NACUBO

My NacuboWhy Join: Benefits of Membership

E-mail:   Password:   

 Remember Me? | Forgot password? | Need an online account?

Business Officer Magazine
Loading

Get Your Head Into the Cloud

Examining the business case for cloud computing requires focusing your attention on the internal and external trends that influence your institution's technology needs today and tomorrow.

By Apryl Motley

*In a relatively short period of time, the word "cloud" has taken on a whole new connotation. Rarely now is it associated with dark and foreboding events. Instead, the cloud-better known as the Internet-represents the realm of seemingly endless possibilities for enhancing the functionality, flexibility, and financial models associated with information technology systems.

Higher education institutions are beginning to take advantage of these opportunities. According to Tracy Mitrano, director of IT policy at Cornell University in Ithaca, New York, electronic mail for students, faculty, and staff is the most frequently adopted cloud computing service in higher education to date. Almost 25 percent of colleges and universities in the United States have outsourced student e-mail to the cloud, which means they avoid the capital costs required to support these systems while giving users access to more applications.

Certainly, cost is one important consideration, but institutions have a host of issues to consider as they determine whether moving to the cloud creates opportunities or obstacles on their campuses. Many of these issues speak to the central question that concerns chief business officers: Does moving certain services to the cloud make good business sense?

Yes, it may save money. No, the security risk is too great. Yes, we can get that department the upgrades faculty members have requested sooner rather than later. No, it's more economical and efficient to maintain those systems in-house. The responses will vary from campus to campus, but it's clear that investigating your options should be a part of your ongoing strategic planning process.

Edward Kania, vice president for finance and administration at Davidson College, Davidson, North Carolina, believes that CBOs must achieve a delicate balance between evaluating the costs and risks associated with cloud computing and ensuring that their institutions continue to use the best technological tools to meet the needs of their stakeholders.

"Don't be so enamored with cloud computing that you lose sight of the risks and costs associated with it," he cautions. "On the other hand, move the campus culture along so that the institution is open to exploring the options available."

Roger Bruszewski has a similar take on the pluses and minuses of cloud computing. He is the vice president for finance and administration at Millersville University, Millersville, Pennsylvania. "The obvious plus is the potential for saving money," he says. "However, what happens when the business model doesn't work because it isn't operating at the level that you need anymore? That's why most of cloud computing in higher ed has focused on what I consider to be ancillary or secondary systems. Institutions have been reluctant to move their primary business systems to the cloud."

Both Kania and Bruszewski have been actively involved as their institutions continue to assess the benefits and challenges of cloud computing. From convening committees and task forces to completing financial and functional analyses, here's a look at how these institutions and three others have defined the business case for cloud computing on their campuses.

The State of Systems

A critical first step in defining the case for cloud computing is working with chief information officers to assess your current technology infrastructure, the staff, and the systems that support it.

A critical first step in defining the business case for cloud computing is working with chief information officers to assess your current technology infrastructure, the staff, and the systems that support it. What you learn during that process may greatly influence decisions you make relative to the cloud. For instance, Colin Currie, executive director for administrative information services at Princeton University, Princeton, New Jersey, acknowledges that "relative to other schools, we've been slow adopters to the point where we're doing very little in the cloud at this time."

According to Currie, this cautious approach has been deliberate largely because of the university's long-standing practice of maintaining its established business processes. "We have very traditional systems that were customized for our use or recustomized from packaged systems," he explains. "This presents a difficulty in terms of moving to the cloud." Currie's group is responsible for managing the university's core enterprise resource planning systems. Princeton operates within a highly centralized IT environment where Currie and his counterparts in the IT office, and ultimately the chief information officer, run most of the businesses systems that control how the university conducts business.

 At Davidson College, mission-critical systems are still being run on campus data centers as well, but the institution began looking to the cloud for IT solutions over five years ago-specifically for an employment recruitment system. "We basically ask ourselves, 'Where should we put this?' We work together to determine if the requirements of a project can be met within the existing IT infrastructure or in the cloud," says Mur Muchane, the college's chief information officer. Kania describes the relationship between his office and IT as an ongoing partnership that is built on "strong communication about what tools provide the best functionality and meet user needs."

Meeting user needs has been a catalyst for Mercer County Community College's foray into cloud computing. Susan Bowen, executive director for information and technology services at MCCC in West Windsor, New Jersey, says her office does all the management and planning for both academic computing and enterprise services. "We are very centralized," she explains. "However, needs have come up that we didn't have infrastructure or IT expertise to support."

In these instances, Bowen and her team looked to the cloud for possible solutions. A case in point was meeting the needs of the college's staff who track various assessment initiatives. "We were able to get a SharePoint site up quickly so that it could be used to track these initiatives, and we later used the tool to prepare for our Middle States [Commission on Higher Education] assessment," Bowen recalls. "At some point, we will probably bring it in-house and expand its needs."

However, this solution took some of the immediate pressure off internal staff. "IT staff members still have to be comfortable with the interfaces for sharing data," she notes, "but not to the same extent as if we were hosting the services on campus, which gives staff the ability to focus on in-house projects. We need to focus on our core mission and the services that we need to provide to the campus. The cloud is there to supplement our efforts." For this reason, among others, Bowen believes that business officers need "to be open to these kinds of solutions to meet their institutions' strategic IT needs." 

Cloud by Committee and Culture

In addition to assessing the state of their existing IT systems, administrators need to build consensus around their motivations for entering the cloud. To better understand what's driving the decision-making process, most institutions rely on informal or formal groups of campus stakeholders to identify information technology needs.

Davidson College's Mur Muchane and Edward Kania urge institutions to be comprehensive in calculating the costs of cloud computing, because there is a tendency to underestimate the expenses associated with its implementation and maintenance.

At Princeton, the IT staff has regular communication with users and internal customers through monthly meetings with the university's project management team, which includes representatives from the business office, representatives from the office of information technology, and other staff members with primary responsibility for systems functionality throughout the university. Senior-level managers, including the chief business officer, also have the opportunity to share concerns through their participation in the university's monthly enterprise systems planning group.

"It's a very open and collaborative environment, and we discuss these kinds of issues across the university," Currie says. "Nothing is ever off the table here. We will continue to monitor cloud computing very closely. We won't be early adopters; we'll be early followers."

According to Muchane, most efforts at Davidson College are collaborative rather than IT- or department-centric. A recent example was a joint team formed to look for an alternative to the library's aging card catalog system. "They decided on a cloud-based service," he notes. "Librarians are responsible for the use of the product and some aspects of the relationship with the vendor, but handling most technical questions and billing falls to the IT department, which has the financial relationship with the vendor."

In addition to joint teams formed on an ad hoc basis, Davidson has a technology advisory committee made up of two groups: the academic computing committee, to which the dean of the faculty appoints members; and the Banner team leaders' group, made up of users from across the campus and named for the systems the college currently uses. Muchane participates in both groups and reports to Kania about their activities.

The process is less formal at Millersville University, where according to Bruszewski, "The composition of IT task forces varies based on the service and our needs." For example, he worked directly with the university's vice president of information resources to evaluate options for making the university's electronic billing more efficient and cost-effective.

In another instance, "A small four-person task force made up of the university's development staff and outside consultants is completing a gap analysis of what we need versus what we have, to run our capital campaign more effectively. Cloud is one option that will be considered," Bruszewski explains. "Another task force made up of internal IT staff and vendors is reviewing options for implementing customer relationship management in the admissions office."

Staffs working in Millersville's finance and human resources departments have grown accustomed to cloud computing through their use of what Bruszewski describes as a "private cloud" for the 14 public institutions that make up the Pennsylvania State System of Higher Education.

Certainly, it takes involvement at all levels to fully examine the range of business issues that cloud computing may present. When MCCC begins implementation of a cloud computing service, it calls on an IT advisory committee made up of representatives from every academic and administrative department on campus.

"Everyone from administrative staff to deans participates," Bowen says. "We also hold specific academic IT cluster meetings with departments that are IT-centric. We have user groups as well." Within its governance structure, the university also has a Web advisory committee.

From a cultural standpoint, faculty and staff at MCCC are not strangers to the cloud. The college's online learning system has always been in the cloud. Its emergency response system and facilities management program are both hosted solutions as well. According to Bowen, "People at Mercer are quite comfortable with the cloud."

However, this may not always be the case, as Davidson College's Muchane learned when he suggested using the cloud to augment the features on the athletic department's Web site. "They wanted more features on the Web site, such as subscriptions to live feeds of home games and access to up-to-the-minute stats," Muchane explains. "We ultimately decided that it would be most cost-effective to do this in the cloud rather than customizing the existing site, but first we had to recognize that this was a shift in our institutional strategy on Web hosting. You definitely need to understand the nature of the service that's being provided in the cloud and how it meshes with your institutional culture."

Calculating the True Costs of the Cloud

In the current economic environment, cutting costs is certainly in line with the culture at most institutions. For some, cost-cutting measures served as the impetus for expanding the use of cloud computing on their campuses. Others opted to find cost savings in other areas.

"For many schools, moving to the cloud was an imperative to control costs," Currie says. "We've looked at other cost-saving measures as opposed to jumping into the cloud. For example, we've consolidated resources into central locations and renegotiated contracts with vendors willing to help us keep costs under control."

When it comes to entering the cloud, it pays to look before you leap. Muchane and Kania urge institutions to be comprehensive in calculating the costs of cloud computing, because there is a tendency to underestimate the expenses associated with its implementation and maintenance. "Be cautious about thinking that the cloud saves money, especially once you evaluate the level of support that still has to be provided in-house," Muchane cautions.

He and Kania have worked together to ensure that Davidson takes a cost-benefit-analysis approach to evaluating cloud services. "It's not just buying whatever is cheapest," Kania emphasizes. "We are looking for the best combination of value and services."

From Bowen's perspective, this is a wise decision. She says of cloud computing, "It's a funding model that doesn't involve a lot of capital, but there are annual operating expenses for which the institution needs to budget. Business officers can be helpful by assisting with the review of contracts on the front end to be sure that the services are in fact being provided in a cost-effective way."

With their promise of cost savings, software-as-service payment models where expenses are assessed based on the number of users or the volumes of data processed are among the hallmarks of cloud computing. However, it's important that institutions consider the total costs of operating in the cloud environment.

At Oakland University, Rochester, Michigan, "The chief business officer has been supportive of change when we consider the total cost of ownership," notes Theresa Rowe, the university's chief information officer. "We need to understand the total cost of operation in the cloud environment, particularly if there are annual escalator clauses in the financial arrangements for such agreements.

"In some cases we've found that after five years of projected annual cost escalations, the cloud environment is not competitive with a university installation," she continues. "Other times the reverse is true.  IT and the finance and administration division need to work together to build multiyear total cost-of-operation projections for all scenarios." These projections may illustrate that short-term cost savings from using the cloud may not be competitive with long-term investment in an institution's IT infrastructure.

At the same time, Rowe acknowledges that there may be instances where expediency trumps cost: "If we are introducing a new service, the new service is desired now, and we are not sure of the adoption rate or penetration of the new service, using cloud computing services may be a wise decision even if a three- to five-year cost projection is slightly more than internal investment. This is factoring in the need to be agile and responsive in a fast-paced IT market."

Along with the long-term or multiyear costs of maintaining cloud computing services, institutions should also factor in the costs of their exit strategy. For example, institutions may incur the cost of buying back software licenses. "What is your decision-making process or backup plan if you're not happy with services of the cloud?" Bruszewski asks. "How will you get out if things don't go as planned? You must have an exit strategy in the event that the relationship does not work out." 

Recognizing Risks

When evaluating the business case for cloud computing, institutions must include risk management in the equation, along with costs and demands for new services. From a risk management standpoint, the primary concern will be the secure "processing, transmission, and storage of confidential or personally identifiable information in cloud computing solutions," Rowe observes. "Each campus has its own tolerance for risk." (See sidebar, "Cloud Coverage: Understanding Risks You Should Assess.")

According to Princeton's Currie, concerns about maintaining data security should be a major factor in a university's decision whether to integrate cloud computing services into its IT environment. "Depending on what data is out there, you're taking a significant risk," he says. "How is data traveling? What server is it landing on? Who has access to the information?"

Currie expresses concern that institutions may not have as much control over data management in the cloud as they might think. "Let's say that the firm you're working with has outsourced data storage to someone else," he explains. "Where is that data, and how can you be sure that it will be safe?"

In addition, he says that with the introduction of cloud computing on their campuses, institutions' IT governance has to change as well: "If IT no longer has control over access to systems, the departments whose systems are now being run in a cloud model have to step up and monitor these systems more closely. They will need to take more responsibility."

Davidson's Kania believes that some of the risks associated with cloud computing can be mitigated by institutions developing vendor-specific relationships and centralizing the process for doing so. "Our practice is not for departments to contract with vendors," he says. "We have a say on the front end and express concerns about security, hosting risks, or integration with other systems on campus. We make sure that we're buying the right products from reliable vendors."

Even so, institutions must also have a means for addressing the risks associated with departments and individuals who are beginning to use cloud computing services they find on their own, without going through normal channels. For instance, at Mercer County Community College, a department was using an online gradebook-a free application in the cloud-and brought the idea of implementing it across campus to Bowen's attention.

"Users are concerned with ease of use and access, but from an IT perspective, we look at different risk factors," Bowen says. "If this solution were implemented campuswide, how would students and faculty authenticate? Where is data stored? Who owns it? How is it secured and backed up? Is the solution FERPA-compliant? What are the components of the service-level agreement?" Bowen and her staff will evaluate these elements of the cloud computing service currently in use and determine whether it is a viable option for the college as a whole.

"More and more decisions are being made by the individual consumer, and institutions need to be aware that individuals may act outside traditional university constraints," Rowe observes. "For example, a university may decide not to go with an alternative-funded e-mail solution such as Google Apps for Education or Microsoft Live, but that university needs to understand that individuals may still obtain and use a personal Gmail account. Now expand that to the hundreds of personal computing solutions that an individual may acquire and use. There is a growing blend of work and personal computing that must be addressed in campus policies and procedures."

As institutions begin to address these issues and work to identify and mitigate risks, keeping lines of communication open between the business office and other departments-legal, compliance, risk management, and IT-will be critical.

"It's important that chief business officers be involved in the process and open to being engaged by IT in dealing with these issues," Muchane says. "They should ask lots of questions. We have a very open process here where decision making is collaborative. It's great that Ed and I can ask questions of each other about what needs to be considered. We're able to look at issues from all angles.

"Each situation is different, and CBOs may find themselves talking on either side of the issue. It may make sense for IT to suggest that a service be moved to the cloud or vice versa," he continues. "You need to approach the process from a position of being open to hearing what the department has to say. It's a process of really listening and exchanging ideas, because ultimately a decision has to be made."

APRYL MOTLEY, Columbia, Maryland, covers higher education business issues for Business Officer.

Case by Case in the Cloud

Most colleges and universities have taken an incremental approach to cloud computing. "I don't think it's effective to make an across-the-board decision to use or avoid cloud-based solutions," says Edward Kania, vice president for finance and administration at Davidson College, Davidson, North Carolina. "A case-by-case analysis makes the most sense." Given this overarching philosophy, here are two examples of cases where institutions have found it most efficient to provide services in the cloud.

Electronic mail. Mercer County Community College, West Windsor, New Jersey, decided that it was best to investigate going into the cloud for student e-mail. "Our challenge is having 13,000 students who come and go at different times, and supporting their use of electronic mail," explains Susan Bowen, the college's executive director for information and technology services. "We are using Gmail because of the ease of its interface. We don't have to do training because students are already familiar with it. It makes sense to let them stay in that environment." In addition, this move gives the college access to additional applications like Google Docs for creating and sharing documents.

Electronic billing. Millersville University, Millersville, Pennsylvania, recently put its electronic billing services in the cloud with a third party. "When people paid tuition by credit card, it was costing the university $400,000 a year," says Roger Bruszewski, the university's vice president for finance and administration. "By moving this service to the cloud, we're no longer collecting credit card information and paying fees to vendors." He says other benefits of moving electronic billing to the cloud include improving customer service and reducing staff time spent on compliance with federal regulations.

While there is still some hesitancy on the part of institutions, use of cloud computing is likely to expand as more institutions gain experience and share it with their peers. "It's a new and untested business model," Bruszewski says. "As people get more comfortable, you'll see more institutions in the cloud."

^ Top

Cloud Coverage: Understanding Risks You Should Assess

Inherent in most opportunities for increased efficiency and cost savings is some level of risk, and operating in the cloud environment is no different. 

In their white paper, "Managing the Risks of Operating in the Cloud," Phillip D. Porter and Michael E. Larner, partner and counsel respectively for the international law practice of Hogan Lovells in McLean, Virginia, identify four main categories of risks to assess as you consider the business case for moving operations to the cloud on your campus.

Vendor. All cloud services vendors are not created equal. In consultation with your chief information officer (CIO), you'll want to verify the vendor's credentials in terms of its financial stability and capability to provide reliable services. When assessing the risk of selecting a specific cloud services vendor, you should also consider the nature of the proposed services, the data that will be transferred to the cloud, and the vendor's proposed contract for providing its cloud services.

Technology. The most significant risk that results from the shift in possession and control of your technology assets from the institution to a third party is loss of control over responses to problems with those assets. To address this risk, you and your CIO should review the service levels that a vendor offers to undertake to measure and maximize the availability of service, resolve functionality errors, and provide user support.

Confidentiality, privacy, and data security. You'll want to evaluate whether the proposed cloud services require the transfer of confidential information or protected personal information to the cloud, which includes inquiring about whether the vendor has policies and procedures in place that will reasonably support your institution's confidentiality, privacy, and data security interests. You also need to find out from the vendor what remedies are available to your institution if confidential or protected personal information is lost or improperly accessed, modified, or disclosed.

Policy and compliance. To address this area of risk, you need to determine what impact the proposed cloud service will have on your institution's ability to meet applicable federal, state, accreditation, and electronic discovery requirements and what remedies are available if a vendor performance failure causes your institution to violate any of these requirements.

The white paper on risk will be available later this summer, along with two other white papers on cloud computing. (Also see sidebar, "What CBOs Need to Know About the Cloud.")

^ Top

What CBOs Need to Know About the Cloud 

To prepare chief business officers for conversations about cloud computing with their chief information officers, NACUBO is developing materials as an outcome of a joint conference in early 2010 with EDUCAUSE, Internet2, and others. (See "High Altitude Technology" in the July/August 2010 Business Officer for a report on the conference.)

These materials are available as white papers and on-demand webcasts, as well as a session at the NACUBO 2011 Annual Meeting in Tampa. At the annual meeting, authors of the white paper series will serve as panelists at a session in the Running the Campus track. It will take place on Monday, July 11, at 2 p.m.

The white papers themselves will become available individually as a webcast is scheduled on each topic. The first paper, "Capturing the Cloud, Defining the Business Case"-which served as a source for this magazine article-was completed this spring and a related webcast held in May. Written by Bonnie Burns, senior writer for SunGard Higher Education, the white paper can be found here, while the on-demand webcast is available here.

The second paper, "Managing the Risks of Operating in the Cloud," is nearly finalized and a webcast will be scheduled this summer. Authors Philip D. Porter and Michael E. Larner, from the McLean, Virginia, office of the international law firm Hogan Lovells, regularly assist clients with cloud computing transactions. The third white paper, written under sponsorship of Grant Thornton, will address how to audit a relationship with a cloud provider.

Watch for announcements of the remaining two webcasts over the next few months. You can register here. For more information regarding this effort, contact Bill Dillon, NACUBO executive vice president.

^ Top