11. A FRAMEWORK TO GUIDE COMPANIES ON ADOPTING CLOUD COMPUTING TECHNOLOGIES Maurice Nyaoro Bitta Submitted in partial fulfillment of the requirements for the Degree of Master of Science in Computer Based Information Systems at Strathmore University Faculty of Information Technology Strathmore University Nairobi, June 2012 This dissertation is available for Library use on the understanding that it is copyright material and that no quotation from the dissertation may be published without proper acknowledgement. 84479 A Framework to guide companies on 12. DECLARATION I declare that this work has not been previously submitted and approved for the award of a degree by this or any other University. To the best of my knowledge and belief, the dissertation contains no material previously published or written by another person except where due reference is made in the dissertation itself. © No part of this dissertation may be reproduced without the permission of the author and Strathrnore University ................................................. [Name of Candidate] ... : ...................... : .. [Signature] ...................................... [Date] Approval The dissertation of Maurice Nyaoro Bitta was reviewed and approved by the following: Reuben Marwanga, PhD Faculty of Information Technology Strathrnore University Reuben Marwanga, PhD Dean, Faculty of Information Technology Dean, School of Graduate Studies II ABSTRACT Cloud computing has emerged as a popular computing model in the Westem world. It is still not well understood by many companies in the developing world that may benefit from its pay-per-use models, and low hardware and software management costs. This dissertation aims at describing Cloud computing, discussing its benefits and barriers, and proposing a framework that small businesses could use to guide them with the adoption of this new computing paradigm. The dissertation deploys the case study as its research methodology. Three small businesses are studied. All three companies are small businesses as per the definition provided by the European Commission. One company is a non-profit, while the other two are for-profit organizations. One of the two for-profit companies operates in an IT intensive industry. The proposed framework is built on the premise that the quality of data collected through qualitative enquiry is sufficient for it to be used for evaluative purposes. Also, although three cases may not be a basis that is large enough for arriving at a scientific conclusion, the research uses Walsham (1993) argument that from an interpretive position, the validity from our extrapolation from these cases depends on the plausibility and cogency of the logical reasoning used in describing the results from the cases, and in drawing conclusions from them. From the research, we discover that businesses perceive Cloud computing to be useful and that they are prepared to face the challenges that hinder its adoption but that they lack a framework to guide them in adopting this technology. This dissertation's key contribution therefore is the proposal of a four-staged framework that could be used to guide small businesses in adopting Cloud computing technologies. III TABLE OF CONTENTS DECLARA TION ............................................................ ........................................................................ ii ABSTRACT ..................................................................... ....................................................................... iii LIST OF T ABLES .......................................................... ...................................................................... vii LIST OF FIGURE S ......................................................... .....................................................................viii LIST OF ABBREVIATIONS .......................................... ....................................................................... ix ACKNOWLEDGEMENTS ............................................. ........................................................................ x DEDICATION ................................................................. ....................................................................... xi CHAPTER ONE: INTRODUCTION .............................. ....................................................................... 1 1.1 Background ........................................................... ....................................................................... 1 1.2 Problem statement. ................................................ ....................................................................... 5 1.3 Research objectives ............................................... ....................................................................... 6 1.4 Research question s ............................................... ....................................................................... 6 1.5 Scope and Limitations ........................................... ....................................................................... 6 1.6 Significance of the research .................................. ....................................................................... 7 CHAPTER TWO: LITERA TURE REVIEW .................. ' .................................................................... 8 2.1 Defining cloud computing ..................................... ....................................................................... 8 2.1.1. Cloud Description .......................................... ....................................................................... 9 2.1.2. Cloud Technology Delivery ........................... .................................................................... 11 2.1.3. Proposed definition ........................................ ..................................................................... 13 2.2. Cloud computing as a commercial reality ............. ..................................................................... 13 2.2.1 SaaS Users ...................................................... .................................................................... 13 2.2.2. SaaS Providers I Cloud Users ........................ .................................................................... 15 2.2.3. Cloud Providers ............................................. .................................................................... 16 2.3. Barriers to the adoption of the Cloud Computing IT model ....................................................... 17 2.3.1. Performance bottlenecks ..................................................................................................... 17 2.3 .2. Highly probability of single point offailure ....................................................................... 18 2.3.3. Data lock-in ......................................................................................................................... 18 2.3.4. Data Confidentiality, Security and Trust ............................................................................. 19 2.3.5. Challenge from incumbent software market leaders ........................................................... 19 2.3.6. Switching costs .................................................................................................................... 20 iv 2.3.7. Lack of variety of services ................................................................................................... 20 2.4. Summary and Emerging Issues .................................................................................................... 20 CHAPTER THREE: RESEARCH METHODOLOGY ........................................................................... 22 3 .1. Introduction ................................................................................................................................. 22 3.2. Research design .......................................................................................................................... 22 3.3. Case study methodology ............................................................................................................. 23 3.4. Data collection ............................................................................................................................ 25 3.4.1. Data collection technique ..................................................................................................... 26 3.4.2. Site and sample selection ..................................................................................................... 27 3.5. Framework for analysis ............................................................................................................... 30 3.5.1. Interview Model. .................................................................................................................. 30 3.5.2. Operationalization ................................................................................................................ 32 3.6. Validity ........................................................................................................................................ 34 3.7. Reliability .................................................................................................................................... 34 3.8. Limitations and potential problems ............................................................................................. 35 CHAPTER FOUR: CASE STUDY FINDINGS AND DISCUSSION ................................................... 37 4.1. Introduction .................................................................................................................................37 4.2. Case company profiles .................................................................................................................38 4.3. Findings ...................................................................................................................................... 39 4.3.1 Theme A: Comprehension of Cloud Computing .................................................................. 39 4.3.2. Theme B: Barriers to Cloud Computing .................................................................... o< •••••••••••••••••••••• 41 4.3.3. Theme C: Factors Affecting Adoption ................................................................................ 45 4.4. Discussion ................................................................................................................................... 49 4.4.1. Comprehension of Cloud computing ................................................................................... 49 4.4.2. The major barriers to Cloud computing ............................................................................... 50 4.4.3. Factors affecting Cloud computing adoption ....................................................................... 52 CHAPTER FIVE: PROPOSED FRAMEWORK ........................................................................... 54 5. I. Introduction ................................................................................................................................. 54 5.2. Background of the framework ..................................................................................................... 54 5.3. Scope of the framework ............................................................................................................. 55 5.4. Content of the framework ........................................................................................................... 56 5.4.1. Phase I ................................................................................................................................. 57 v 5.4.2. Phase II .......................................................................................................................... 60 5.4.3. Phase III ................................................................................. 61 5.4.4. Phase IV ....................................................................................................................... 62 5.5. Justification for the research ............................................................................................... 63 5.6. Conclusion .......................................................................................................................... 63 CHAPTER SIX: CONCLUSION .................................................................. ................................ 64 REFERENCES .............................................................................................. ................................ 65 APPENDIX A: INTERVIEW THEMES & QUESTIONS ........................... , .............................. 71 APPENDIX B: INTERVIEW NOTES FROM MANAGEMENT OF COMPANY X (NON- PROFIT) ......................................................................................................................................... 75 APPENDIX C: INTERVIEWNOTES FROM USERSI OTHER STAFF OF COMPANY X (NON-PROFIT) .............................................................................................................................. 80 VI LIST OF TABLE S Table 3-1: Breakdown ofthemes and questions .............................................................................. 33 Vll LIST OF FIGURE S Figure 2-1: High-level Cloud architecture adapted from Buyya et al. (2008) .................................. 9 Figure 2-2: Cloud computing abstraction layers ............................................................................ 11 Figure 5-1: Proposed cloud computing adoption framework ......................................................... 57 Vlll LIST OF ABBREVIATIONS API - Application Programming Interface FOSS - Free and Open Source Software IaaS - Infrastructure as a Service Mbps - Megabytes per second PaaS - Platform as a Service QoS - Quality of Service SaaS - Software as a Service SLA - Service Level Agreement SME - Small and Medium Enterprises VM - Virtual Machine WiMAX - W orldwide Interoperability for Microwave Access lX ACKNOWLEDGEMENTS I thank: all the teachers in my life who continue to be in every aspect shepherds to my continued academic journey. Special appreciation goes to my masters lecturers who were fun to share my postgraduate experience with. I also acknowledge my classmates, especially Joy Mwangi, Mathew Shahi, Patrick Oluoch and Washington Omwomo, with whom we challenged and enriched the postgraduate experience. The important support from my parents and siblings cannot be overstated. Special appreciation goes to my supervisor, Dr. Reuben Marwanga, whose course "Business Information Systems" generated my interest in Cloud computing in general and software as a service in particular. I am also indebted to him for his guidance throughout this dissertation. Above all, I thank God for this life, its travails and all its beauty. x DEDICATION This work is dedicated to my parents for the good job done in guiding me this far, and to my siblings Caesar, Emmanuel and Christian who believe in the possibilities of the impossible. XI CHAPTER ONE: INTRODUCTION 1.1 Background Cloud computing is arguably the most popular emerging computing paradigm that enjoys huge commendation (Hayes, 2009). It is predicted that this new Information Technology (IT) paradigm will change the entire computing landscape from technology to human resource to businesses and their outputs (products or services) (Y ousif, 2010). Though several critical reservations continue to be raised about cloud computing, its proponents' faith remains unmoved as they provide a positive reply to each of the reservations raised (Hayes, 2009). However, one key area that cloud computing proponents have been unable to provide an adequate answer to is its definition. The many existing definitions and the variety of technologies used in the Cloud aggravate the confusion that already exists about this new computing model. Moreover, most of these definitions as seen in Geelan (2009) seem to focus on different aspects of Cloud computing rather than providing a unified description (Vaquero, Rodero-Merino, Caceres, & Lindner, 2009). Nevertheless, according to Armbrust et al., (2009) there is no time better than this for businesses to consider adopting the cloud computing model for their IT infrastructure. They analogize the advantages brought about by cloud computing to the software industry to have an irnpact comparable to that which foundries brought to the hardware industry. With continued technological advances, several new computing paradigms such as cluster computing, Grid computing, Peer-to-Peer computing, service computing, market-oriented computing and cloud computing have been proposed and adopted (Buyya, Yeo, & Venugopal, 2008). The promise ofmost of these new paradigms is to provide pervasive computing where consumers seek to pay for computing services only when they access them. To provide such pay-per-use computing services the paradigm adopted would need to be scalable, autonomic to support ubiquitous access, have high reliability and guarantee specific Quality of Service (QoS) parameters and Service Level Agreements (SLAs). Of all these new paradigms, cloud computing and Grid computing offer the most promise (Buyya et al., 2008). However, before getting to know why cloud computing and Grid computing hold the most promise of the new paradigms, it is important to understand why these paradigms emerged in the first place. Today, almost any major human economic activity depends on IT and/or IT services. Further, today's technology needs to improve end-user productivity while simultaneously reducing the technology-driven overheads (Vouk, 2008). Currently, the more popular approach being floated to reduce technology-driven overheads in organizations is to apply the service provisioning model that is similar to that used in supplying basic essential services such as water and electricity to people's homes (Buyya et al., 2008). Additionally, consumers are looking for ways to reduce the 'characteristic' huge initial investment and difficulties that come with building and maintaining complex IT infrastructure. The argument here is that as IT has become accessible and affordable to all companies will need to manage their IT investments defensively - watching costs and avoiding risk, because this ubiquity inexorably diminishes the strategic potential for IT to differentiate one company from others (Carr, 2003). Gone is the era when companies would throw huge amounts into procuring the latest technological innovation with the hope of gaining sustainable competitive advantage. Carr (2003) therefore urges organizations to seek to achieve the necessary levels of IT capability at the lowest possible cost and risk. Inasmuch as new technologies will continue to give companies the ehanee to differentiate them by service, produet feature, and eost structure for so me time to come; McFarlan & Nolan (2003) pointed out that eompetitive advantage is more sustainable where the company pursues it by extending its eompetitive scope, developing partnerships, changing the rule s of competition, and providing new IT- based services to extend their customer value proposition. 2 Other than cost, another major driver for the push towards the need for new paradigms to acquire IT infrastructure is the immense imoads made in technology as a result of combinatorial innovation. Varian (2003) defined combinatorial innovation as a set(s) of technologies that come along and offers a rich set of components that can be combined and recombined to create new products. Cloud computing is a technology that could be directly attributed to have come about because of combinatorial innovation for three main reasons. For starters, the phenomenal growth ofweb services in the 2000s forced many large Intemet companies to invest heavily in the construction of extremely large datacenters. These large Intemet companies also had to develop scalable software infrastructure and operational expertise to protect these datacenters and to get the best out of them (Armbrust et al., 2009). To leverage on and amortize their large investment on data centers, it was natural that these large Intemet companies would seek to create new revenue streams on top of these existing infrastructures (Armbrust et al., 2009). Secondly, in the advent of an era in which low-cost ownership of IT was possible, companies preferred IT infrastructures where vendors assume most of the risks of failure while increasing ease of use (Strassman, 2003). And thirdly, consumers want the ability to pay for use of computing resources on a short-term basis as needed and to also relinquish them as needed (Armbrust et al., 2009). Furthermore, the growth of cyber-infrastructure, which Vouk (2008) defined as computer networks, the World Wide Web and software services, could also be adequately categorized as part of the combinatorial innovation described above. However, its huge scope and impact necessitate that its influence on the emergence of these new IT paradigms be evaluated on its own. Vouk (2008) stated that cyber-infrastructure make s the development and deployment of applications easier and thus enables expanding the feasible scope of applications possible within common organizational constraints such as budget and expertise. Also, cyber-infrastructure facilitates the efficient sharing of IT equipment and services. The growth in cyber-infrastructure therefore led to an emergence of mobile technologies and mobile devices that enhanced flexibility and mobility for consumers. Due to their 3 size constraints mobile technologies require more resources than can be made available on the devices for real-time information processing and interactivity (Kovachev, Renzel, Klamma, & Cao, 2010) which implies the need for an IT infrastructure that can extend computing resources outside these devices. With all the chalienges highlighted above, businesses have found it necessary to seek new IT paradigms that come with a service provisioning model. Even though Carr (2003) generated much debate over his assertion that IT has become so commonplace that it needs to be treated as any other commodity to a business, his proposal that investment in IT be handled with an eye on minimizing risk exposure and at the lowest cost possible, seems to have gained a foothold on today's organizations. Consumers have become increasingly better informed, and this has heightened their selfconfidence making them more willing to try newer, efficient and cheaper technology offerings especially for performing noncritical functions. Cloud computing and Grid computing have been singled out by Buyya et al. (2008) as the more popular paradigm for this new consumer markets because they are the best marched to deliver IT services as computing utilities. Grid computing emphasizes on the coordination of resources from different organizations using standard, generalpurpose protocols and interfaces to deliver nontrivial qualities of service (Foster, 2002). On the other hand, Cloud computing refers to large pools of virtualized computing resources that can be dynamically reconfigured to adjust to a variable load, that are easy to use and access, and are typically exploited by a pay-per-use model (Vaquero et al., 2009). An in-depth evaluation of the definition of Cloud computing is carried out further in this research where its difference with Grid computing shall also be clarified. It is arguably true that Cloud Computing is still at its infancy stage (Vaquero et al., 2009) and therefore it is natural that many enterprises remain skeptical. Moreover, the skeptics point out that significant challenges persist in the universal application of cloud computing with many systems that are being developed for it being in the proofof-concept stage (Buyya et al., 2008). With such arguments it is difficult to see howa company in a developing country could go on and adopt cloud computing. It is 4 especially important to raise this issue in this research considering that it is primarily conducted in Kenya - a developing country in Africa. African countries are not particularly renowned for being early adopters of new technology. In fact the assumption has been that there is a huge disconnect between businesses and technology in Africa. However, Kenya' s globalleadership in the area ofm-commerce as evidenced through the success ofSafaricom's M-Pesa service demonstrates that the developing world is not only catching up with the developed world on technological uptake, but that it also has the capacity to take leadership in some aspects. Kenya lacks the plethora of IT paradigms that are available to the developed countries, such as Grid computing, Peer-to-Peer computing and so ono The ease with which the Cloud computing model can be adopted and used makes it a likely candidate for success in Kenya. Much like M-Pesa, so long as businesses and consumers are convinced of the utility, capacity and other benefits of cloud computing, they would be very willing to embrace this new model of acquiring IT infrastructure. The question at this point would be: why are Kenyan businesses not adopting the Cloud computing model? 1.2 Problem statement Many businesses in Kenya today have yet to adopt cloud computing as an IT provisioning method. This could be the consequence of firstly; the variety of technologies, the hype and the lack of a dear definition of what is the Cloud (Vaquero et al., 2009). This confusion prevents even the daring explorer firms (March, 1991) or early adopters to be wary of embracing this new IT paradigm. Secondly, businesses have not been made fully aware of the merits and demerits of adopting the Cloud; and most of ali, even if businesses wanted to adopt the Cloud computing model, they lack a framework to guide them through the entire process. To facilitate arriving at a solution that shall adequate1y address this problem statement, the following research objectives have been outlined. 5 1.3 Research objectives The research objectives for this dissertation are to: 1. Analyze the architecture and operation of cloud computing. 11. Explain why businesses need to adopt cloud computing. Ill. Analyze the barriers to the adoption of cloud computing by businesses. IV. Propose a model that businesses can use to assist them in the adoption of cloud computing technologies. 1.4 Research questions From these research objectives the research questions that shall guide us through this research are: 1. How does cloud computing work? 11. Why should businesses consider the cloud computing model of IT infrastructure ? Ill. Why are businesses hesitant in adopting cloud computing? IV. How can businesses go about adopting cloud computing? 1.5 Scope and Limitations This study willlimit itself to the development of a framework for adoption of Cloud computing for small organizations. Staten, Yates, Gillet, Saleh, and Dines (2008) stated that Cloud computing is still in the early-adopter phase which implies that it is not ready to meet enterprise requirements. Nevertheless, they advocate for its adoption by smaller organizations. Our definition of small organizations is in accordance with the European Commission's definition: a small enterprise has 11 to 49 employees (European Commission, 2005). 6 1.6 Significance of the research Much was expected from the arrival of the fibre optic cable at the Kenyan coast town, Mombasa. This infrastructure was hailed as a major force for the country to accomplish its industrialization goal by 2030. In fact President Mwai Kibaki is quoted to have referred to it as a landmark in Kenya's national development history (AFP, 2009). However, the success of the arrival of the fibre optic can only be measured by how much it is utilized. According to Stansfield and Grant (2003) the Internet and Internet related technologies undoubtedly provide fresh opportunities to companies of all sizes in terms of expanding their marketplace, creating highly specialized businesses and improving the quality and speed of their processes. This is especially true for smaller companies, whose size and location can become irrelevant, in theory, since through the Internet they have access to the same global market places as large companies. It is well documented that small enterprises play a vital role within many major economies (Samiaji & Zowghi, 2003; Stansfield & Grant, 2003). The arrival of the fibre optic cable in Kenya assures businesses of adequate Internet capacity. However, even with this increased Internet bandwidth, smaller companies still face particular challenges if they are to survive and flourish in the face of competition from larger companies who have more resources, technical expertise and capital (Stansfield & Grant, 2003). Cloud computing is a new IT paradigm that allows businesses to acquire IT infrastructure, over the Internet, without the need to own them. With Cloud computing smaller companies will now have access to competitive IT infrastructure, despite their fewer resources, and still be able to easily ramp demand up or down as needed (Leavitt, 2009). This research aims to provide a framework that Kenyan businesses can use to acquire Cloud technologies for themselves. The proposed framework will provide a guide to small organizations on how they can go about evaluating and implementing this unique way of acquiring IT infrastructure without owning that is referred to as cloud computing. 7 CHAPTER TWO: LITERATURE REVIEW 2.1 Defining cloud computing Cloud computing has been termed as being confusing (Rimal, Choi, & Lumb, 2009), as an overloaded phrase with tons of connotations (Pritzker, 2008), and as a technology at the peak of the Gartner hype cyc1e (Schonfeld, 2008). It is mainly characterized by virtualization, scalability and pay-per-use utility model and has too much semblance of visions with Grid computing (Vaquero et al., 2009). Both Cloud and Grid computing aim to reduce computing costs and increase flexibility and reliability through use of third-party operated software (Vaquero et al., 2009). In some quarters the Cloud is confused to be a combination of c1usters and Grids, which is not the case (Buyya et al., 2008). There is therefore a need to find a crisp definition that distinguishes Cloud computing from Grid computing. In a quest to do this, Geelan (2009) provided a round-up of twenty definitions from Cloud computing experts but failed to amalgamate these definitions into one, which stillleaves the hitherto risk of vagueness. On the other hand, Vaquero et al. (2009) went a step ahead and found a common denominator from more than twenty expert definitions of the Cloud. They used their analysis of the numerous definitions to arrive at a more comprehensive definition of the Cloud as stated below: Clouds are a large pool of easily usable and accessible virtualized resources (such as hardware, development platforms and/or services). These resources can be dynamically re-configured to adjust to a variable load (scale), allowing also for an optimum resource utilization. This pool of resources is typically exploited by a pay- per-use model in which guarantees are offered by the Infrastructure Provider by means of customized SLAs (Vaquero et al., 2009, p. 51 ). 8 2.1.1. Cloud Description As good as the definition above by Vaquero et al. (2009) is this research proposes to describe the Cloud through a depiction of its architecture, and the mode of delivery for this technology with the common features to be found therein. 2.1.1.1 Cloud architecture It would be simpler to realize a clearer description of the cloud after exhibiting an understanding of the Clouds' high-level architecture and the entities involved. The cloud architecture is represented diagrammatically as shown below. Actors in the Cloud can be categorized as providers or users of Software as a Service (SaaS), or providers or users of Utility Computing. Providers of SaaS are also referred to as users of utility computing or Cloud Users (Arrnbrust et al., 2009) while providers of utility computing are Cloud Providers. Most of the attention in Cloud computing has gone to SaaS Users. Cloud Providers own the computing resources which they offer as a service to SaaS Providers. This accords SaaS Providers flexibility and lower operational costs which are transferred to SaaS Users. 9 2.1.1.1.2. SLA Resouree Allocator This supports SLA-oriented resource management which includes several key features for viability of Cloud computing. Buyya et al. (2008) outlined the six core mechanisms in the SLA resource allocator as: service request examination and admission control, pricing, accounting, Virtual Machine (VM) monitor, dispatcher and service request monitor. The purpose of the service request examination and admission control is to prevent overloading of resources. This is done through examining requests submitted by Cloud Users for Quality of Service (QoS) requirements and determining whether to accept or reject them. The pricing mechanism determines how service requests are billed while accounting checks the actual usage of resources for accurate billing and resouree allocation decisions. VM monitor tracks availability ofVMs while the dispatcher starts execution of accepted service requests on allocated VMs. The service request monitor tracks progress of service requests. 2.1.1.1.3. Virtual Machines (VMs) A virtual machine is a software implementation that provides a virtualization of a physical host machine (Keahey, Foster, Freeman, & Zhang, 2005). Virtual machines are separated into two major categories: system virtual machines and process virtual machines. The former provide a complete system platform which support the execution of a complete operating system while the latter is designed to run single programs. Software running on the host is responsible for supporting this abstraction by intercepting and emulating instructions issued by the guest machines. This software is referred to as virtual machine monitor (VMM) or hypervisor (Keahey et al., 2005). 2.1.1.1.4. Virtualization Virtualization refers to the abstraction of logical resources away from their underlying physical resources, which makes it possible for the dynamic creation, expansion, shrinking or moving of computing resources as demand varies (Rimal et al., 2009). Virtualization is not something new. It has existed in one form or another since the 10 days of the IBM mainframe. Virtualization increases agility and f1exibility of computing resources (Rimal et al., 2009) which ensures scalability and high availability of resources (Armbrust et al., 2009). The latest virtualization technologies allow different operating systems to be hosted on the same physical hardware at a datacentre. Virtualization can be of different types such as server virtualization, storage virtualization and network virtualization. 2.1.1.l.5. Physical Machines These are the numerous computing servers found at the Data Centre of the Cloud Provider. 2.1.2. Cloud Technology Delivery Cloud computing allows delivery of computing resources as services in the form of Infrastructure as a Service (IaaS), Platform as a Service (PaaS) or Software as a Service (SaaS) depending on the level of abstraction that the client desires. A depiction of these layers of abstraction is shown below. 2.1.2.1. Infrastructure as a Service Under this form of delivery, a business opts to access computing infrastructure from a Cloud provider instead of the traditional purchase of physical servers and software needed to set up a datacenter. IaaS is made available to consumers through software Application Programming Interfaces (APIs). According to Bhattacharjee (2009) the providers here differentiate their offerings based on the number of operating systems (OS) they support, the software that accompanies the as, the SLAs and the pricing model. Examples of IaaS providers are: Mosso I Rackspace, Amazon S3, GoGrid and Flexiscale. 2.1.2.2. Platform as a Service In PaaS the Cloud provider avails all the facilities that an application developer would require to build, test and deliver applications over the Intemet from a single cloud (Bhattacharjee, 2009). In the traditional model of software development applications are written in one environment, tested in another and deployed elsewhere. The costs of developing in these multiple environments and the risks all falI on the application owner. With PaaS, the entire software lifecyc1e is supported on the same computing environment which reduces development costs, project risk and time-to-market (Bhattacharjee, 2009). Also, given that the entire development environment is hosted on the Cloud, collaboration is made easier via the Intemet. Examples of PaaS providers are: Bungee Lab's Bungee, Microsoft Azure and Google App Engine. 2.1.2.3. Software as a Service This is the most common form of Cloud services delivery for example services like mail, calendar and maps provided by Google, Microsoft and Yahoo. SaaS is the delivery of applications across the Intemet where the web browser is often the interface for delivery (Bhattacharjee, 2009). The SaaS model eliminates the need to install and run an application on the customers own computer, the cost and burden of software maintenance on the customer, and support. However the consumer does lose control over major aspects of the software such as versions and changing requirements which may cause problems of backward compatibility on the consumer. Examples of SaaS providers are: Salesforce Sales Force Automation, Oracle SaaS platform, NetSuite and Google Apps. Regardless of the mode of delivery, all these Cloud services share the following features: 1. All services are available on demand. 13. All Cloud services are managed away from the customer's site, at a single or multiple central locations. 14. All these services are measurable such that at any given point in time the resources by each user can be ascertained. 12 IV. All the services have multi-tenancy capabilities. Bhattacharjee (2009) defines multi-tenancy as different clients accessing the same service without the applications knowing about each other. v. Customers are provided with specified minimum level s of service enshrined in SLAs that Cloud providers agree to when clients sign-up for the service (Buyya et al., 2008). 2.1.3. Proposed definition From the description provided above we could define Cloud computing as a multilayered computing infrastructure that arises from the virtualization of physical computing resources and that is provisioned as a service using three difJerent levels of abstraction depending on what the client needs. Virtualization ensures scalability and high availability of resources, white client is guaranteed of service through agreed SLAs with the Cloud provider. 2.2. Cloud computing as a commercial reality The advent of Open Source, Web 2.0 and increased need to keep ahead of business competitors by responding in Intemet time with new capabilities and offerings continue to put pressure on organizations to seek IT platforms that will guarantee flexibility, affordability and rapid scalability (Staten et al., 2008). Web 2.0, the second generation of the Intemet, is based on the concept of rapid, highly configurable and customizable IT platforms that extend communication and collaboration among humans (Casarez, Cripe, Sini, & Wackerle, 2008). The Cloud computing model seems to offer the best proposition of infinite yet discemible context to enable configurable and customizable computing to become available (Sharif, 2010). The emergence of the Cloud as a commercial reality is viewed through the three actors in this new paradigm: SaaS Users, SaaS Providers and Cloud Providers. 2.2.1 SaaS Users 2.2.1.1 New technology trends and business models Accompanying the emergence of Web 2.0 was new technology trends and business models such as that depicted by a shift from "high-touch, high-margin, high- 13 commitment" provisioning of service to "low-touch, low-margin, low-commitrnent" self-service (Armbrust et al., 2009). This has also led to an emergence of a new category of consumers that is rapidly increasing in size and influence referred to as "Prosumers" (Gunelius, 2010). According to Gerhardt (2008) a prosumer is someone who blurs the distinction between a producer and a consumer especially through the adoption ofWeb 2.0 technologies such as social networking, video on demand, blogging, mobile communications, virtual realities and so ono The prosumer is an enthusiastic and early adopter of the connected lifestyle - a lifestyle that makes little distinction between one's home and work lives (Gerhardt, 2008). The prosumer opportunity for industries lies in creating solutions that tightly integrate work and home life to attract these individuals. Such solutions are hard to replicate, because changing providers also involves transporting and re-creating both personal and work data and services. Securing the prosumer segment allows vendors to create a full portfolio of Connected Life services that will draw more customers as this segrnent grows (Gerhardt, 2008). SaaS enables services to be accessed anywhere and at any time, easier data sharing and collaboration, and better data storage redundancy in the infrastructure that meets the demands of such new and growing markets. 2.2.1.2 New application opportunities As evident from the growth of "prosumerism" the future belongs to services that respond in real time to information provided either by their users or by nonhuman sensors. Such services will be attracted to the cloud because they must be highly available and they generally rely on large data sets that are most conveniently hosted in large datacenters (Armbrust et al., 2009). An example here would be the emergent mobile technologies. Mobile apps demand more resources than can be made available on the devices for re al time information processing and interactivity to enhance user and community experiences (Kovachev et al., 2010). Mobile Cloud computing extends the computing resources and data storage outside these devices, seamlessly integrating with other services and sensor data, thus opening new c1asses of apps. The new possibilities of Cloud computing require the development of new services and solutions for mobile community support 14 infrastructure, while relieving the cornrnunity members/organizers of the cumbersome technical groundwork. This means that users need not have knowledge of, expertise in, or control over the technology infrastructure in the cloud that supports them (Kovachev et al., 2010). 2.2.1.3 The rise of analytics The large database industry, originally dominated by transaction processing, is rapidly shifting the resource balance in database processing from transactions to business analytics. A growing share of computing resources is now spent on understanding customers, supply chains, buying habits and so on (Armbrust et al., 2009). This growth of decision support requires greater computing power than many IT departments are finding it difficult to be responsive to these new business requirements while maintaining control of their IT spend (Staten et al., 2008). 2.2.2. SaaS Providers / Cloud Users According to Armbrust et al. (2009) this category of C10ud actors has received the least attention yet the benefits that the current state of the Cloud portends would be made more available with greater participation at this level. They specifically cite three aspects that are new in Cloud Computing that makes it a present-day commercial reality. To begin with Cloud computing bears an illusion of infinite computing resources that can be availed on demand. This implies that SaaS providers are relieved of the erstwhile difficult task of capacity planning. With Cloud computing SaaS providers need not worry about long-term planning for provisioning of services, a time-consuming and resource intensive activity, because that is covered by the Cloud providers (Staten et al., 2008). In fact, Cloud computing allows deploying SaaS and scaling on demand without building or provisioning a datacentre (Armbrust et al., 2009). Secondly, with the Cloud computing model of IT infrastructure acquisition billing is done using a pay-per-use utility approach. This is beneficial to SaaS providers because it lowers the capital outlay needed to cornrnence their businesses such that SaaS provisioning companies can easily start small and increase hardware resources only when there is an increase in their needs (Armbrust et al., 2009). The elimination of an 15 up-front financial commitment by SaaS providers substantially lowers the barriers to entry to that industry. And thirdly, Arrnbrust et al. (2009) argued that the Cloud provision for paying for use of computing resources on a short-term basis as needed and releasing them as needed rewards SaaS providers with f1exibility to let machines and storage go when they are no longer useful. 2.2.3. Cloud Providers While the attraction of Cloud computing to SaaS users and SaaS providers is c1ear, that for becoming a Cloud provider is not that clear. To begin with, to be a Cloud computing provider requires the construction of extremely large datacenters to leverage on economies of scale, and similar huge investments in large-scale software infrastructure and technical manpower to run these datacenters (Armbrust et al., 2009). Considering the intensive capital outlay required it is logical to be solicitous over whether or not there will be companies willing to not only invest in these large datacenters but also be willing to provision their services at the low prices advocated for by the pay-per-use Cloud computing paradigm. However, there are some factors that should inf1uence several companies to seek to become Cloud providers and therefore provide the necessary platform required to make this paradigm a commercial reality. These factors are listed below: 1. The phenomenal growth of the World Wide Web in the 2000s made several large Intemet companies such as Amazon, Google and Microsoft to invest in the construction of super-large datacenters. And to protect these huge capital investments, these companies spent even more on developing scalable software and operational expertise necessary to manipulate these datacenters effectively and protect them from intrusions and attacks. 2. With such huge investments these firms have to seek various ways to make money out of them. According to Arrnbrust et al. (2009) the Cloud offers these firms an opportunity to amortize the large investments in data centers. At a low incremental cost, they could add an additional revenue stream from by adding Cloud computing services on top of their existing infrastructure. 16 111. The economies of scale that these large Internet companies can muster can be leveraged to further lower the cost of their datacenter offerings and as such make it more sensible for mediurn-sized company to opt to use these datacenters rather than to build their own. A good example is the fact that very large datacenters can buy hardware, network bandwidth, and power for 115 to 117 the prices offered to a medium-sized datacenters (Armbrust et al., 2009) IV. As Porter (2008) states to sustain long-term profitability companies must continuously respond strategically to competition. Therefore as conventional server and enterprise applications embrace Cloud computing the vendors of these applications such as Microsoft, Orac1e have a motivation to also seek to offer their customers with a Cloud option lest they opt for the competitor who has this alternative. Substitute offerings can lure customers away. 2.3. Barriers to the adoption of the Cloud Computing IT model According to Staten et al. (2008) for a service to be ready for enterprise to consume, it must pass from the early-adopter phase to early majority. Early majority is depicted by a sufficient volume of customers using the service for business-critical purposes. Currently, the major consumers of Cloud computing are small companies and startups that do not have a legacy of IT investments to manage, and developers in business units within IT who are experimenting on the platform (Staten et al., 2008).We will look at some of the major reasons that continue to hinder the level of adoption of this new computing infrastructure acquisition paradigm. 2.3.1. Performance bottlenecks The latency encountered when transferring data to and from the Cloud is higher than when transferring data to and from an in-house datacenter. With applications continuing to become more data intensive latency becomes a big concern. Bhattacharjee (2009) states that one of the key causes of this latency problem is that the architecture being used for data interchange in the Cloud re lies on the traditional get/post mechanism of the HTTP protocol which was not designed for the dynamic user interfaces supported by the Cloud. Nevertheless, Bhattacharjee (2009) suggests that a probable solution could be realized through use of multiple geographically- 17 dispersed datacenters. This should widen and shorten the channel between the user and the Cloud provider's servers. 2.3.2. Highly probability of single point of failure A single Cloud provider company could host a large set of cornpanies" data and this makes it a single point of failure. Even if this Cloud provider has mu1tiple data centers distributed across the world, the possibility of it going out of business makes it a single point of failure (Armbrust et al., 2009). The best way to mitigate this is for c1ients to seek provision of Cloud services from different companies. However, using different providers in today's Cloud has the challenge of data portability, considering that APIs of different providers are yet to be fully standardized. 2.3.3. Data lock-in This can be looked at in two ways. To start with APIs for Cloud computing are essentially proprietary thus c1ients cannot easily migrate their applications and data from one provider to another (Armbrust et al., 2009). Other than placing customers at the mercy of the providers for example with regards to price increases, this also raises the risk of single point of failure. Nevertheless, this challenge can be overcome through standardization of APIs. The issue of interoperability is currently been addressed by the Cloud Computing Interoperability Forum (CCIF) - an organization formed with the purpose to create a common framework I ontology that will enable two or more cloud platforms to exchange information in an unified manner (CCIF, n.d.). The second way of looking at data lock-in is the fact that there are only a handful of large Cloud providers. Large providers are being singled out because enterprises are wont to question the stability of small Cloud providers. This implies that consumers have a limited number of providers to choose from. However, from The Economist (2008) the likelihood ofthis computing platform to produce a dominant company in the form of Microsoft that will be able to extract more than their fair share of profits is shot down. The artic1e argues that even though there are important economies of scale in building a network of data centers, the computing needs of companies and consumers varies too widely for one size to fit all. 18 2.3.4. Data ConfidentiaIity, Security and Trust This is the commonly cited reason for enterprise apathy towards the Cloud. For starters, the non-uniform structure of legislations across the world characterized largely by the United States" Patriot Act makes enterprises unwilling to move their data into the Cloud. Cloud providers are trying to work around this by building data centers in more parts of the world but this only solves the aspect of legislation. The second concem of security is whether the Cloud environment can be made as secure as that for most in-house IT environments. Armbrust et al. (2009) downplays this by stating that use of well-understood technologies such as encryption, Virtual LANs and network middle boxes could easily make data in the Cloud as secure as that an a local data center. Thirdly, there is the difficulty of winning consumer trust. How can Cloud adopters trust their Cloud computing providers not to disclose their data to competitors or alter their data? The end-user perspective oftrust makes this a highly sUbjective property. According to (Savola, Juhola, & Uusitalo, 2010) the most important aspects that enforce trust in the cloud are good levels of security and privacy. One of the best ways of achieving this is through cutting off the semantic link of the data to the owner while preserving the cloud provider with the capability to proper1y and reliably charge for the usage of its cloud resources (Jensen, Schage, & Schwenk, 2010). The provider can solve this through use of cryptographic solutions based on ring and group signatures to create an accounting scheme that ensures a user's anonymity and guarantees authenticity of service requests (Jensen et al., 2010). 2.3.5. Challenge from incumbent software market leaders The Cloud poses a big threat to incumbent software giants. These incumbents will neither be willing to cede their market to the Cloud nor quickly move away from their lucrative software licensing model, Therefore it is expected that they would use their expertise, power and money to delay adoption of Cloud computing model until they are able to offer their own offerings on this new platform. And even if these software giants come up with their cloud solutions, it is important to note that the licensing model they use for commercial software is not suitable for Cloud computing 19 (Armbrust et al., 2009). To mitigate this challenge these companies would have to come up with a licensing structure that fits this new IT provisioning paradigm. 2.3.6. Switching costs Enterprises that are contemplating moving to the Cloud face a dilemma on whether to discard their current IT investments - such as that used on setting up their local data center - at a discount and opt for the Cloud. To migrate to the Cloud enterprises have to be prepared to incur not only the cost of migrating data and application but also the cost of restructuring their organizations to fit this new computing paradigm (Bhattacharjee, 2009). To mitigate against this the large Cloud providers could leverage their economies of scale to offer competitive prices that will entice enterprises to counter these switching costs. 2.3.7. Lack of variety of services With the technology uptake stilI low many application developers have shied away from the Cloud thereby reducing the variety of "everyday" enterprise applications available (Bhattacharjee, 2009). This lack of all critical applicatiops on the Cloud may make companies hesitate to move their operations to the Cloud. An aggressive campaign by the large Intemet companies that have invested as Cloud providers to promote Cloud computing and standardization of APIs could attract more appIication developers into the Cloud. 2.4. Summary and Emerging Issues There has been lots of successful work done with regards to the progress of Cloud computing over the last few years and the future appears brighter. Barriers to the adoption of CIoud computing have been looked at and possible ways to tackle them have also been proposed. The major barriers identified are: performance bottlenecks due to use of HTTP protocol and bandwidth issues; increased threat of single point of failure; customer Iock-in; concems over data privacy and security; threat posed by the incumbent software giants; lack of frequently used tools; and the switching costs of migrating from in-house software and hardware infrastructure. Nevertheless, for each challenge plausible mitigating strategies have been identified. 20 Also, it has been established that this new IT paradigm, does indeed bear the ability to make commercial sense to Cloud providers irrespective of the very huge capital required to build and run them. Cloud providers can make a profit by statistically multiplexing among a large group of customers (Armbrust et al., 2009). New software start-ups are especially advantaged by the Cloud computing model because it removes the need to heavily invest in acquiring software and hardware. Furthermore, Leavitt (2009) predicted that the current difficult economic c1imate would boost the appeal of Cloud computing to companies running on tight budgets. He add s on that companies want to spend less of their resources on the traditional IT vendor management, procurement, estimating future needs and managing large inhouse IT staffs. Armbrust et al. (2009) gave the following three predictions that should assure c1ients of the brighter future of the Cloud: 1. Applications Software of the future willlikely have a piece that runs on c1ients and a piece that runs in the Cloud. The cloud piece will provide the scalability needed by newer software systems. 2. Infrastructure Software of the future will be cognizant that they are no longer running on bare metal but on virtual machines. They will also have in-built capacity for accurate billing. 3. Hardware Systems of the future will need to be designed at the scale of a container (at least a dozen racks) rather than at the scale of a single rack. Cost of operation will match performance and cost of purchase in importance in the acquisition decision. 21 CHAPTER THREE: RESEARCH METHODOLOGY 3.1. Introduction Research differs in a number of aspects but they do have some commonalities. One of the common aspects is the need to collect data. Data collection can be derived from a number of methods, which inc1ude interviews, focus groups, surveys, telephone interviews, field notes, taped social interaction or questionnaires. This section aims to provide a solution to how businesses can go about adopting cloud computing. It begins with a description of the research design. It explains why an exploratory research design was seen to be most appropriate and with that regards, the use of the case study methodology. The chapter explains why the case study methodology has been adopted for the research and the reason behind the selection of the three cases from small businesses. An in-depth look at the technique employed to collect data, and the framework that shall be used for analysis are also brought forth in this chapter as well as operationalization, validity and reliability in that order. Finally, the dissertation highlights the major problems and limitations that were faced by opting to use the case study research methodology and the data collection technique. 3.2. Research design The research design can be classified into three main categories: exploratory, descriptive, and explanatory. Exploratory studies are suitable for research where little is known about a situation (Saunders, Lewis, & Thornhill, 2009) as well as how past researches have dealt with similar studies (Sekaran & Bougie, 2010). The flexibility and adaptability to change, are therefore of vital importance when using an exploratory research design (Saunders et al., 2009). Descriptive studies are suitable where there is a good understanding and structure of the problem before the data collection phase (Saunders et al., 2009) because of the need to bring out an accurate profile of events or situations. Also, the purpose of descriptive research is to provide more vital information to the given study. Finally, explanatory studies are targeted towards 22 endeavoring to explain cause-effect issues or to discover any causal relationships between variables (Saunders et al., 2009). After critical analysis of the literature and careful evaluation of the three categories of research design, the exploratory design is found to be the most appropriate for this dissertation. For starters, investigations on the model that an organization can use when it wants to adopt the Cloud computing paradigm are sparse. Secondly, the limited number of investigations on models for adopting cloud computing means that the research in this field is still young and therefore there is the need to be flexible and adaptable in this dissertation in order to develop a better understanding of this subject as the research progresses. 3.3. Case study methodology This dissertation's fourth objective is to develop a model that businesses can use to assist them in the adoption of Cloud computing technologies. From literature it is evident that information technology adoption (Cloud computing is a form of IT) depends on a range of factors brought about by particular characteristics of a business (Fink, 1998). This implies that to be able to find out how businesses need to go about adopting Cloud computing technologies effectively this research had to adopt a research methodology that would enable an in-depth querying of these range of factors within a real-life business context. These research elements suit the case study methodology. A case study is an "empirical inquiry that (a) investigates a contemporary phenomenon within a real-life context, especially when (b) the boundaries between phenomenon and context are not clearly evident (Yin, 2003, p. 13)." Yin distinguishes the case study from other research strategies and emphasizes investigations being carried out in a real-life context, which bears the spirit of this research; which in this instance is to discover how best to adopt Cloud computing technologies at an existing business. 23 This research strategy, case study methodology, presumes that the casuallinks in reallife interventions experienced by our case companies to be too complex for the survey or experimental strategies (Yin, 2003) especially considering that we are referring to a relatively new computing paradigm being adopted by enterprises. To further justify this choice of research strategy Thies & Vol1and (2010) proposed that the exploratory nature of case studies make them to be most appropriate with unique and first-time cases. In this study we discover three distinct factors that support the use of the case study strategy based on Thies & Volland (2010) argument: (1) Cloud computing is still a new phenomenon in the IT infrastructure provisioning landscape and (2) to the best of our knowledge a study seeking to develop a framework for adopting Cloud computing has not been conducted in Kenya; (3) this study shall focus on small businesses which adds more to the singularity of the research. Most of the focus on adoption of Cloud computing has been geared towards large enterprises (Staten et al., 2008). The first two attributes affirm Thies & Volland (2010) first-time case defense, whereas the last attribute bears the uniqueness that validates the choice of the case study methodology according to the same authors. The uniqueness of this study could also be derived from the knowledge that the sample case studies are from a less developed country. Furthermore, the case study research strategy offers a choice of three approaches for the researcher; exploratory, explanatory and descriptive case studies. Each of these three approaches can be either single or multiple-case studies. Almost similar to the exploratory research design, the exploratory case study allows for data col1ection to be performed prior to definition of the research questions and hypotheses (Tellis, 1997). Explanatory case studies are appropriate for undertaking cause and effect studies and descriptive case studies require that the investigator begin with a descriptive theory concerned with the formation of hypotheses of causal relationships (Tellis, 1997). Another important issue of note that supports the choice of the case study methodology in this dissertation is that the object of our discipline is the study of information 24 systems in organizations and according to Myers (1997) interest in this field has shifted to organizational rather than technical issues which are well-handled by the case study method. Finally, the case study derives a lot of strength from its triangulated research strategy. This ability to cover a wide range of data from multiples sources, of qualitative or quantitative nature (Stake, 1995) endears this strategy to answer this dissertation's "how" research questions adequately. 3.4. Data collection Data collection is not only a complicated and hard task but it is also very difficult to specify the best method of data collection. According to O'Leary (2004) "Collecting credible data is a tough task and it is worth remembering that one method of data collection is not inherently better than another (p. 150)." This implies that the decision of which data collection method to use depends on the research goals and the advantages and disadvantages of each method relative to those goals. Data collection consists of either primary or secondary data. Primary data is information that is collected afresh by the researcher to answer his current research questions. Primary data collection can be divided into four main methods: census, sample survey, experiment and observational study (David & Sutton, 2004; Saunders et al., 2009; Sekaran & Bougie, 2010). A census is a study where data is collected from all the members of the population. A survey is a structured data collection method, suitable when collecting quantifiable data from a randomly selected subset of a population. An experimental research involves a test where an investigator measures causal relationship between an independent variable and a dependent variable. An observational study is where the investigator, like in experiments, seeks to understand causal relationships but without the control that experiments provide over their variables (David & Sutton, 2004; Saunders et al., 2009; Sekaran & Bougie, 2010). Secondary data is use of information already collected by someone else. 25 This research has preferred to use primary data for two main reasons. Firstly, Cloud computing has yet to mature as an IT paradigm and therefore there is stilllimited availability of secondary data, plus the specificity of the scarce secondary data to businesses in the developed world may make the use of such data to this context misleading. Secondly, primary data is up to date, and this is vital where the research is looking at issues in an environment with a rapidly changing landscape such as the Cloud computing environment. To collect primary data we have selected the survey method of data collection. Surveys can be conducted via interviews or questionnaires. Since this dissertation's selected research strategy is the case study methodology, it employs the use of interviews for its survey. According to Myers (1997) the qualitative interview is one of the most important data gathering tools in qualitative research. 3.4.1. Data collection technique Interviews are a systematic way of talking and listening to people. The researcher often uses open questions to obtain responses from the interviewee, who is the primary data for the study. The interview is particularly suitable for this study for the following reasons: (1) this being a case study, there is need to attain highly personalized data; (2) there is need for probing; (3) a good response rate is important (Gray, 2004). There are many types of interviews, which include: structured interviews, semi-structured interviews and unstructured interviews (Saunders et al., 2009). In a structured interview the aim is for all interviewees to be given exactly the same context of questioning so that their replies can be aggregated. Questions tend to be closed ended, pre-coded, or of fixed choice. Structured interviews make probing a problem area difficult because they introduce some rigidity to the interview (Corbetta, 2003). Nevertheless, the common format utilized within this type of interview makes it easier to code, analyse and compare data (David & Sutton, 2004). Semi-structured interviews, on the other hand, are non-standardized and are frequently used in qualitative analysis. The interviewer does not do the research to test a specific hypothesis. Instead he has a list of key themes, issues, and questions to be covered 26 (David & Sutton, 2004). Semi-structured interviews give the researcher f1exibility to establish own style of conversation depending on the direction of the interview (Corbetta, 2003). This f1exibility enables probing, which is a way for the interview to explore new paths which were not initially considered (Gray, 2004). To enable the development of a model from this dissertation's selected research strategy we find the semi-structured interview most suited because of the control and direction provided by the underlying themes and the f1exibility accorded by the reduced rigidity to structure. According to David and Sutton (2004), " [Having] key themes and sub-questions in advance aides in giving the researcher a sense of order from which to draw questions from unplanned encounters (p. 87)." These attributes endear semi-structured interviewing for this dissertation. The unstructured interview or in-depth interview takes a further step towards a more open discussion where no predetermined questions are needed. The interviewee is encouraged to speak freely about events, behavior, and beliefs, with reference to the subject. The problem with this is that the researcher may not know what to look for or what direction to take the interview especially if his interviewers are inexperienced. Respondents may talk about irrelevant and inconsequential issues and also it may be difficult to code and analyze the data. The unstructured interview would be highly disadvantageous for this research especially when one considers the limited research time and resources that dissertations offer. 3.4.2. Site and sample selection Three companies from different industries were surveyed. To maintain the confidentiality that was promised to each company prior to conducting the interviews, the companies are referred to in this research using letters X, y and Z. Company X was a non-profit, Company Y was in manufacturing and Company Z was from the sales & service industry. The profiles for each company are given below. These three organizations were selected for this study for two main reasons: (1) According to Staten et al. (2008) small businesses are the ideal businesses for the early adopter phase of Cloud computing; and (2) the researcher happens to have greater 27 access to data from the selected organizations, a characteristic that Yin (2003) identifies as being ideal for conducting the in-depth research required of case studies. Case 1: Company X is a small nonprofit organization located in Nairobi, Kenya. It is an offshoot to an international nonprofit with a presence in three continents: North America, Asia and Africa. Company X has been operating in Kenya for the past six years. The founding organization in North America was established 25 years ago. Company X"s operates with a fairly high degree of autonomy in the sense that it has the mandate to enter into local partnerships without seeking approval from its founding organization as long as the latter's founding principles are upheld. However, there is extensive communication between Company X and its North American "Counterpart" mostly through use of Internet tools and technologies. Company X currently has two major departments and ten fulltime employees. One department deals with early childhood education while the other deals with social loans. There are two social loans programs supported by two different nonprofits in North America, while the education department is its founding activity. Occasionally, the company hires extra hands to enable it complete big projects in time. With such a small number of employees, the organization equips its staff with the expertise to be flexible to perform several roles as and when they arise. This means that jobknowledge is high among all the employees as they may be requested to take up an extra-role, which is often. Case 2: Company Y is a for-profit organization that manufactures and sells industrial dyes and chemicals across the region. Its major clients are located in Ethiopia, Rwanda, Uganda and Kenya. The firm was established 21 years ago when the current owner cum CEO acquired part of the assets of a Multinational corporation that was ceasing its operations in East Africa. Company Y has approximately 25 employees. The term 28 approximately has been used because the firm regularly hires casuallaborers with the see-saw of demand and supply. The owner cum CEO of Company Y has employed his sons as heads of the key departments, namely: production, and finance and IT. This implies that the business could accurately be referred to as a family business. Also, with over two decades in operation, the owner cum CEO has opted for the strategy to remain a small but great company rather than seek to grow big. The processes and machinery in the factory have been retained to be as simple as they were decades ago. Case 3: Company Z deals in sales and installation of security and surveillance equipment and systems and related services such as developing access cards (biometric, chip-based, smartcards) and so ono The company has been operating for eight years. One year ago it opened a new branch in Uganda to serve its expanded market there. The team at Company Z is highly technical due to the nature of their core business including the entrepreneur cum CEO who has a graduate degree in Information Systems. The company has employed twenty members of staff, most ofwho are field and service technicians. The company has outsourced its human resource and accounting functions. The organization is still entrepreneurial with the CEO cum owner being central to all activities from procurement to installation to marketing. From each of the cases subjects were selected for the interview using a combination of convenience sampling and stratified sampling technique. Stratification occurred where the researcher divided the members ofstaffbased on the company's organizational structure and the staff core functions. The researcher then proceeded to select a member of staff who was within the office on the particular day of research as the subject. This second part represents the convenience sampling. Interviews were conducted in March 2011 and responses were obtained from all selected subjects bar one. 29 Even though interviews were scheduled two weeks in advance, the CEO of Company y was not available on the material day of the interview due to an urgent meeting with one of the organization's major customers. However, given the fact that Company Y operates as a family business, this research assumes that interviews with the Finance and IT manager and Production manager - two sons to the CEO - would give a fairly accurate picture of the business and its approach towards adoption of Cloud computing. The assumption taken by this research derives its backing from the fact that other than being the owner cum CEO's sons the two have worked in Company Y for a cumulative experience of 15 years. F or the other cases, three members of staff were interviewed. In Company X the interviewees were the founder cum director, the operations manager and a program officer. In Company Z, those interviewed included the founder cum CEO, the office administrator and a field technician's team leader. This representation of various voices is referred to as triangulation of subjects which is important in qualitative research so as to avoid elite bias (Myers & Newman, 2007), The opportunity to implement case studies within these three small businesses to explore staff views and practices related to adoption to Cloud computing is exciting. This research will delve deeply into how small organizations approach Cloud computing by implementing three case studies and by concentrating on collecting qualitative data from various levels of staff. It is hoped that the results of this study will provide the reader with a three-dimensional picture of organization perceptions, attitudes and behavior towards migration to Cloud computing and, through its "relatability", add to the tapestry ofknowledge that is forming around formulating models for the adoption of Cloud computing by small organizations. 3.5. Framework for analysis 3.5.1. Interview Model This dissertation employs the dramaturgical model of the qualitative interview following the guidelines provided by Myers and Newman (2007) as outlined below: 30 1. Situating the researcher as actor. Myers and Newman (2007) argued that since interviews are social encounters, the interviewers should situate themselves as well as the interviewees. The interviewer in this study is also the researcher. He is a 29 year old male, Kenyan and in mid-level management for a nonprofit organization. His academic background includes a completed coursework for the Master of Science in Information Systems and an engineering undergraduate degree. 2. Minimizing social dissonance. According to Myers and Newman (2007) it is vital to minimize anything that may cause the interviewee to fee 1 uncomfortable. This they state would improve the quality of disclosure. In this research, several initiatives to minimize social dissonance were undertaken such as using the appropriate jargon (the interviewer has intimate knowledge of the three organizations) and playing different parts for different subjects (for example the founder cum CEO for Company Z was interviewed differently in terms of language, style, probing in comparison to the office administrator). 3. Representing various voices. Triangulation of subjects is important in qualitative research so as to avoid elite bias (Myers & Newman, 2007). In this study, different individuals holding different portfolios were interviewed in each of the cases so as to represent the different voices in the three organizations. IV. Everyone is an interpreter. The rarity of interviews to most interviewees coupled with the assumption that subjects are creative interpreters of their worlds, Myers and Newman (2007) were of the opinion that the interview should lead to creating and reading of one or more texts. This is also among the reasons why the semi-structured interview was selected as the data collection technique, so that it could provide room for the different interpretations of each interviewee. v. Using mirroring in questions and answers. Myers and Newman (2007) encourage the interviewer to take the words and phrases the interviewees are using to construct the subsequent question. This allows the researcher to focus on the subjects" world and uses their language rather than imposing his. 31 Though structured questions had been prepared, the interviewer used a semi- structured interviewing approach and as such was able to build on to the subsequent question using the comments that his subjects had made. VI. Flexibility. As already stated, the technique employed in this research was the semi-structured interview. This implies that the interviewer had to take into account the attitudes of his subjects, and their response with continued improvisation and mirroring to keep the conversation engaging and information-rich. vu. Confidentiality of disclosures. Interviewees were reassured that neither their identity nor attribution would be given to their views in any subsequent discussion or reports. 3.5.2. Operationalization The interviews were structured in the me s to enable a focus on the core objectives of this study and to ease the analysis of the qualitative data. These themes reflect the major areas arising from the review of literature and echo the goals and aims for this research. Themes covered in the interview process are three: comprehension of Cloud computing, barriers to Cloud computing and factors affecting adoption of Cloud computing. All three themes are inter-related. To increase depth and focus in the research, the subjects were categorized into two: management or decision makers and users of lower level staff. These two categories of interviewees were not asked an equal set of questions given that they have different roles and different influence towards the decision to or not to adopt Cloud computing. The dichotomy of subjects and the breakdown ofthemes and questions are graphically represented below. 32 Table 3-1: Breakdown of themes and questions Theme Number of Questions Management Others Comprehension of cloud computing 3 2 Barriers to cloud computing 7 4 Factors affecting adoption 7 4 According to Miles and Huberman (1984) analysis of qualitative data is not a linear activity and requires an iterative approach to capture and understand themes and pattems. This implies that an iterative process of description, analysis and interpretation is utilized to extract and understand emerging themes. The procedure followed in this study was: using the interview to eollect data under themes, describing the data, grouping the issues, and interpreting what is happening. The recording technique for the interview was note taking by hand, followed by typing. There are some disadvantages to this technique such as omission of erucial eomments and nuances. However, note taking takes less time and eosts less than recording and transeribing. Also, the fact that the interviewer is familiar to the interviewees meant that further prodding and repetition of questioning could easily be done to clarify on issues raised in the notes taken. In terms of analysis the researeh deploys a three-pronged approach: first, the users" ease study findings will be described and analyzed; second, the management case study findings will be deseribed and analyzed; and then, the users and management case study findings will be compared and contrasted to relevant literature review findings. 33 3.6. Validity Valid research is about the appropriateness of the choices you make in terms of your research strategy and data collectionl analysis techniques. According to Yin (2003) the primary objective of reliability is to reduce errors and biases in a study. Saunders et al. (2009) proposed the use of the following three questions to test reliability. First, will measures yield the same outcome in other occasions? Second, will comparable observations be achieved by future observers? Third, is it clear in how sense was made from the raw data? In this study, Appendix A shows the question template used to conduct the semistructured interview and Appendices B, C, D, E, F and G show the written responses to the interview sessions for each of the three cases under study. These coupled with the discussion in chapter four could be used by other researchers to validate the findings. 3.7. Reliability Central to reliable research is the concept of trust: can your results be trusted? This research is reliable because it used valid strategies and techniques appropriate to the research objectives. Also, it has a detailed record of the research plan and its implementation. Question could be raised about the ability of the researcher to collect unbiased response from researching among people who are familiar to him in the three selected cases; however this study mitigated the effects of this through implementing the following strategies: 1. The researcher informed participants of the purpose of the research, the uses of the collected data and the manner in which participants could assist in the research. This was to sensitize to the interviewees on the importance of providing the researcher with responses that were as objective as possible. 2. Within the period of conducting the research and analyzing the findings, the researcher avoided formal and informal meetings with the interviewees so as to avoid influencing them with his thoughts on Cloud computing However, it is important to note that adoption of IT infrastructure such as Cloud computing is a complex issue that dependent on the observer may be interpreted in 34 different ways, thus the possibility of this research to achieve total reliability is difficult. 3.8. Limitations and potential problems According to Myers and Newman (2007) the use of the semi-structured interview as a data collection instrument exposes the research to the potential problems listed below. However, it has to be noted that not all the pitfalls caused by using the semi-structured interview that were identified by Myers and Newman (2007) are relevant to this particular research. For example the interviewer's acquaintance with the management of the selected companies eliminates some problems cited by Myers and Newman (2007) such as artificial it y of the interview, interviewee not trusting the interviewer and level of entry. Below, the pitfalls relevant to this case, as identified by the work of Myers and Newman (2007), as well as those encountered during the research itself are enumerated and explained. 1. Elite bias. The researcher may interview a select few people in the organization. "Elite bias concems overweighting data from articulate, wellinformed, usually high-status informants and, conversely, under-representing data from intractable, less articulate, lower-status ones (Myers & Newman, 2007, p. 5)". This would be a greater problem for case 2/ Company Y where the only persons who could be interviewed were management who also happen to be members of the same family. 2. Hawthorne effects. This limitation is based on the assumption that interviews are intrusive and therefore the interviewer may intrude upon the social setting and potentially interfere with peoples' behavior. Myers and Newman (2007) stated that by intruding on the social setting the researcher inf1uences the interactions that they seek to study. ni. Constructing knowledge. Interviewees may want to appear knowledgeable and rational, hence the need to construct a story that is logical and consistent. This is highly likely in this study because the interviewer is well acquainted with 35 management staff of the case companies under study. This implies that the managers interviewed could be tempted to construct their stories instead of stating the facts so as to paint them and their organizations in a good light. IV. Ambiguity of language. According to Fontana and Frey (2000) "The spoken or written word has always a residue of ambiguity, no matter how carefully we word the questions or how carefully we report or code the answers (p. 645)." This implies that no rnatter how much effort is made to make the interview questions as clear as possible the interviewees may still not fully cornprehend the questions asked. 36 CHAPTER FOUR: CASE STUDY FINDINGS AND DISCUSSION 4.1. Introduction This chapter reveals the results of the case study described in Chapter 3: Research Methodology. The data collection instrument utilized was the semi-structured interview that provided both control and direction through a list of questions divided under key themes. Three cases of small companies were selected as study sample and within each company triangulation of subjects was done through the selection of three interviewees to avoid elite bias. The research concentrates on two groups of stakeholders: management or senior staff, those with authority to decide which direction the organization takes with regards to adopting new IT infrastructure or not, and users or junior staff, those whose opinion, skill, participation and buy-in may affect the success or not of any chosen IT infrastructure. However, following from diverse literature owners I managers have been found to have the more dominant roles with respect to the adoption of IT in SMEs (Fink, 1998) and therefore this section will also give them more weight when analyzing the results from the research methodology. The case study is approached in a structured way. First, a description is provided of both senior and junior staff results, theme by theme, for each company and then the different sets of results are triangulated and discussed. The use of a case study allows the analysis of real issues in a set context which in this case is three small businesses. Before the description and analysis of the case study results, a profile of each of the case companies is made to set the study in context. It is within this context that this research is undertaken. The profile does not attempt to explain or wholly describe the operations and culture of small businesses, but merely to guide in putting this research in context. Finally, the notes taken from the interviews are available in the Appendices. Appendix B contains interview notes from management of Company X and Appendix C contains interview notes from users I junior staff of Company X. 37 4.2. Case company profiIes Companies X, y and Z were selected on the basis that they are small businesses. Our definition of small organizations is in accordance with the European Commission's definition that defines a small enterprise as one that has 11 to 49 employees (European Commission, 2005). Case 1: Company X is a non-profit organization that was started as a branch of another nonprofit in in the North America. It was founded by one senior member who relocated from North America back to Kenya to become the director. In its initial years Company X relied heavily on the mother non-profit for fundingbut has slowly becoming self-sustaining. However, even with its self-sustenance the bond between the mother non-profit and the local chapter has remained very intimate over the years. The non-profit is currently collaborating with three different major donor organizations. Company X has ten fulltime employees but often has to employ contract staff to aid it in performing several major projects in any given year, which is why the research categorizes it as a small business. The company has al: 1 staff to computer ratio but does not have a central server. Most of its work is done in collaboration with overseas and local partners, with most communication taking place via the Intemet. Case 2: Company Y is the oldest among the selected cases for this research. It has been in operation for the past 21 years. The core activity for this firm is production and distribution of industrial dyes and chemicals, most of which is exported to Eritrea, Ethiopia, Rwanda and Uganda. The organization is being run as a family business with the owner / CEO employing his sons to key positions immediately after they complete their undergraduate education. This organization employs at least 25 employees but often surpasses this nurnbers depending on the demand and supply of their products. The organization prefers 38 employing staff on short terrn contracts and casual basis which is reflected in its investment of IT infrastructure. The company has ten computers to total staff size of 25. However, this number of computers is still high considering that more than half of its staffuses the computers for checking e-mails and general Intemet browsing. Case 3: Company Z is a rapidly growing business that deals with provision of security and surveillance equipment and installation. From its founder, we are informed that it began as an IT security company but moved on to physical security and surveillance due to a greater demand for these services. It recently opened a regionai branch in Uganda and could be venturing into Rwanda by end of2011. The organization's founder has al way s sought to keep the company focused on its core business by outsourcing support functions such as human resource and accounting from its inception to date. Currently, Company Z has 20 employees inclusive of the founder cum CEO. Ofnote, the founder cum CEO has an IT background and holds a graduate degree in information systems. 4.3. Findings 4.3.1 Theme A: Comprehension of Cloud Computing Three questions were asked to ascertain the understanding of Cloud computing by small businesses. Question Al: Are you aware ofCloud computing technology? Response: All respondents in companies X and Y confessed that they were hearing about it for the first time. In company Z two subjects knew about Cloud computing, the fa under and the field technicians' team leader. Question A2: Considering your day to day activities which Cloud technology delivery would be most suitable to you? Why? 39 Response: All respondents at company X referred to themselves as mere IT end users and therefore from their understanding software as a service (SaaS) would be the most appropriate technology for them. However, the operations manager thought that they could in some way utilize Infrastructure as a Service (IaaS) especially as the organization grew. This respondent stated that a lot of work is done in collaboration with partners in North America and that at some point it would be more efficient to secure all the shared data at a central online server where all parties could update it and access it together from their different locations. Unlike company X, companies Y and Z both had local servers. Company Y did data backups every 14 days on DVDs which were stored at a separate location though onsite. Both company y and Z management were not convinced of the security of online storage and therefore said that they would utilize only SaaS even though they had potential to use infrastructure as a service (IaaS). Question A3: Are you willing to exchange your privilege of complete software control for limited control at lower total IT cost? Response: This question was directed only to management staff. For company X, the non-profit cost control far superseded software control. One respondent said, "Donors are keen to reduce the monies that go into administrative and infrastructure issues and are increasingly demanding that a greater percentage go into actual project implementation." Nevertheless in an almost contradictory statement the same respondent confessed that, "technology to many of us is in a class of its own and we go into it with limited knowledge." At the manufacturing company y the respondent was unable to provide a clear answer. He stuck to the borderline response of"it depends on what percentage of control will be lost against the magnitude of marginal gain derived from lower total eost ofIT." 40 Company Z's respondent, on the other hand, was categorical that control superseded eost. "The nature of our work is security where control is paramount to everything else." To company Z greater control offers more competitive advantage than lower east. 4.3.2. Theme B: Barriers to Cloud Computing There were seven questions asked in this section with management being asked all questions and users asked only four out of the seven questions. Question BI: What is the bandwidthfor your internet connection? What is the ISP technology you currently use? Do you payafixed or variable internet fee? Response: All organizations have 24 hour Intemet access that is paid using a fixed fee. Company y had a dedicated 1 Mbps link, while Company X and Z used ashared 2 Mbps link. Company X's link was delivered on fibre optic while companies Y and Z used WiMAX technology. However, the management of company Y was distrustful of their intemet service provider. The respondent said, "We are paying for a dedicated link yet what we receive are speeds typical of ashared link. And this is a big ISP that we are talking about. They know that our options are limited by our business location so we cannot move." Question B2: What kind of applications do you typically use at your workstation (for junior staff) at the entire organization (for management)? List them Response: Among the three cases, company X appears to be the most active user of Internetbased applications. The applications mainly at use at company X are: Microsoft Office Suite, QuickBooks, Dropbox.com, Picassa, Acrobat.com, Wordpress and Google Reader. One senior staff said, "We utilize a lot offree online tools primarily because of our limited budget and secondly because we have to constantly share data with our US partners." 41 Respondents at Company y listed Microsoft Office Suite, QuickBooks, Microsoft SQL Server and Bit Torrent as the main applications utilized by them. This list is similar to what respondents from company Z listed bar Bit Torrent. Question B3: Suppose you decide to move to the cloud, would you be willing to subscribe to more than one provider, to say backup your data on another provider? Response: This question was asked to only the senior members of staff because they are the only ones who have the power to make this decision. Company X: One respondent stated that the organization does not backup its data, even at that time. "We use dropbox.com and e-mail a lot but we've never thought about what would happen say if dropbox.com shut down. In fact I must be grateful to you [the interviewer] for raising that issue. I have never thought about what would happen if dropbox.com did not work!" The other senior staff stated that so long as the marginaI cost of using an additional provider was reasonable the organization could consider doing so. This respondent also wondered if another provider would be necessary if the organization backed up its data physically, on their personal computer, and online on one provider's server. Company Y: One respondent was highly skeptical of storing any of the firm's data online thus the idea of subscribing to a second provider to him only aggravated his fears. The second respondent did not see the need for additional backup online. He thought that an online and an offline backup would suffice. Company Z: Only the founder-CEO was asked this question. He preferred a "hybrid" system of performing backups online and offline. He said, "Having an additional online storage, even from a different Cloud service provider would only increase our exposure to fraudsters and corporate identity hackers and the like." Question B4: What are your thoughts on data security and the Internet in general? Why do you think this way? 42 Response: Company X: The junior staff believed that so long as no personnel files or financial transactions were involved, the security already provided by most of the online applications would suffice. The staff said, "Most of what I handle could be done over the Internet without fear because it is not that sensitive." The senior staff had a slightly divergent view on this. According to her data security issues are affected primarily by one's social standing in society. "Ifyou are a VIP or your organization is a blue-chip then data security is paramount. That does not mean that we do not have intellectual property to protect, just that our risk is much lower." This respondent also argued that in their industry information sharing is critical and thus when one is considering data security it has to be weighed against the ease of information sharing. At Company Y: the two respondents held very opposing views. One respondent stated that data security is possible even on the Internet so long as one has full control over his/her IT resources. The other respondent had a fixed mind from the outset that the Internet cannot be trusted. At Company Z: the management had no qualms with using Internet technologies even at the organization depending on the sensitivity of the data being handled. To support his assertion he reminded the interviewer that their organization had outsourced functions such as human resource and accounting. "And outsourcing is just as risky as storing data online," he added. The junior staff concurred with this assessment, though not in those exact words. Question B5: How much of your organization 's data would you be willing to immediately put up in the Cloud? Response: Considering that only the senior staff have the authority to implement this, junior staff were not interrogated about this. 43 Company X: One senior staff categorically stated, "100 percent. Y ou see for us we have to work with partners abroad so we just have to." The other senior staff interviewed was slightly more conservative and put the figure at about 90 percent. The 1 O percent that they could not put online would be staff details, grant proposals under development and banking details. Company Y: Both respondents stated that they would probably put less than 10 percent of their organizations data on the Intemet. Company Z: The respondent said that most of what they outsource could be put up online. The respondent stated that if given better service at a better price by a Cloud provider as an outsourcing option he would give it a try. Question B6: How prepared are you to incur the direct and indirect costs associated with a possible move to the Cloud? Response: This question toa was addressed to senior staffers. Company X: One respondent said that "normal" Intemet applications such as Google Does require basic IT know how and a creative head, and anyone can work her way around it without need for additional training. Another respondent stated that they were doing most of their work online primarily because of the numerous options that one could find, leam by himself and utilize with in a very short time frame. However if these software were costly they would probably have not considered using them because cost was something they always aimed to reduce. Company Y: If the marginal benefit for moving an application to the Cloud surpasses its marginal cost then the organization could be prepared to incur its direct and indirect costs. Company Z: The founder-CEO insists that the major factor that will drive the firm to invest in any technology would be the derived advantages. He said, "If Cloud computing will give us a competitive edge over our competitors, the cost to adopt it would the least of our concerns." Question B7: What is the most specialized software that you use at your organization? Response: At Company X it is QuickBooks and at companies Y and Z its QuickBooks and Microsoft SQL Server. 4.3.3. Theme C: Factors Affecting Adoption Question Cl: One o/the perceived benejits of the Cloud is that it frees working capital and enhances operational savings. How does the knowledge o/these perceived benejits affect your decision on whether to adopt Cloud computing or not? Response: Company X: The senior staff displayed enthusiasm at this question because the low cost structure of the Cloud seems to match the very needs of their organization. Another respondent though enthusiastic, was more cautious in the approach. He said, "Y ou [the interviewer] have just made us aware of the possible risks of putting up our data online therefore we would approach it with caution." Company y: respondents at this organization were not wholly convinced about the benefits of Cloud computing. One respondent insisted that there had to be two or three examples of local companies that are successfully using this infrastructure before they consider it. The second respondent stated that their current IT infrastructure was offering all that was required and that it did not need to be replaced. He recited the cliche, "If it isn't broken, why fix it!" Company Z: One user respondents felt that the anywhere, everywhere access of Cloud computing would be suitable for them considering that most of their activities are carried out in the field rather than at the office. The founder also echoed similar sentiments by confirming that there are certain activities such as the company's biannual filing of tax return s that could be eased by an application provisioned in the 45 Cloud. He went ahead to provide the interviewer with intricate details of how and why this would be a viable option for many small businesses such as his. Question C2: How much of a say do your trading partners and collaborators have with regards to the IT infrastructure you use at the organization? Do they for instance insist on you acquiring certain technologies? Response: Company X: One senior staff said, "Donors often would enquire about what we are using at the moment, and sometimes they suggest one or two software tools for us to use. But it has never reached a point where they insist that we use a particular too1." Donors primarily suggest or recommend use of certain technologies or certain training to aid the non-profit better manage its funds. However, another respondent stated that by suggesting the sort of software tools that they preferred, the donor community indirectly pegged their funding on these criteria. This respondent said, "It would be unusual to find a non-profit with no requisite software tools win a grant or donor support. We almost subconsciously align our IT infrastructure to match those of our partners. " Company y: "A large percentage of our customers and suppliers are not IT savvy," stated one respondent. He argued that the cornpany 's IT infrastructure was a reflection of the industry. If the industry changed to accommodate Cloud computing, then they tao would follow suit. The other respondent also displayed similar averseness to the risk in implementing Cloud computing. However, he did agree that their trading partners do have a big influence on their operating procedures and practices. Company Z: The CEO acknowledged that trading partners to some extent have an influence on the IT infrastructure of the firm. Currently though, most of the organizations that they work with use traditional business procedures and processes with technologies such as e-procurement, reverse auctions still foreign to many locaI cornpames. 46 Question C3: How much of an influence are competitors to your organization 's IT infrastructure ? Response: All respondents from the three cases referred to the importance of having competitive edge over one's rivals. "For an organization to survive it must better its competition therefore we constantly keep an eye on what our competitors are doing" said the founder of Company Z. All respondents concurred on the influence of competitors to their organizations IT infrastructure. Question C4: How would you ra le your knowledge of IT? Response: Company X: All respondents had at least a certificate in computer studies and had worked with computer s for at least two years continuously. This makes them have average IT knowledge. Company Y: Both respondents had diplomas in information technology therefore their IT knowledge is average. Company Z: The founder had a graduate degree in Information Systems which makes his IT knowledge above average, while the other two respondents had diverse certificates in information technology which make s their IT knowledge average. Question C5: Would you consider taking up additional training in IT? Company X: The senior staff had an interest in undertaking further training on video and photo editing. The other respondents are also interested in specific IT courses such as project management and desktop publishing. Company Y: Both respondents did not seem eager to further their IT know-how. One respondent went further to state that he does not see himself going back to school, the best he could do is on-the-job training. 47 Company Z: The founder-CEO leads his staff from the front by urging them to keep abreast with technology. This is evidenced by the fact that his staffknew about Cloud computing. The organization is considering paying for specific IT course s for two of its best performing staff on each financial year Question C6: Do you have the financial capacity to go ahead with implementing Cloud computing? Response: Company X: One senior staff stated that the increasing donor requirement to reduce administrative and infrastructure costs will eventually lead the organization to implement Cloud technologies. The other respondent stated that the organizations small size favored it immensely in this regard because costs to re structure and implement Cloud technologies would be minimaI. None of the respondents directly referred to whether or not they had the funds ready to immediately implement the technology. Company Y: From both respondents it is elear that the firm opted to remain small but improve its product offering. Though, they refused to disclose their actual financial performance over the years, the respondents pointed out the increased presence of their products across the East African region. The company therefore seems to have the capacity to invest in Cloud computing. The only hindrance is that its management is yet to be convinced that their business will get greater competitive edge over its rivals. Company Z: The founder cum CEO stated that the organization has the financial capacity to invest in Cloud computing, train its staff on it and restructure the organization. The owner cites numerous requests from local venture capital firms that seek to invest in his booming business. Question C7: Do you have IT policies at your organization? Are you conversant with them? Response: 48 Company X & Y: There are no IT policies Company Z: The organization has a general IT policy that rnainly focuses on the use of IT resources and data security. The CEO and team leader are conversant with the policy but the office administrator is not. 4.4. Discussion The literature review highlighted several forces behind the push for adoption of Cloud computing technologies by businesses. The main drivers reflect a desire to lower costs associated with management ofhardware and software resources (B. Hayes, 2008), while increasing flexibility and reliability (Vaquero et al., 2009). The match between Cloud computing and small businesses is driven today by benefits such as efficiency gains, increased management effectiveness, and improved business performance (Fink, 1998). According to Kaplan (2001) even non-profits have not been spared from this push towards increased measurement and management of organizational performance. 4.4.1. Comprehension of CJoud computing The first theme - comprehension of Cloud computing - provides a basis to evaluate an organization' s comprehension of not just Cloud computing but also its own IT infrastructure. As van Akkeren and Cavaye (1999) state, it would be difficult for a small business to envisage the benefits associated with using Intemet technologies without being familiar with the Intemet. Cloud computing is provisioned via the Intemet and therefore it would be difficult for a business to adopt it without first having an appreciation of Intemet technologies. The questions asked under this theme aimed at achieving the following: (1) finding out whether businesses are aware of this new computing paradigm; (2) finding out if businesses know their core IT needs and their current IT infrastructure; (3) finding out if businesses are wil1ing to make major trade-offs which will be necessitated by the adoption of Cloud computing. From the findings, only company Z is aware of Cloud computing which can be attributed to the industry it operates in and its top management's knowledge, support and enthusiasm for technology. The CEO of company Z encourages his staff to continuously update their IT skills. However, it is also seen that having a high IT 49 knowledgeable top management could be a hindrance in itself when a trade-off has to be made. The non-profit seems to be the most ideal to be an early adopter of Cloud computing because: it would rather lower the cost of its IT infrastructure than wholly control it and its key applications are readily available on the Cloud. These major implications of the findings here are that firstly, the owner-CEO plays a pivotal role in shaping the company's culture towards keeping abreast with technology and the use of IT. This advances the notion that the psycho-sociological perspective remains a key trait of small businesses that has a bearing on their adoption of IT. Further, company Z's organizational culture that encourages staff to continuously update their IT skills could be attributed to the owner-CEO's advanced knowledge of IT (a Master of Science degree in Information Systems) and its effect on his perception of the benefits that will be realized thereof, which is consistent with the findings of Samiaji and Zowghi (2003). The second implication is that the cost versus control tradeoff is a major factor that affects companies motivation towards adopting cloud computing. This tradeoff decision is largely dependent on the industry that the company operates in and as su ch it can only be addresses from an industry scale and not individually by the small businesses. Finally, perceptions on the security of Intemet technologies continue to be achallenge towards the adoption of Internet-based technologies and its subjective nature make s it difficult to propose outright solutions. 4.4.2. The major barriers to Cloud computing The second theme re-visits the barriers to Cloud computing discussed in chapter two but this time around focusing on the basic requirements that businesses must have prior to adopting this new computing paradigm. The questions asked under this theme looked at: (1) does the business have the infrastructure without which Cloud computing cannot function? How good is this link? (2) Does the business use applications that are better deployed on-site than on-line? (3) Is the business willing to go the extra mile to protect itself, were it to adopt Cloud computing, as part of its business continuity strategy / disaster recovery plan? (4) What are the users' / management's perception with regards to services provided over the Intemet? (5) Is 50 the business an early adopter or not? (6) How ready is the business with regards to taking up new technology? In chapter two we are made to understand one of the common barriers to adopting Cloud computing arises from latency issues. Transferring data to and from the Cloud has higher latency than when transferring data to and from an in-house datacenter. The cumulative effect of this delay makes several businesses opt for an in-house data center. Considering the generally poor state of infrastructure in sub-Saharan Africa, this would be a cIear problem for an organization located within this region. However, from the findings it is apparent that businesses within the region do have access to the high bandwidth Internet required as a basis for providing Cloud computing services. The other major issue that come s from the findings is the universal concem of security as to whether the Cloud environment can be made as secure as that for most in-house IT environments. Arrnbrust et al. (2009) clearly downplayed this concern by stating that use ofwell-understood technologies such as encryption, Virtual LANs and network middle boxes could easily make data in the Cloud as secure as that on a local data center. However, the non-uniform end-user perspective oftrust makes this a highly subjective property that is difficult to wino The best strategy is for Cloud providers to somehow attract a couple of early adopters in this region that shall then be used as references of Cloud computing success. Some of the respondents in the research felt that successful referrals would assist in helping them overcome their hesitance with respect to adopting Cloud computing technologies. Lastly, the computer applications that an organization uses as well appear to play an important role. We could easily presume the importance of software currently in use, especial1y when we consider that most small companies use non-legacy, nonspecialist, off-the-shelf type of software. However, the findings show that the greater exposure to new types of software such as the practice at Company X, the more receptive the organization is towards adopting newer technologies su ch as Cloud computing. 51 4.4.3. Factors affecting Cloud computing adoption The set of questions categorized under this theme aimed to demystify the quandary as to which factors have the greatest effect on the decision of a business to or not to adopt Cloud computing. Much has been written on factors affecting IT adoption on small businesses and the knowledge derived from this literature together with findings from the case studies have been used to strengthen the discussion. According to the Technology Acceptance Model (TAM) put forward by Davis (1989) IT adoption, implementation and diffusion are affected by their perceived usefulness and perceived ease of use. In fact the number one reason given by 49% of nonadopters of Internet technologies is their lack of interest and perception of a lack of business benefit (van Akkeren & Cavaye, 1999). Responses from companies X and Z manifest high enthusiasm for "Internet-based" computing technologies from both management and lower level staff. The mention of Internet-based computing technologies is intentional given that subjects in all cases found it much easier to express their understanding of Cloud computing that way. Also, the cautious approach towards Cloud computing that characterized the responses from Company Y seem to have their origins in lack oftrust in the technology and not lack of perceived usefulness. One statement that manifests this was: "we would think of investing in it [Cloud computing] when we have references of local companies that have successful implemented it and are stil1 operating it." We find both sets offactors, perceived usefulness and perceived ease ofuse, to be relatively high in all the companies studied. The staffs positive attitude is critical for adoption because it lessens resistance to change s that shall be necessitated as a result of adopting Cloud computing. However, from the findings there is a critical factor that is necessary for the adoption of IT that small businesses tend to overlook; that is the presence and enforcement of c1ear IT policies. IT policies offer much more than IT security and disaster recovery plans. Where used effectively they could provide guidance on matters pertinent to adoption of IT such as: product selection, product acquisition criteria, justification of IT adoption and integration of new IT (Fink, 1998). The size of the business should not be a deterrent towards implementation of such 52 po1icies considering that small businesses have other policies such as human resource and accounting. A salient point that arose from all the companies studied is that the companies' IT infrastructure is a reflection of the industry. As obvious as this point is, its implications are significant on an industry or even national scale. All companies agreed that they are greatly inf1uenced by their rivals, trading partners, collaborators and other third parties. If the industry as a whole cannot see the benefits of adopting a technology that is apparently causing significant disruption across other regions of the globe, then the industry needs to be worried over remaining competitive in the future. This finding could probably signify need for government intervention so that the country's industry remains globally competitive. 53 CHAPTER FIVE: PROPOSED FRAMEWORK 5.1. Introduction Following from the case study findings and discussions in chapter four, clearly there are lots of issue!'raised from the companies studied with regards to the adoption of cloud computing. There is therefore need to de-clutter the issues raised so as to enable these small companies better evaluate their organization's approach towards adopting cloud computing. This chapter seeks to meet this identified need for a structured approach when it comes to assessing small businesses' fit with the cloud computing model of acquiring IT infrastructure. Three cases are not a basis that is large enough for any quantitative study or for arriving at a scientific conclusion. However, Walsham (1993) stated that "from an interpretative position, the validity from an extrapolation from an individual case or cases depends not on the representativeness of such cases in a statistical sense, but on the plausibility and cogency of the logical reasoning used in describing the results from the cases, and in drawing conclusions from them (p. 15)". From this research's experience with the three companies studied, the typical challenges that small companies face with regards to adoption of cloud computing has been conveyed. Therefore the proposed adoption framework may broadly be applied as a guideline to other small companies that are seeking to adopt cloud computing. Obviously, these other small organizations will have to make some modifications to accommodate for the level of idiosyncrasy of each company in question. 5.2. Background of the framework From the discussion of each theme in chapter four we can delineate the following nine factors as being major with regards to a small business' outlook on IT: (1) owner/Clit) drive and its influence on the organization's culture; (2) cost versus control tradeoff, which is largely dependent on industry; (3) user's perceptions on the security of Intemet-based technologies, though this is highly subjective; (4) availability ofbase infrastructure, in this case Intemet bandwidth, connectivity and related issues; (5) nature or type of the commonly used software at the firm; (6) perceived usefulness of the new technology especially with regards to improving the company's competitive 54 advantage; (7) perceived ease of use of the new technology in terms of implementation and training needs; (8) presence or lack of IT policies at the organization; and (9) government intervention especial1y where the entire industry's competitiveness as a whole could be affected by the adoption of particular technologies. These nine factors are almost similar to those identified by other authors who have also developed IT adoption frameworks for small businesses (Fink, 1998; Samiaji & Zowghi, 2003). Fink (1998) guideline proposed a three phased approach that ought to be conducted stepwise for the successful adoption of IT in small and medium enterprises. The three phases were: (1) determine if sufficient IT benefits exist and if the organization's culture is supportive ofadopting IT; (2) determine if there are sufficient internaI resources available and if appropriate procedures exist for the successful selection and implementation of IT; and (3) evaluate external environment, support and resources especially where internal resources are lacking. On the other hand, Samiaji and Zowghi (2003) guideline proposed a waterfall approach that had the following six key steps: (1) evaluate the need for IT; (2) evaluate the organization's readiness; (3) evaluate available options; (4) matching; (5) implementation; and (6) evaluate the IT post adoption using the existing measurement of success. From their descriptions we find that Samiaji and Zowghi (2003) process model for IT adoption can be depicted by Fink (1998) framework' s first three phases. And since both of these models contain factors similar to those that we obtained from this research' s findings we shall modify Fink (1998) guidelines in developing our cloud computing adoption framework. 5.3. Scope of the framework The framework has been built on the premise that the quality of data collected through qualitative enquiry is sufficient for it to be used for evaluative purposes. Qualitative research enables the framework to obtain a more in-depth understanding of staff' s experiences and perspectives in the context of their work circumstances or settings within the organization. According to Spencer, Ritchie, Lewis and Dillon (2003) the 55 quality of the qualitative research generating the evidence for evaluation lays at the heart of this assessment. Among the many distinctive features that make the qualitative enquiry suitable for this framework are: (1) it is characterized by use of'unstructured methods which are sensitive to the social context of the stndy; (2) its enables capture of detailed, rich and complex data; (3) it is mainly an iaductive rather than deduetive analytic process; (4) it employs a variety of methods such as observation, conversation, focus groups and interviews (Spencer et al., 2003). It is important to note that the framework has been devised to aid informed judgment and not to enforce robotic rule-following. 5.4. Centeet of the fl'amewol'k The framework, as depicted in Figure 5-1 below, closely resembles Fink (1998) guidelines, However, it comprises of four phases rather than three and unlike Fink' s guidelines it is specific through the use of the checklist provided, Also, unlike Fink (1998) guidelines this framework need not be condueted as a waterfall. Figure 5-1 below depicts it as a waterfall model but we believe that the phases could almost be condueted in parallel other than phase IV. The four phases of this framework are: (l) determine if sufficient benefits exist and if the organization' s culture is supportive of adopting cloud computing technologies; (2) determine if there are sufficient intemal resources available and appropriate procedures exist for the successful selection and implementation of cloud eompnting technologies; (3) evaluate extemal environment; and (4) evaluate the success of adopting cloud computing technologies, The checklist will be in question format with only two answers a yes or a no. Where there is doubt the reviewer of the checklist should select "no". All questions that have answers tieked "no" implies that the organization has some work to do before proceeding with adopting this new technology. Ideally, an organization should give a green light to the process when all answers in the eheeklist are "yes". There eertainly will be the temptation to go ahead with implementation where a majority of the answers are ''yes'' however we advise against this even where the "no" appears to be a non-key item. Though an item may appear not to be important key, a "no" means that 56 it may hinder the organization from fully enjoying the benefits of cloud computing at a later stage. 5.4.1. Pbase I In this phase, the organization seeking to adopt cloud computing will need to go through the following checklist to evaluate whether there are sufficient benefits to warrant it to go ahead with the process or not. Also, the organization will use the checklist to see if its culture is supportive towards the process of adopting cloud computing teehnologies or if it needs to first work on its organizational culture before proceeding with the process, The checklist largely uses the pronouns '~e" and "our" to suggest to the business the need for personalizing the proeess.Also most of the checklist questions begin with the future tense "will" because at the time of analysis the reviewer needs to project and think of the future when cloud computing wiU have been implemented, 57 5.4.1.1. Phase 1 Checklist Assessing cloud benefits A. Operational value 1. Will eloud computing technologies increase our efficiency in the production of core goods and/or services? 2. Will cloud computing teehnologies lower per unit cost of production for our core goods and/or services? m. Will eloud computing technologies increase our ability to respond to fluctuations of market supply and demand better than the curreat computing technologies that we have? B. Financial value 1. Will investing in cloud computing teehnologies give us greater total cost savings on hardware acquired and maintenance than our current computing technologies over the long run? 2. Will investing in cloud computing technologies give us greater total cost savings on software acquired and maintenance than our current computing technologies over the long run? C. Customer value 1. Will cloud computing technologies enable us to make our customer relationship management processes better than our current IT technologies? 2. Will cloud computing technologies make it easier for our customers to interact with us? D. Strategic value 1. Do cloud computing teehnologies support our current strategy better than the IT technologies we are currently using? 58 u. Do cloud computing technologies offer better game-changing attributes than the IT technologies we are currently using? m, Do cloud computing technologies increase our knowledge management efforts better than the IT technologies we are currently using? E. Supply cham value 1. Will cloud computing technologies increase the efficiency of our supply chafi process better than our current IT infrastmcture? u. Will eloud computing teehnologies make it easier for us to engage in collaborative activities within our supply cham than our curreat IT infrastructure does? It is difficult to assess an organization's culture objectively. For starters, sinee there are numerous different definitions of the word "culture" in literamre we would have to begin by defining it. However, we cannot proceed that way given that we would be going out of the scope of this research. For this reason, we shall only highlight three of the factors identified by Fyock and Branniek (2002)as defining an organization's culture. These factors are degree of'hierarchy, degree ofurgency and organizational slogan, A. Degree of hierarchy - small businesses tend to have low degree of hierarchy and loosely defined job descriptions 1. Do cloud computing technologies snpport our degree of hierarchy better than our current IT infrastructure? B. Degree of urgency - this defines how quickly an organization needs to push decision-making and innovation (Fyock&Brannick, 2002). This may be high, moderate or low depending on one's market and products, 1. Will cloud computing technologies support our degree of urgency better than our current IT teehnologies? 59 C. Organizational slogan I personality - refers to how employees and others characterize the organization (Fyock&Brannic14 2002). For example Nakumatt' s slogan is "Y ou need it, we've got it" 1. Will cloud computing technologies offer better snpport for activities and processes that make us identify more with our organizational slogan than our current IT technologies? 5.4.2. Phase n Phase II aims at determining whether the organization has within it snfficient internal resources and appropriate procedures necessary for the successful selection and implementatioa of Cloud computing. For example, Cloud computing is IT infrastrueture provisioned over the Intemet, This means that for an organization to adopt this technology it would requires good Intemet bandwidth, where "good" is determined by the organization's core activities and the serviees that it would acquire from the Cloud. Internal resources also look at: the technical capacity of the members of staff or enduser sophistieation and financial eonstraints necessary for making the switch from traditional computing 10 Cloud computing, According to Bhattacharjee (2009) to migrate 10 the Cloud enterprises have to be prepared to ineur not only the cost of migrating data and applications but also the cost of restructuring their organizations to fit the new computing paradigm. There is also need to evaluate the organization's current policies on IT, if they are present, so as to revise them 10 meet the needs of this new IT paradigm, 5.4.2.1. Phase 11 Check/ist Assessing Internal Capacity 1. Does the business owner I eEO fully book the plan to adopt cloud eomputing? u. Is the company in a position to allocate the financial resources required to implement cloud computing technologies now? v. Are the software systems we use I want to use available on the cloud computing platform? 60 IV. Is it possible to integrate our existing IT system with cloud computing system? v. Is our Intemet connection sufficient for running the cloud computing solntions that we are acquiring? VI. Does the top management have adequate knowledge on how to use cloud computing technologies? What about ether employees? 5.4.3. Phase m The third phase aims to evaluate the external environment, support and resources, partieularly if in-house resources and support are lacking (van Akkeren&Cavaye, 1999). At the end of this stage the organization typically is able to have an answer to the question of which Cloud provider it should subscribe to. Here the organization will look at: data security, number of'operating systems and applications supported, training and back-end support, provider reputation, SLAs guaranteed and so one 5.4.3.1. Phase III Checklist Assessing externalsupport and resources 1. Does this Cloud service provider that we are considering provide the abstraction that we need (IaaS, PaaS or SaaS) as its core product? Do they have a good track record? 2. Is the Cloud service provider' s pricing model favorable to meeting our needs? ur, Are the Cloud service provider's SLA commitments adequate for our needs? IV. Does this Cloudservice provider meet high security, trust andprivacy measurements standards? can they provide us with historical and/or statistical records of their performance in these three key metrics? v: Does the Cloud service provider give additional features with their offer? If yes, what are these extra features (e.g, free training, variety of user interfaces and so on)? VI. Is there a competitor or alternative Cloud service provider that we could use? vn. Can we move our data from this Cloud service provider to another? If yes, what would it cost us in terms of time and resources? 61 5.4.4. Phase IV The fourth phase is a post adoption phase that seeks to identify whether the small business has actually succeeded from implementing cloud computing technologies, Measuring long-term success may be a challenge espeeially given that it will need a longer monitoring and evaluation period in a landscape of rapidlychanging business environment and teehnologies, However, we believe that the company could still measure success over the short term to project the implications of adopting cloud computing to the firm in future. Samiaji and Zowghi (2003) proposed the use of three criteria to measure success of IT adoption: impact on the business, extent of actual use of the IT and user satisfaction, 5.4.4.1. Phase IV Checklist A. Impact on the business This is a broad category where management will have to think of all possible areas that could have benefitted from the adoption of cloud computing technologies, Possible impact areas include but are not limited to: cost reduction, reduction of transaction processing time, and inerease in transaetion volumes and so ono B. Extent of actual use especially where the company uses a hybrid of cloud computing and desktop IT infrastructure 1. What kinds of applications are being used from the cloud? u. What is the frequency of use of applications from the cloud? 111. What is the typical duration of use of applicationsfrom the cloud? IV. Has the company inereased the nnmber of applications that it uses from the cloud? C. User satisfaction 1. Is the manager satisfied with the performance and features of cloud computing technologies? u. Are employees satisfied with the performance and features of cloudcomputing technologies? 62 5.5. Justification for the research It used to take years to grow a business to serve millions of customers. Today, with the Internet this can take just a few months, In the same light, it took the Western world several years to industrialize, today through new computing paradigms such as Cloud computing less developed countries can develop much faster through knowledge and information based economies, Cloud computing enables a business in Kenya to access similar IT infrastructure to businesses in the United States, Germany, Japan and so ono This research has been guided on the faet that in as much as CIoud computing is available businesses in Kenya do not have a framework to guide them to adopt it. This framework is purposefully designed to guide small enterprises in adopting this new computing standard. 5.6. Cenclnsion This framework employs the use of checklist that managers or the assigned personnel at a small business could use to quickly gange whether it should go ahead and acquire cloud computing technologies, From the framework the business will beable to rapidly identify the weak areas that it needs to work on before adopting this new technology, Even though the framework is divided into four phases, they need not be implemented sequentially as shown in Figure 5- I Phases I, II and n could almost all be conducted in parallel. Phase IV is a post-adoption phase and as such can only be done last, However, condueting the process in a stepwise format could minimize the overall risk of technology acquisition, 63 CHAPTER SIX: CONCLUSION Awareness of cloud computing technologies by small businesses in Kenya remains low. However, from this researeh this is not the greatest challenge to the adoption of this new IT infrastructure. We found out that small organizations are still ambiguous about their IT infrastructure needs. This ambiguitycould be the key stumbling block towards the adoption of cloud computing technologies by small businesses in Kenya. One possible way of mitigating this ambiguity would be through the institution of clear IT policies that would assist small businesses internally appraise the benefits and/or demerits of acquiring or implementing any new computing paradigm for their organizations. However, as this research found out, small businesses either lacked relevant company IT policies or these that had their staff were not conversance with those policies. The framework proposed here is based on existing Iiterature and the author' s experience in studying small businesses in Kenya. It is a four-phased framework that may be implemented sequentiaily or in iteration, It deploys the use of a checklist so as to simplify the entire evaluation process given that the small businesses studied professed a desire for a simpleguideline, This research found out that the level of IT knowledge by both staff and management in small businesses is sufficient for them to use cloud computing technologies. One limitation to this research though is that it was conducted within the Kenyan context and as such the framework might not to be valid in a differentcontext, Implications of this research, other than proposing a simple and assumedly easy to implement framework, is that it identifies the need for two vital ingredients for vendors and other parties who may seek to encourage small businesses to adopt cloud computing technologies, Firstly, we recommend the need for vendors to assist small businesses in setting up IT policies to enable them disambiguate their IT needs. Secondly, vendors need to have successful local test cases of businesses that have adopted cloud eomputing if they are to overcome small business misperception of lack of security in cloud computing technologies, 64 REFERENCES AFP. (2009, June 12). Kenya gets undersea broadband fibre optic cable. Google News. Retrieved April9, 201 I, from http://www.google.com!hostednews/afj>/articleJALeqM5gLTAq.nEgDXYbpYzaGDte2 5k5AOpA Armbrust, M., Fox, A., Griffith, R., Joseph, A. D., Katz, R., Konwinski, A., Lee, G., et al. (2009)Above the Clouds: A Berkeley View of Cloud Computing (Teehnical Report No. UCBIEECS-2009-28) (pp. 1 - 23). UC Berkeley Reliable Adaptive Distributed Systems Laboratory: University of Califomia at Berkeley, Retrieved from http://www.eecs.berkeley.eduIPubsITechRptsl2009IEECS_2009_28.html Bhattacharjee, R. (2009, January), An Analysis of the Cloud Comptaing Plaiform.Massachusetts Institute of Technology, Cambridge, MA. Buyya, R., Yeo, C. S., &VenugopaJ, S. (2008). Market-oriented cloudcomputing: Vision, hype, and reality for delivering IT services as computing utilities. Proceedings of the 10th IEEE International Conierence on High Performance Computingand Communications, (HPCC '08) (pp. 5-13). Carr, N. G. (2003, May 1). IT doesn't matter, Harvard Business Review Online. Casarez, V., Cripe, B., Sini, J., &Wackede, P. (2008).Reshaping YOW' Business with Web 2.0: Using New Social Technologies to uati Business Transformation. New York: McGraw-HiU. CCIF.(n.d.). Cloud Computing Jnteroperability Forum: Home. Cloud Computing Inieroperability Forum. Retrieved March 16,2011, from http://doudforum.org! Corbetta, P. (2003). Social Research Theory, Methods and Techniques. Loodon: Sage Publications. David, M., & Sutton, C. D. (2004).Social Research the Basics. London: Sage Publications. 65 Davis, F. (1989).Perceived usefulness, perceived ease of use and user acceptance of information technology.A1lS Quarterly, 13(3), 319-340. European Commission. (2005). The new SME definition: User guide and model declaration, Enterprise and Industry Publications. Fink, D. (1998). Guidelines for the successful adoption of information technology in small and medium enterprises./nternational Journal of Information Management; 18(4), 243- 253. Fontana, A., & Frey, J. H. (2000). The interview: from structured questions to negotiated text, In N. K. Denzin& Y. S. Lincoln (Eds.), Handbook of qualitative researcb (2nd ed., pp. 645 - 672). Thousand Oaks, CA: Sage Publications. Foster, I. (2002, July). What is the Grid? - A three point checklist, GRIDtoday, (6). Fyock, C. D., &Brannick, J. P. (2002).Assessing Organizational Culture.cathJ1Vock.com. Retrieved Apri130, 2011, from http://www.cathyfyock.comfAssessing.htm Geelan, J. (2009, January 24). Twenty-One Experts Define Cloud Computing I Ulitzer. Retrieved January 14,2011, from http://www.ulitzer.coml?q=nooe/612375 Gerhardt, W. (2008, Marchj.Prosumers: A New Growth Opportunity. Ciseo Internet Business Solutions Group. Gray, D. E. (2004).Doing Research in the Real World. London: Sage Publications. Gunelius, S. (2010, July 3). The Shift from CONsumers to PROsumers. Work in Progress. Retrieved March 6,2011, from http://blogs.forbes.comfwork-in- progresS/20 1 0/07/03/the ... shift-from-consumers-to-prosumers! Hayes, B. (2008). Cloud Computing.Communications of the ACM, (7),9 - 11. Hayes, J. (2009). C10ut of the C1oud.Engineering & Technology, (11 April- 24 April), 60--61. Jensen, M., Schage, S., &Schwenk, J. (2010). Towards an Anonymous Access Control and Accountability Scheme for Cloud Computing. 2010 IEEE Srd International Conference on Cloud Computing. 66 Kaplan, R. S. (2001). Strategic perfonnance measurement and management in nonprofit organizations. Nonprojit Management & Leadership, 11(3), 353-370. Keahey, K., Foster, 1., Freeman, T., & Zhang, X. (2005). Virtual workspaces: Achieving quality of service and quality of life in the Grid. SCientijic Programming, 13(4), 265 _ 275. Kovachev, D., Renzel, D., Klamma, R., & Cao, y. (2010). Mobile community cloud computing: emerges and evolves. 2010 Eleventh International Conference on Mobile Data Management (pp. 393 - 395). Kansas City, Missouri, USA. Leavitt, N. (2009). Is cJoud computing really ready for prime time? Computer, 42(1), 15-20. March, 1. G. (1991). Exploration and Exploitation in Organizational Leaming. Organization SCience, 2(1), 71 - 87. McFarlan, F. W., & Nolan, R. L. (2003, June). Does IT Matter? An HBR Debate. Letters to the Editor - Harvard Business Review, . Miles, M., & Huberman, A. (1984). Qualitative Data Analysis: An Expanded Source Book. Thousand Oaks, CA: Sage Publications. Myers, M. D. (1997). Qualitative Research in Information Systems. MIS Quarterly, 21(2), 241 - 242. Myers, M. D., & Newman, M. (2007). The qualitative interview in IS research: Examining the craft. Information and Organization, 17, 2-26. O'Leary, A. (2004). The Essential Guide to Doing Research. London: Sage Publications. Porter, M. E. (2008). The Five competitive forces that shape strategy. Harvard Business Review Online, R0801E, 1-18. Pritzker, Y. (2008, JUly 21). Defining Cloud Computing. Ulitzer. Retrieved February 17,2011, from http://www.ulitzer.com/node/595685 67 Rima], B. P., Choi, E., & Lumb, 1. (2009). A Taxonomy and Survey of Cloud Computing Systems. Fifth International Joint Conference on INC, IMS and IDC (pp. 44 - 51). IEEE. Samiaji, S., & Zowghi, D. (2003). Strategy for adopting information technology for SMEs: experience in adopting email within an Indonesian furniture company. Electronic Journai of Information Systems Evaluation, 6(2), 165-176. Saunders, M., Lewis, P., & Thornhill, A. (2009). Research Methodsfor Business Students (5th ed.). Essex: Pearson Education. Savola, R. M., Juhola, A., & Uusitalo, 1. (2010). Towards wider cloud service applicability by security, privacy and trust measurements. Presented at the 2010 4th International Conference on Application of Information and Communication Technologies (AICT), Tashkent: IEEE. Schonfeld, E. (2008, August 18). Where Are We In The Hype Cycle? TechCrunch. Retrieved February 17,2011, from http://techcrunch.com/2008/08118/where-are-we-in-the-hypecyclel Sekaran, U., & Bougie, R. (2010). Research Methods for Business: A Skill Building Approach (5th ed.). Sussex, UK: John Wiley & Sons. Sharif, A. M. (2010). It' s written in the cloud: the hype and promise of cloud computing. Journai of Enterprise Information Management, 23(2), 131 - 134. Spencer, L., Ritchie, J., Lewis, J., & Dillon, L. (2003). Quality in qualitative evaluation: A frameworkfor assessing research evidence (pp. 1-17). London: Government Chief Social Researcher's Office. Stake, R. (1995). The Art ofCase Research. Thousand Oaks, CA: Sage Publications. Stansfield, M., & Grant, K. (2003). An investigation into issues influencing the use of the internet and electronic commerce among small-medium sized enterprises. Journai of Electronie Commerce Research, 4(1), 15-33. 68 Staten, L, Yates, S., Gillet, F., Saleh, W., & Dines, R. (2008). Is Cloud Computing Ready For The Enterprise? (pp. 1 - 13). F orrester Research. Strassman, P. A. (2003, June). Does IT Matter? An HBR Debate. Letters to the Editor- Harvard Business Review., . Tellis, W. (1997). Introduction to Case Study. The Qualitative Report, 3(2). Retrieved from http://www.nova.edu/ssss/QRJQR3-2/tellisl.html The Economist. (2008, October 23). A survey of corporate IT: Where the cloud meets the ground. The Economist. Retrieved from http://www.economist.com!research!articlesbysubjectldisplaystory.cfm?subjectid=348 981&story id=El TNQTTJND - - Thies, H., & Volland, D. (2010, October). What are the requirements case studies have to meet and how are they analyzed? University of St. Gallen. van Akkeren, L, & Cavaye, A. L. M. (1999). Factors Affecting Entry-Level Intemet Technology Adoption by Small Business in Australia: An Empirical Study. 10th Australasian Conference on Information Systems (Vol. 8, pp. 1071-1083). Victoria University of WeIlington: Emerald Group Publishing Limited. Vaquero, L. M., Rodero-Merino, L., Caceres, L, & Lindner, M. (2009). A break in the clouds: towards a cloud definition. ACM SIGCOMM Computer Communication Review, 39(1), 50-55. Varian, H. (2003, March 23). Economics of Information Technology. Retrieved from http://people.ischooI.berkeley.edu/~haIlPapers/mattioli/mattioli.htmI Vouk, M. A. (2008). Cloud computing - Issues, research and implementations. 30th International Conference on Information Technology Interfaces, 2008 (ITl2008). (pp. 31-40). Wal sham, G. (1993). Interpreting Information Systems in Organizations. Chichester, UK: Wiley. 69 y in, R. K. (2003). Case Study Research: Design and Methods. Applied Social Research Methods (3rd ed., Yol. 5). Thousand Oaks, CA: Sage PubJications. Yousif, M. (2010). Cloud Computing - An IT Paradigm Changer. Keynote l. Presented at the 2010 ACS/IEEE International Conference on Computer Systems and AppJications, Hammamet. 70 APPENDIX A: INTERVIEW THEMES & QUESTIONS A. THEME: Comprehension of Cloud Computing Question Al Cloud computing allows you to obtain IT infrastrueture and services without the need to own them. It allows you to pay for only what you use. Are you aware of Cloud Computing technology? Question A2 With Cloud computing resources are provisioned as services either as Infrastructure (IaaS), Platform (PaaS) or as Software (SaaS). Considering your day to day activities which Cloud technology delivery would be most suitable to you? Why? Question A3: For management The Cloud transfers the eost and burden of software maintenance and support to the Provider. However the consumer does lose control over major aspects of the software such as versions and changing requirements which may cause problems ofbackward compatibility on the consumer. Are you willing to exchange your privilege of complete software/infrastructure control for limited control at lower tota} IT cost? B. THEME: Barriers to Cloud Computing Question BI (Bandwidth issues) Cloud computing is provisioned over the Internet. What is the bandwidth for your internet connection? What is the ISP technology you currently use? Do you payafixed or variable internet fee? 71 Question B2 (Performance Bottlenecks) There are concerns that Cloud computing has latency issues that delay transfer of huge volumes of data to and from the cloud. This tends to be a problem for data intensive applications. What kind of applications do you typically use at your workstation (for others) at the entire organization (for manager)? List them Question B3: For management (Single point of failure) Currently there are few Cloud Providers and these could pose the risk of single point offailure. However, the proposed strategies to mitigate these risks are that you subscribe to two or more Cloud providers. This means extra hassle to move to another provider, extra cost of subscribing to another provider and complexity of managing two providers. Suppose you decide to move to the cloud, would you be willing to subscribe to more than one provider, to say backup your data on another provider? Question B4 (Security, confidentiality and trust) Many studies show that businesses are apprehensive about the cloud because they feel that their data will not be secure. What are your thoughts on data security and the Internet in general? Why do you think this way? Question B5: For management How much ofyour organization's data would you be willing to immediately put up in the Cloud? Question B6: For management 72 (Switching Costs) Moving to the Cloud may imply that you underutilize or discard your current IT infrastructure as you adopt a new one. AIso it would probably necessitate organizational restructuring. How prepared are you to incur the direct and indirect costs associated with a possible move to the Cloud? Question B7 Many application developers have shied away from the Cloud there by reducing the variety of "everyday" enterprise applications available. What is the most specialized software that you use at your organization? C. THEME: Factors affecting adoption Technology context / Characteristics ofthe Cloud Question C 1: One of the perceived benefits of the Cloud is that it frees working capital and enhances operational savings. How does the knowledge of these perceived benefits affect your decision on whether to adopt Cloud computing or not? External environment context Question C2 (For management) - Influence oftrading partners, collaborators, donors How much of a say do the company's trading partners, collaborators, donors have with regards to the IT infrastructure used at the organization? Do they for instance insist on you acquiring certain technologies? Question C3 (For management) - Influence of competition How much of an influence are your competitors to your organization's IT infrastructure ? Organizational context 73 Question C4 - User knowledge and attitude towards new technologies How would you rate your knowledge of IT? (High, above average, average, slightly below average, minimal) Question C5 - Would you consider taking up additional training in IT? InternaI resources Question C6 - Financial resources (For management) Moving to the Cloud may imply that you underutilize or discard your current IT infrastructure as you adopt a new one. Also it would probably necessitate organizational restructuring. Do you have the financial capacity to go ahead with implementing Cloud technologies? Question C7 - IT policies often are used to guide the implementation of new technologies, acquisition criteria and justification of IT adoption. Does your organization have IT policies? Do you know them? 74 APPENDIX B: INTERVIEW NOTES FROM MANAGEMENT OF COMPANY X (NON-PROFIT) A. THEME: Comprehension of Cloud Computing Question Al: Are you aware ofCloud Computing technology? Notes: No, he is not aware of it, probably because there present IT infrastructure is sufficient. Question A2: [Preceded by explanation of cloud delivery technologiesJ considering your day to day activities which Cloud technology delivery would be most suitable to you? Why? Notes: "We do not develop stuff [technical software and/or hardware tools]. We are typically application users so I think software as a service would suit us ... also, eh, eh, I think at a later stage when we have probably grown in size and operations we may need a server ... but that is long term, in the future. " Question A3: Are you willing to exchange your privilege of complete software control for limited control at lower total IT cost? Notes: They are a small organization which is not well funded therefore cost reduction is much more critical than control at the moment. Technology is still seen by many as something in a class of its own which makes come of us ignorant of some of the newer trends. She was not aware of the cost vs. control issue that one gets into when one decides to move to the Cloud. She is grateful for [the interviewer] raising the issue and promises to start keenly use the cost vs. control paradigm to evaluate whether to acquire Free and Open Source Software (FOSS) for the organization. 75 B. THEME: Barriers to Cloud Computing Question Bi: What is the bandwidth for your internet connection? What is the ISP technology you currently use? Do you payafixed or variable internet fee? Notes: The organization use s a 2 Mbps shared link. The 1ink use s fiber optic technology. The intemet fee is a f1at rate ofKES 6,000. Question B2: What kind of applications do you typically use for the entire organization? List them Notes: Proprietary, purchased:  Microsoft Office Suite QuickBooks Proprietary, free  Dropbox, Picassa, Acrobat.com, Google Does, Google Reader, Wordpress, SmugMug Question B3: Suppose you decide to move to the cloud, would you be willing to subscribe to more than one provider, to say backup your data on another provider? Notes: "Areri't having the information online and a eopy in the hard drive suffieient baekup?" She be1ieves that this is enough, but may eonsider subseribing to two providers if it does not strain their budget. She had never thought about a situation where the on1ine applications that they use would malfunction or mess their data. Now that she has been made aware she is going to think through their current business continuity strategies. 76 Question B4: What are your thoughts on data security and the lnternet in general? Why do you think this way? Notes: She believes that the Internet is secure for most data especial1y for their organization. Other than personnel data, proposals under development and financial records, she trusts the Internet with the rest of the organizational data. The organization from its inception 7 years ago has been sending data back and forth with the HQ (headquarters) in California, USA. No incident has ever occurred to diminish their trust of the Internet. Question B5: How much of your organization 's data would you be willing to immediately put up in the Cloud? Notes: She would willingly put up 100 percent of their data online. Question B6: How prepared are you to incur the direct and indirect costs associated with a possible move to the Cloud? Notes: She does not anticipate for the costs to be high because of the foI1owing reasons: small size of the organization, computer 1iterate members of staff, flexible organizational structure Question B7: What is the most specialized software that you use at your organization? Notes: QuickBooks for general accounting 77 C. THEME: Factors affecting adoption Question Cl: One of the perceived benefits of the Cloud is that it frees working capita! and enhances operational savings. How does the knowledge of these perceived benefits affect your decision on whether to adopt Cloud computing or not? Notes: She would have answered this question differently had she and the interviewer not had the earlier conversation. She says that she would have to evaluate the cost vs. control issue raised earlier. However, as mentioned severally during the interview cost is a big issue for the organization thus anything that lowers it is bound to receive much attention. "So, yes, operationaI savings would make us adopt Cloud computing." Question C2: How much of a say do your donors have with regards to the IT infrastructure you use at the organization? Do they for instance insist on you acquiring certain technologies? Notes: Donors do inquire about the technology that one has at his disposal. They do make suggestions and recommendations as to which software would be better, faster or more appropriate for a given project. However, they never insist on the organization to use certain software. The decision is always for the nonprofit to make. Question C3: How much of an influence are competitors to your organization 's IT infrastructure? Notes: Most of the organizations collaborations are for three months. In rare occasions the collaboration may go up to six months. With such short time frames it would be unwise to invest in a collaborative that may never find use again therefore they never invest in IT for that purpose only. 78 Question C4: How would you rate your knowledge of IT (High, above average, average, slightly below average, minimal) ? Notes: She has received training in computer programming, web design and how to use social media to fundraise. The interviewer also had an easy time as she could grasp most of the concepts quickly without too much explanation. She rates herself as "above average". Question C5: Would you consider taking up additional training in IT? Notes: Yes, she would like to pursue further training on video and photo editing. Question C6: Do you have the jinancial capacity to go ahead with implementing Cloud technologies? Notes: She refers to an earlier question and mentions the organization size, structure and culture which mean that implementing Cloud technologies would be within the scope of their limited budget. Question C6: Does your organization have IT policies? Do you know them? Notes: No. their organization does not have written IT policies. It is something they are currently working ono 79 APPENDIX C: INTERVIEW NOTES FROM USERS/ OTHER STAFF OF COMPANY X (NON-PROFIT) A. THEME: Comprehension of Cloud Computing Question Al: Are you aware ofCloud Computing technology? Notes: No. This is the first time she is hearing about it. Question A2: Considering your day to day activities which Cloud technology delivery would be most suitable to you? Why? Notes: From how she has understood me [interviewer] she thinks SaaS is best for the organization because most of her work involves using software and not anything technical. She has at her role for five years and there has never arisen a need for her to go technical. B. THEME: Barriers to Cloud Computing Question Bl: What is the bandwidthfor your internet connection? What is the lSP technology you currently use? Do you payafixed or variable internet fee? Notes: The organization pays KES 6,000 per month for 2 Mbps provided by KDN J fiber optic cables. Question B2: What kind of applications do you typically use at your workstation? List them Notes: Microsoft: Word, Excel, Outlook, Publisher I KDN is the country's largest backend Intemet supplier 80 Gmail, Google Does, Dropbox, Pieassa, SmugMug Question B4: What are your thoughts on data security and the Internet in general? Why do you think this way? Notes: The Internet is safe so long as one is eareful with their passwords. Most of her work involves information sharing with other nonprofits, which implies that her work is not that sensitive. She believes that the Internet is also safe for financial records or personnel data as long as one remains vigilant of suspicious e-mails, keep their PCs locked while away from the workstation and so ono Question B7: What is the most specialized software that you use at your organization? Notes: QuickBooks and Internet banking C. THEME: Factors affecting adoption Question C4: How would you rate your knowledge of IT (High, above average, average, slightly below average, minimal)? She has a certificate in Computer Applications. She rates her computer literacy as average. Question C5: Would you consider taking up additional training in IT? Notes: Yes, she would take up additional computer training if it would be relevant. Question C7: Does your organization have IT policies? Do you know them? No, she is not aware of any IT poliey. She is not sure whether the organization has IT policies or not. 81