworks in order to extract the best from each for university level [4].
IT services have implications for business and innovation processes and may be a determinant in their evolution.The organization of these services, their status within the organization of the university, and their relationships with other management departments and new technologies is therefore vital.At present, the degree of involvement, the volume of services offered, and the participation or external alliances with partner companies through outsourcing, that Gottschalk and Solli-Saether [5] defined as the "practice of turning over all or part of an organization's IT function to an IT vendor", are of special interest.
Currently, and in the years to come, organizations that achieve success are and will be those who recognize the benefits of information technology and make use of it to boost their core businesses in an effective strategic alignment, where delivery of value, technology, risk management, resource management, and performance measurement of resources are the pillars of success.
It is necessary to apply the above-mentioned practices through a framework and process to present the activities in a manageable and logical structure.Good practice should be more strongly focused on control and less on execution.They should help optimize IT investments and ensure optimal service delivery.
It is clear that ITs have become ubiquitous in almost all organizations, institutions and companies, regardless of the sector to which they belong.Hence, effective and efficient IT management to facilitate optimal results is necessarily essential.Furthermore, in this environment of total IT dependency in organizations using ITs for the management, development and communication of intangible assets, such as information and knowledge [7], organizations become successful if these assets are reliable, accurate, safe and delivered to the right person at the right time and place, according to ITGI.Also, knowledge integration mechanisms is important in helping knowledge utilization in client firms [10].
In short, Fernández [4] proposes that the proper administration of IT will add value to the organization, www.ijacsa.thesai.orgregardless of its sector (whether social, economic or academic) and will assist it in achieving its objectives and minimizing risk.
Given the importance of proper management of IT, the search for solutions to the alignment of IT with the core business of organizations has accelerated in recent years.The use of suitable metrics or indicators for measurement and valuation, generate confidence in the management teams.This will ensure that investment in ITs generates the corresponding business value with minimal risk [4].
The above solutions are models of good practice, metrics, standards and methodologies that enable organizations to properly manage ITs.And public universities are not outside these organizations, though they are not ahead.In addition, interest in adopting models of governance and management of appropriate ITs is not as high as it should be.Two of the factors through which IT best practices have become important is, the selection of appropriate service providers and the management of outsourcing and procurement of IT services.
IT outsourcing has brought potential benefits in addition to many examples of the great organizational losses associated with this practice.Even with awareness of the potential for failure, the IT outsourcing industry continues to grow, as organizations communicate their desire to engage in IT outsourcing and their determination to decipher a method that enables successful IT outsourcing relationships [9].
On the other hand, Cloud computing is the latest trend to outsource some or complete IT operations to run a business from the public cloud that provides a flexible highly scalable technology platform for an organization's business operations [1].In addition, Cloud computing poses serious challenges to traditional business process outsourcing and have a profound impact on how IT outsourcing is done [11].
Cloud computing represents a fundamental shift in how organizations pay for and access IT services.It has created new opportunities for IT service providers and the outsourcing vendors.Cloud computing will have significant impact on outsourcing vendors, who must adopt new strategies to include Cloud services as part of their offerings to keep up with profound changes in the IT service industry.They should experiment with Cloud services and understand which models are suitable for their clients.This will help them to identify new business opportunities that arise from cloud computing.In addition, the deployment of new innovative Cloud services with attractive business models will lead to high level of customer satisfaction and unprecedented adoption of Cloud services in the organizations [3].
In the following study, a new holistic maturity model with a specific focus on IT outsourcing, is adapted to external provision of cloud-based services, taking into account the general characteristics that define IT outsourcing and external provision of cloud-based services, but also bearing in mind the nuances outlined on service models and deployment models.After analysing all the differences between traditional IT service outsourcing and IT services provided externally from the cloud, the justified adjustments to be made in the indicators of the new holistic maturity model are shown in order to adapt it to the external provision of cloud-based IT services, from the point of view of the customer.

II. MM-2GES AND CLOUD-BASED IT SERVICES PROVIDED EXTERNALLY
MM-2GES is a new holistic maturity model based on standards ISO/IEC 20000 and ISO/IEC 38500, and the frameworks and best practices of ITIL and COBIT, with a specific focus on IT outsourcing.The model allows independent validation, practical application, and an effective transition to a model of good governance and management of outsourced IT services.
In order to design the model, we studied in detail every reference on the provision of IT services that there is in the ISO 20000 and ISO 38500 standards and ITIL v3 and COBIT methodologies, with a specific focus on IT outsourcing.
The model follows a stage structure and has two major components: maturity level and concept.Each maturity level is determined by a number of concepts common to all levels.Each concept is defined by a number of features that specify the key practices which, when performed, can help organizations meet the objectives of a particular maturity level.These characteristics become indicators, which, when measured, determine the maturity level.MM-2GES defines five maturity levels: initial or improvised; repeatable or intuitive; defined; managed and measurable; and optimized.The measurement tools of the model is the subject of a paper published in an International Conference.1 The model proposes that organizations under study should ascend from one level of maturity to the next without skipping any intermediate level.In practice, organizations can accomplish specific practices in upper levels.However, this does not mean they can skip levels, since optimum results are unlikely if practices in lower levels go unfulfilled.
The applicability of the model and the measurement tools, allow organizations to meet the goal of effective transition to a model of good governance and good management of outsourced IT services.
On the other hand, the external provision of cloud-based services appears as a natural evolution of traditional outsourcing, due to the emergence of emerging technologies related to the provision of IT services.As a result of technological developments, traditional outsourcing and external provision of cloud-based services, share common characteristics such as reduced costs, increased flexibility, simplified IT and release of resources, among others.But the external provision of cloud-based services has some characteristics that are distinct from traditional outsourcing, from the point of view of the customer, such as shorter 1 Cf.Valencia, V., Usero, L., & Fernández, E., "Measurement Tools of the Maturity Model for IT Service Outsourcing in Higher Education Institutions", Proceedings of the 13 th International Conference on Information Systems Design and Technology, Jan 13-14, 2015, Zurich, Switzerland, 9 (01) Part V, pp.667-676 www.ijacsa.thesai.orgcontracts, more transparent costs, less project management, less government and less coordination, among others.MM-2GES is a good basis in order to use in this new scenario and new business model based on external provision of cloud computing services.The model has been designed to be applied in any scenario where an organization has the ability to hire IT services to external service providers.However, there are some significant differences between traditional IT outsourcing and external provision of services based in the cloud.Therefore, the model allows some adjustments to be made in the metrics tables where each characteristic in the model is rated.The adjustments in the model must be made depending on the differences mentioned above.
In addition, when discussing cloud computing we must take into account there are three different service models, each of which has specific characteristics, and also there are four deployment models with specific characteristics.Thus, when discussing the external provision of services in the cloud, the characteristics of services depend on the type, design and nature of the service, studied in a personalized way.

III. DIFFERENCES BETWEEN TRADITIONAL IT SERVICE OUTSOURCING AND CLOUD-BASED IT SERVICES PROVIDED EXTERNALLY
In the following analysis, MM-2GES is adapted to external provision of cloud-based services.These kinds of services are analysed from a general and theoretical angle, taking into account the general characteristics that define them, but also bearing in mind the nuances outlined on service models and deployment models.
Therefore, the differences between traditional IT service outsourcing and IT services provided externally from the cloud are the following, extracted from different publications [2], [3], [6], [8]: Taking into account the differences between IT outsourcing and the external provision of cloud-based services, it is necessary to make a number of adjustments in MM-2GES.These adjustments will allow to apply the maturity model in an environment where external cloud-based services are provided.This way, a new characteristic that define both traditional outsourcing and cloud computing will be added to the maturity model, flexibility.This requires identifying which concepts of MM-2GES would be affected by the differences between traditional IT outsourcing and the external provision of cloudbased services.Table I shows the concepts affected by the differences.The first column of the table shows all key areas that form the basis of the maturity model designed for IT outsourcing.The second and successive columns show the differences between IT outsourcing and external provision of cloud-based services.

IV. ADJUSTMENTS IN ORDER TO ADAPT MM-2GES TO THE CLOUD
After analysing all the differences, extracted from different publications [2], [3], [6], [8], between traditional IT service outsourcing and IT services provided externally from the cloud, the adjustments to be made in the indicators of the model in order to adapt it to the external provision of cloudbased IT services, are the following:

A. Formal Agreement
Differences between external provision of cloud-based services and IT outsourcing: [D2, D3] Because contracts in external provision of cloud-based services are in general shorter in duration, less complex and more important, in addition to the scaling of IT resources potentially demanded by organizations is more demanding, formal agreements signed by the customer and cloud supplier should be more flexible.Therefore, the review of the formal agreements in external provision of cloud-based services should be more frequent at predefined intervals.This circumstance would allow the ability to align quick scaling of IT resources and the provisions of the signed formal agreements.

B. Service Measurement
Differences between external provision of cloud-based services and IT outsourcing: [D9] Because the external provision of cloud-based IT services share the same infrastructure for all clients who hire these services, it is more difficult to get a certain performance due to the use the rest of the customers can make of shared services.This way, customers can achieve high availability of services and have poor performance at the same time.
As a result, measuring the performance of cloud-based services provided externally is essential to meet the expectations and business needs.In addition, measurements allow early detection of potential problems in services, according to Cobit.Therefore, it would be necessary to have procedures for the measurement of cloud-based servicies in order to assess their performance.These procedures would facilitate the achievement of the objectives in organizations.

C. Monitoring and Adjustments
Differences between external provision of cloud-based services and IT outsourcing: [D5, D9] Although it is needed less management and less government in external provision of cloud-based services, and the coordination between organizations and cloud providers is less necessary, all model indicators that define the concept of monitoring and adjustments are not altered, but the existence of the KPI indicators needed to assess the performance of services so that they can meet the needs and expectations of the business.
Therefore, the characteristics that define the indicators for monitoring and adjustments, and that they are important to be kept in the external provision of cloud-based services in the same way as in IT outsourcing, are the following:

E. Service Level Agreement (SLA)
Differences between external provision of cloud-based services and IT outsourcing: [D2, D3, D8, D9] Due to the fact that cloud-based services provided externally are under the tutelage of agreements or contracts shorter in time, and demand of scaling IT resources are more demanding, SLAs should be reviewed more often as happens with formal agreements.In addition, is important to keep availability in SLAs in the same degree as in traditional outsourcing, require greater compliance with the performance of cloud-based services provided externally due to the possible scaling up or down of services, and reduce security requirements due to the inability to obtain a full security commitment by cloud providers, due to the intrinsic cloud configuration.

F. Control of External Providers Differences between external provision of cloud-based services and IT outsourcing: [D8]
In an environment of external provision of cloud-based services, the availability of services becomes more important because it creates more uncertainty having the infrastructure that supports services in locations sometimes physically unknown.Cobit indicates the need to assign responsibility for managing external suppliers and the quality of services provided.In addition, it specifies that the external provider is subject to periodic independent reviews to feedback its performance in order to improve its service delivery.Therefore, is necessary to establish a control on external suppliers by conducting independent audits and security reports.The latter allow, among others things, to monitor and ensure confidentiality, integrity and availability of information about the services provided by external suppliers, minimizing risk.
In addition, is important to keep the characteristics that define the indicators on the control of external suppliers in external provision of cloud-based services to the same degree as in outsourcing.

G. Business Risk Differences between external provision of cloud-based services and IT outsourcing: [D7]
The external provision of cloud-based services needs to improve important aspects such as security of information managed.This formula creates uncertainty and distrust in organizations because of potential risk in the business.This circumstance forces to adjust the indicators that define the concept of business risk in the model, and thus mitigate the uncertainty created.
Therefore, it is important to assess the risk, have a contingency plan that is regularly reviewed as well as the skills and capabilities of the cloud provider, as part of the business risk management.Strict compliance with service levels offered, quality of services and business continuity, reduce business risk.

H. Financial Management Differences between external provision of cloud-based services and IT outsourcing: [D1]
Costs of services provided externally in the cloud are more transparent than those arising when external supplier provides services using traditional outsourcing.In addition, there are no costs in advance in external provision of cloud-based services.Despite making clear the costs, it would be desirable to maintain a commission in financial management.This commission would provide vital information for IT management in order to ensure external provision of cloudbased services efficiently and profitable.

I. Legislation Differences between external provision of cloud-based services and IT outsourcing: [D6]
It is well known that one of the reasons that keep many organizations from taking the step to the cloud, is the lack of legal guarantees on security and privacy of data providers manage in the cloud.Providing confidential information to another organization is always delicate and produces distrust.However, organizations that offer cloud services are aware they put their reputation at risk; that is why they try to dispel mistrust founded.In addition, data provided by cloud services can be accessed from any location.Therefore, there is always the possibility of compromising customer privacy.Taking all the above into account, it is necessary to relax the enforcement of rules, laws, decrees, directives and decisions about data protection, data processing, processing site, clauses for the transfer of data and contractual clauses for the transfer of personal data to third countries.This involves to cover all levels of the maturity model.

J. Demand and Capacity Management
Differences between external provision of cloud-based services and IT outsourcing: [D3, D7] Managing demand of cloud services is less complex than in traditional outsourcing, because the scaling is faster and more flexible, and the availability of IT resources required are provided by cloud providers almost immediately.This does not prevent uncertainty in business continuity from increasing.This is due to the inability to act directly on the IT infrastructure that supports services in the event of a disruption www.ijacsa.thesai.orgproduced by a client request to increase or decrease the capacity in cloud services.

K. Formal Agreement Management Differences between external provision of cloud-based services and IT outsourcing: [D2]
The formal agreements signed with cloud-based services suppliers are generally shorter in duration than the formal agreements signed with traditional outsourcers.This circumstance requires the availability of a management system of formal agreements signed with cloud providers to facilitate getting a consistent quality service at a competitive price, plus an extension, renewal and/or renegotiation of formal agreements.
In addition, the management system of formal agreements signed with cloud providers should be integrated into a configuration management system, which allows to have a clear knowledge and control of the infrastructure, the relationships between configuration items (ECs) that make up the infrastructure and support services, and life cycle of the ECs.
Finally, it would necessary to create a new role in the organization named contract manager or similar, responsible for managing formal agreements or contracts with external suppliers through the management system of formal agreements.This circumstance requires the creation of a new indicator in the metrics table (see Table II).

L. Guidelines on outsourcing an IT service (life cycle)
Differences between external provision of cloud-based services and IT outsourcing: [D1, D2] When an organization faces the compromising decision to outsource to the cloud an IT service that was previously provided internally, the organization should analyze comprehensively all the circumstances related to that decision from an economic, technical and regulatory compliance point of view before making a final decision.Services provided externally in the cloud have the added difficulty for organizations of not knowing the physical location of the infrastructure that supports the services.This implies a greater difficulty in applying enforcement regulations to information that cloud providers manage.
Costs of services provided externally in the cloud are more transparent than those arising when external supplier provides services using traditional outsourcing.In addition, there are no costs in advance in external provision of cloud-based services.This circumstance facilitates to carry out an economic study to compare costs of cloud-based services with costs of the same services provided internally, including technical staff, equipment (processing and storage) and infrastructure costs.Furthermore, it is necessary to carry out a technical study using proper indicators, with a specific focus on availability, continuity and capability of the service provided internally by the organization, if any, and that is meant to outsource to the cloud.
It is also necessary to assess the service demand required by the organization.In the assessment is included the following: percentage of required availability, quality, degree of continuity and capacity, not to mention in this assessment current and future resources available internally.
Once you have completed the above studies and the assessment is favorable to outsource the service studied to the cloud, it's time to explore the market of service providers in the cloud in order to contrast the service provided internally and the cloud-based service provided externally.Bids received should be renegotiated downward economically, while maintaining all the benefits of the service.
Finally, Table II shows the necessary adjustments to be made in the indicators of the model in order to adapt it to the external provision of cloud-based services.Indicators to be adjusted are highlighted in yellow.Indicator levels subject to adjustment are highlighted in green.New indicators, in this case there is only one (Contract Manager), are highlighted in green.The necessary adjustments to be made into the metrics table (see Table II) allow to adapt the maturity model for IT service outsourcing to external provision of cloud-based services.Then is when the applicability of the model can be implemented in organizations that have cloud-based services provided externally.In order to apply the new model we must use the same tools used in the maturity model for IT service outsourcing.The tools are the following: a questionnaire, metrics table, and continuous improvement plan tables as part of the measurement process.Therefore, the procedure to follow is to put into practice the measurement process by implementing the continuous improvement plan, and using the assessment tool, which is composed of the questionnaire results, metrics table and continuous improvement plan tables.

V. CONCLUSIONS
Cloud computing is a new model for provisioning and consuming IT services on a need and pay-per-use basis.This new paradigm of information technology is a model that enables IT systems become more agile and flexible.The external provision of cloud-based services, as part of cloud computing, appears as an evolution of traditional outsourcing, due to the emergence of emerging technologies related to IT service provision.As a result of technological development, traditional outsourcing and external provision of cloud-based services share common characteristics, such as cost reduction, increased flexibility, IT simplification and release of resources, among others.But there are some significant differences between the external provision of cloud-based services and traditional outsourcing, always from the point of view of the customer, such as shorter term contracts, more transparent costs, less project management, less IT government and less coordination, among others.MM-2GES has been designed in order to serve as a public service and to fit all forms of current and future external service provision, within a mixed integration system of solutions.This way, the practical implementation of the model becomes flexible, agile and adaptable.Therefore, this research also adapts MM-2GES to external provision of cloud-based services, from the customer point of view, by doing several justified adjustments in the metrics table (see Table II), where every characteristic of the model is assessed.The adjustments have been done depending on the differences between traditional outsourcing and the cloud-based services provided externally.
The applicability of the model can be implemented in organizations that have deployed both IT service provision models, traditional outsourcing and cloud-based services provided externally, in order to achieve excellence in governance and management of all kind of IT services provided externally in organizations.
The model designed in this research shares a common feature there is in both models cloud-based services provided externally and traditional outsourcing.This feature is flexibility to be adapted to possible forms of service provision to come in organizations, due to the ongoing technological evolution.Therefore, MM-2GES can be adapted to any kind of external provision of services, but only after doing the necessary adjustments in the metrics table (see Table II).
Finally, on the basis of this research, by categorizing concepts and subconcepts with a specific focus on IT outsourcing, and designing an assessment tool along with the maturity model that allows independent and practical www.ijacsa.thesai.orgapplication of the model, and ultimately adapting the model to cloud-based services provided externally, this study seeks to allow higher education institutions under study to meet successfully the requirements of the the complex digital era of the internet.
No advance costs.Simpler and more transparent costs;  [D2] Shorter, less complex and more important contracts;  [D3] Rapid scaling on demand.Greater flexibility with respect to the increase and decrease of IT resources needed due to the existence of services and infrastructure deployed in the cloud;  [D4] Less customization of services and greater difficulty of integrating legacy systems;  [D5] Less project management, less government and less coordination.Less interaction;  [D6] Few legal guarantees on security and data privacy;  [D7] Greater uncertainty about business continuity;  [D8] Greater uncertainty and importance of service availability; and  [D9] Less guarantee of getting a certain performance.


Testing and Deployment; and  Knowledge Management.The concepts altered by the differences between IT outsourcing and external provision of cloud-based services are the following:  Formal Agreement;  Service Measurement;  Monitoring and Adjustments;  Alignment IT-Business;  IT Governance Structure;  Service Level Agreement (SLA);  Control of External Providers;  Business Risk;  Financial Management;  Legislation;  Demand and Capacity Management;  Formal Agreement Management;  Knowledge Management; and  Guidelines on outsourcing an IT service (life cycle).


Monitoring IT services;  KPIs and KGIs affect the penalties, contracting and negotiation of IT services; Meeting legal and operational requirements; and  Corrective actions as a result of monitoring.Affected indicators: MON2.D. Governance Structure Differences between external provision of cloud-based services and IT outsourcing: [D5] In an environment of cloud-based services provided externally is needed less government by client organizations, but the IT governance structure established in the model remains the same because their functions are still valid, and therefore the following committees and commissions: www.ijacsa.thesai.org IT Strategy Committee;  Audit Committee;  IT Steering Committee;  Commission on Technology and / or IT Architecture;  Services Commission; and  Projects Office.

TABLE I .
KEY AREAS AFFECTED BY THE DIFFERENCES BETWEEN IT OUTSOURCING AND EXTERNAL PROVISION OF CLOUD-BASED SERVICES

TABLE II .
ADJUSTMENTS IN METRICS TABLE AND QUESTIONNAIRE