FEATURE FEATURE

Migrating to the Cloud

How the COVID-19 Pandemic Has Affected the IT Landscape

the total cost of on-premises software ownership was

lower than using cloud-based software. This was often
www.isaca.org/currentissueforums the case for enterprises that customized their software,

T
which is not as easy to do in the cloud.3
he question of whether to move on-premises
software to the cloud has been relevant In cloud-based software, the alternative to on-
for several years. In the past, every year premises software, software is provided as a
a few more enterprises migrated to the service. According to the Institute of Electrical and
cloud, but that changed significantly in 2020 when Electronics Engineers (IEEE), cloud computing
organizations faced the effects of the COVID-19 empowers “service providers by facilitating efficient
pandemic. Many enterprises decided to transform resource management in data centers.”4 Software
their IT landscape from on-premises to cloud- as a Service (SaaS) enables the consumer to access
based software, accelerated by the pandemic. the software without having to host or support it. The
Understanding this transition through the lens of the consumer (or enterprise) connects to the software
technology acceptance model provides insights for all application via the Internet. The platform layer and
IT professionals and comes with implications for IT the infrastructure layers required to host and service
security and auditing. the software are invisible to the consumer.5

Only 20 percent of EU enterprises used cloud-based

Background services in 2014 through 2016. This increased slightly
On-premises software is software “located within to 25 percent in 2018, but it still means that only
the physical confines of an enterprise often in the one in four EU enterprises reported using the cloud
company’s data center.”1 This implies that everything (figure 1).6
related to the software, such as the data center and
server infrastructure, is housed and maintained by the One explanation for this slow movement toward
enterprise, even though software support may come cloud services is provided by the technology
from vendors outside of the enterprise. acceptance model (figure 2).7 People and enterprises
consider external variables (e.g., risk of outages,
Some enterprises purchase on-premises software, recovery costs) to determine a technology’s
often incurring high initial costs due to both the software perceived usefulness and perceived ease of use.
license and the required infrastructure.2 Software These perceptions influence their attitudes toward
providers also charge additional fees for support and the technology and their intentions to use that
services. In the past, some enterprises calculated that technology. The final outcome is that either they

LU K AS W E R N E R

Is a vocational training student at SAP SE, the market leader for enterprise resource planning (ERP) software, in Walldorf, Germany. He
has completed several internships in the consulting and development departments there, including the Customer Office for the SAP
Business Technology Platform, where he worked on enterprise transformations to the cloud.

G E R A LD F. B U RC H, PH.D.

Is a visiting professor at the University of West Florida (Pensacola, Florida, USA). His primary areas of teaching are in operations
management and information systems at both the undergraduate and graduate levels.

20 ISACA JOURNAL VOLUME 1 | 2022

use the technology or they do not. The key to the FIGURE 1
acceptance of cloud services may, therefore, lie Percentage of EU Enterprises Using Cloud-Based Services
in external variables and how people view the
30
usefulness and ease of use of those services.
25
Cloud Service Pros and Cons 20
The benefits and costs associated with moving
software services to the cloud have been discussed 15
by many.8 Figure 3 summarizes the pros and cons of
this migration.
10

5
Payment Options
Cloud service (i.e., SaaS, Desktop as a Service 0
2014 2016 2018
[DaaS], Infrastructure as a Service [IaaS], Platform
as a Service [PaaS]) offerings often take the form elasticity. Enterprises can save money by choosing
of subscription models, with regular payments. the cloud9 when using the correct techniques and
Sometimes this allows enterprises to bill these tools to provide elasticity in services. However, this
payments as operational expenditures rather than is not guaranteed, especially if the administrator
capital expenditures (as required for on-premises executing the transfer is not a cloud expert.
software purchases). This may lead to tax benefits. In
addition, enterprises can save money by not investing Deployment
in infrastructure and maintenance, which are usually
Cloud deployment can be private, community, public
included in the subscription price.
or hybrid. In a private cloud, only one enterprise has
access to a defined space of infrastructure. The
Elasticity private cloud is managed either by the enterprise
The cloud’s elasticity can also result in cost savings, or by a third party.10 A private cloud is often used by
as enterprises can turn virtual machines on and off enterprises or business units that do not fully trust
as needed. In the cloud, it is possible to pay only for the vendor’s security models.
what is used. In contrast, with on-premises software,
the enterprise must pay for the infrastructure and pay A community cloud is a deployment model in which
the rent where that infrastructure is located. It can two or more enterprises with common interests share
be extremely difficult to move on-premises software infrastructure. The infrastructure is managed either
applications to the cloud because cloud applications by a member of the community or by a third party
have different architectures that enable the software’s that every community member trusts.

FIGURE 2
Technology Acceptance Model for Cloud Use

Perceived
External Variables: Usefulness of
• COVID-19 the Cloud to
• Risk of Outages Enterprises
• Availability
• Disaster Recovery Attitude of Enterprise
Enterprises Actual
Behavioral Cloud
• Costs Toward Using Intention to Use
the Cloud Usage
• Deployment the Cloud
• Security
• Integration and Perceived Ease
Extension of Use of the
Possibilities Cloud to
Enterprises

VOLUME 1 | 2022 ISACA JOURNAL 21

 FIGURE 3
Pros and Cons of Cloud Migration

Pros Cons
An on-premises data center is not necessary. There is reliance on external data centers.
Cloud services (i.e., SaaS, DaaS, IaaS, PaaS) can be charged as Enterprises have already made capital investments.
operating expenses instead of capital expenses, providing tax
advantages for some enterprises.
Cloud elasticity allows for ability to use what is needed. Cloud elasticity requires an administrator who understands how to
take advantage of offerings.
Option exist to use different deployment models (private, Stakeholders need to determine which deployment model best
community, public, hybrid). serves the enterprise.
Integration and extension make the cloud highly scalable. Integration and extension could be managed with additional on-
premises equipment.
Vendors have more security resources and can react faster. Reliance for security is placed on others.
Migration, if done correctly, can be accomplished once and can help Migration is a complex process that relies heavily on a vendor’s or
resolve old data issues. implementer’s expertise.

In a public cloud, infrastructure is offered to the With a hybrid cloud model, an enterprise can store
general public. It is managed and maintained by the its information in an on-premises database, while
vendor and is available only on the vendor’s premises. performing data processing and calculations in the
cloud. This arrangement can offer the best of
A hybrid cloud consists of an arrangement of cloud- both worlds.
based and on-premises infrastructures that can
communicate with each other. In a hybrid cloud, any
of the other cloud models can be used. “On-premises software’s ability
The ability to select the type of cloud deployment to integrate is limited because it
can be seen as a positive variable in terms of
perceived usefulness. However, the need to choose a
is only partially possible to scale
deployment option can also be viewed as a detriment in an onsite data center.”
because it means making decisions that change what
is already in place.
Security
Integration and Extension Security has become more important due to the high
Cloud integration and extension possibilities for on- costs associated with data leaks and hacks in recent
premises software are highly dependent on the platform years. Because of these attacks, cybersecurity has
the software is running on, which determines run times become a highly visible topic, and enterprises now
and software deployments. On-premises software’s recognize the importance of protecting themselves
ability to integrate is limited because it is only partially through investments in security. On-premises software
possible to scale in an onsite data center (e.g., the and the cloud have very different architectures, and
capacity for inquiries is limited). Platforms hosted in when it comes to security, there are many different
the cloud can handle thousands of inquiries due to their opinions. According to a chief technology officer at
hyperscaling technologies, which means they are more Microsoft, huge security costs need to be calculated
communicative, even with other foreign systems.11 It is for both cloud and on-premises data centers, and
possible for both on-premises and cloud-based software “having a data center on premise has little to do with
to integrate and extend, but the cloud securing against cybersecurity threats.”12
has an advantage.

22 ISACA JOURNAL VOLUME 1 | 2022

Another aspect regarding security in the cloud is the
data’s residency, which is:

[T]he set of issues and practices related to the

location of data and metadata, the movement of
(meta)data across geographies and jurisdictions,
and the protection of that (meta)data against
unintended access and other location-related risks.13

Cloud vendors, enterprises and end users are affected

by data residency requirements. Cloud vendors and
enterprises that are buying the cloud services must
adapt to local regulations and constraints. They can
get into legal trouble by using cloud services for
processing and storing data in another geographical
region because local laws may conflict with regard
to individual and organization privacy. For many been discovered. These security threats need to
enterprises, it gets complicated to understand and be considered by any enterprise thinking about
to be compliant with other countries’ laws regarding moving its software to the cloud. Transferring
data.14 Cloud vendors such as Amazon Web Services information systems to another infrastructure is
and Microsoft Azure provide transparent information risky, and many security analyses need to be done
about how customers can handle the data residency before deciding to migrate.18 When storing data
regulations by using their offered services.15, 16 internationally, enterprises must consider data
residency requirements, both for using the cloud and
On-premises software needs to be as well protected
on-premises software.
as the cloud is, but this is difficult to achieve because
many enterprises fail to invest much money in
cybersecurity. The economies of scale play a big role
in cloud security. Enterprises providing cloud services
“The economies of scale play a
can invest more in security. Enterprises that run their big role in cloud security.” LO O K I N G F O R M O R E?
software in the cloud assign the responsibility for
security to the vendor. Innovations in cybersecurity • Read Supply Chain
can be adopted much faster in the cloud, and “with Migration Resilience and
their huge scale, the larger platforms are much better Continuity.
Migration to the cloud is a highly complex and often
able to maintain state of art capabilities and invest www.isaca.org/supply-
unique process, as organizational data are usually
in costly cybersecurity operations centers equipped chain-continuity-2020/
very specific to the enterprise. There are often
with high-end, real-time data analytics.”17 no standard cloud migration processes, and the • Learn more about,
procedure is dependent on the knowledge of the discuss and collaborate
For on-premises software, data residency regulations
expert leading the migration.19 on risk management in
are not as important because many enterprises do
ISACA’s Online Forums.
not have multiple data centers in different geographic Migration to the cloud comes with risk. For example, https://engage.isaca.org/
locations, and most of their data are not processed additional latency due to a distant data center onlineforums
in other countries with different laws. Internationally where the cloud service is hosted may lead to poor
distributed enterprises still need to care about the performance and greater costs caused by lost time.
different policies from different countries. Another factor to consider before migrating is the
possibility of data loss due to missing data backups
Security can be seen as either a pro or a con, based
or transferring data incorrectly.20 These risk factors
on the perceived usefulness of cloud security or
are some of the most common arguments against
the perception of how easy it is to move security
using the cloud.
functions to the cloud. Because cloud vendors
offer the newest technologies, they may include Using the technology acceptance model to explain
security threats that have not evolved or have not the slow migration to the cloud has revealed that

VOLUME 1 | 2022 ISACA JOURNAL 23

 although there appear to be financial and scalability argued that this increased the use of cloud services,
benefits that add to the cloud’s perceived usefulness, as more people needed to access software over
the difficulty of migration and loss of control may be the Internet. Because this happened spontaneously
seen as detriments. At least this was the case before and unexpectedly, many enterprises likely decided
2020. Recent reports show that 37 percent of EU to buy cloud services rather than invest in internal
enterprises used cloud services in 2020—an increase infrastructure that their employees could access
of 12 percentage points from 2018. Corroborating this from home,28 which may have heavily influenced the
increase in cloud service usage is the revenue growth perceived usefulness of the cloud.
of cloud vendors. Figure 4 presents the revenue
numbers from SAP,21 Amazon Web Services (AWS),22 In a survey of 750 organizations, 90 percent reported
Rackspace,23 Microsoft Intelligent Cloud,24 Google25 that their cloud usage was higher than planned during
and Salesforce,26 based on their annual reports. the pandemic, and 29 percent stated that it was
significantly higher than expected (figure 5). This
Synergy Research Group’s 2020 report supports trend was similar among all enterprises and small
these findings by showing that enterprise spending and medium-sized businesses (SMBs).29
on cloud infrastructure services jumped 35 percent in
2020 to reach US$130 billion. In contrast, enterprise Another potential factor in increased cloud usage
spending on data center hardware and software was a shortage of computer hardware, which made
dropped 6 percent, to less than US$90 billion during it difficult for enterprises dependent on those supply
the same period.27 Understanding why these changes chains to maintain their on-premises software’s
occurred may be beneficial. infrastructure.30 Migration to the cloud could solve
this problem because the provider guarantees
availability, which could also impact the cloud’s
COVID-19’s Influence on Cloud perceived usefulness.
Migration
The COVID-19 pandemic forced many enterprises to Furthermore, the use of cloud-based applications for
allow their employees to work from home. It could be virtual meetings increased significantly during the

FIGURE 4
Cloud Vendors’ Revenue, 2012–2020 (in US$ Billions)
Scatter Plot: Cloud Vendors’ Revenue (in US$ Billions)
With Trendline of all Revenues Combined
60

50

40

30

20

10

0
2012 2013 2014 2015 2016 2017 2018 2019 2020
-10

-20

 AWS Revenue  Rackspace Revenue  SAP Cloud Revenue (in $ Billions)

 Google Cloud Revenue  Salesforce Revenue  Microsoft Intelligent Cloud Revenue
.... Linear (Combined)

24 ISACA JOURNAL VOLUME 1 | 2022

pandemic. For example, Zoom had 10 million daily FIGURE 5
meeting participants in 2019. That number increased Change in Planned Cloud Use Due to COVID-19
to 200 million in March 2020 and to 300 million 100%
1% 1% 3%
in April 2020. By the end of 2020, Zoom had 350 9% 8% 11%
90%
million daily meeting participants.31 Zoom’s business
80%
customers increased from 82,000 in 2019 to 470,100
in 2020. Microsoft saw a similar increase in the use of 70%
its product Microsoft Teams, which is also available 60% 62%
52%
61%
as a SaaS.32 These numbers indicate that the cloud’s 50%
perceived ease of use was positively impacted.
40%

The COVID-19 pandemic has certainly acted as an 30%

enabler for cloud migration. Although the risk of 20%
34%
migrating to the cloud was the same in 2020 as it was 10%
29% 29%
in previous years, cloud migrations and adoptions
0%
increased. The pandemic caused individuals to Total Enterprise SMB
change their perception of the cloud’s usefulness and
 Significantly  Slightly  Slightly  Significantly
ease of use.
higher higher lower lower

Source: Flexera, 2021 State of the Cloud Report, USA, 2021, https://info.flexera.com/CM-REPORT-State-of-the-
Cloud?lead_source=Website%20Visitor&id=Blog#download. Reprinted with permission.

“Cloud service providers (CSPs)

could mitigate many concerns controls for cybersecurity also help offer a framework
to measure, address and monitor cybersecurity risk.34
about migration if they were able
It is hoped that as more enterprises migrate to the
to demonstrate to new users cloud, more stable and reliable migration processes
a process that facilitates such will be developed. Cloud service providers (CSPs)
could mitigate many concerns about migration if they
migration.” were able to demonstrate to new users a process
that facilitates such migration. The use of artificial
intelligence (AI) could be especially beneficial if
What Next? common problems and pitfalls could be identified as
It is important to determine what cloud migration means routine issues rather than unique anomalies that only
from an information security and audit standpoint, as it the brightest and cleverest programmers can solve.
appears that more enterprises will be migrating to the
cloud in the near future. Enterprises contemplating the Similarly, CSPs could strive to make security a benefit
use of cloud services and SaaS providers should follow rather than a concern. Solving security issues at the
the technology acceptance model to focus on two macro level and then sharing that information with
major areas: cloud services’ perceived ease of use and potential clients could encourage them to see the
perceived usefulness. cloud as a security provider.

In the past, cloud services’ perceived ease of use The cloud’s perceived usefulness also suffers in
has encountered two major stumbling blocks: two areas: security and auditing. Although it is true
migration issues and security concerns. Concerns that cloud security will never be able to protect all
regarding cybersecurity risk could already be on-premises devices, it can be used to protect the
mitigated by system and organization controls and most valuable parts of the system (i.e, data). CSPs
system and organization controls for cybersecurity. should continue to demonstrate the security benefits
These audits are performed by certified public of storing information and processing transactions in
accountants (CPAs).33 By providing cybersecurity the cloud.
audits, cloud vendors offer transparent overviews
about the security of their services. The system and Many of those who have delayed migrating to the
organization controls and system and organization cloud believe that it does not allow systems to be

VOLUME 1 | 2022 ISACA JOURNAL 25

 must be easy, seamless and transparent to overcome

“As the COVID-19 pandemic rapidly disrupted its past lack of acceptance.

organization and processes, flexibility and The cloud offers many deployment possibilities.
Enterprises that want to store their data on their own
scalability seemed to be the key arguments for infrastructure can do so, while processing those
migrating to the cloud.” data in the cloud. As the COVID-19 pandemic rapidly
disrupted organization and processes, flexibility
and scalability seemed to be the key arguments for
migrating to the cloud.
easily audited. This may be a fallacy that cloud CSPs
can readily address. CSPs should either develop The COVID-19 pandemic has accelerated the move
or strengthen their processes to facilitate audits, toward the cloud. It is now up to implementers
and they should be very transparent about these and CSPs to establish processes that allow easier
processes to ensure that customers do not see the implementation, supported by stronger security,
service as a magic black box. Just as security can and audit portals to increase the cloud’s perceived
often be managed more efficiently due to the scale usefulness and ease of use.
of operations in the cloud, audit procedures and
interfaces can be developed and marketed as benefits Endnotes
to potential users, especially if they understand the
1 Stroud, F.; “On-Premises,” Webopedia,
service’s internal processes and procedures.
22 September 2021, https://www.webopedia.com/
definitions/on-premises/
One final factor in the acceptance of the cloud is that
it is an individual and organizational decision. Just 2 Harvey, C.; “Cloud vs. On-Premise Software:
because the organization decides to implement a The Cloud Debate,” Datamation, 8 March 2018,
cloud-based solution does not guarantee that every https://www.datamation.com/cloud/cloud-vs-on-
individual in the organization is going to accept the premise-software-the-cloud-debate/
change and fully use the new technology. There may 3 Ibid.
be reluctant users who drag their feet and others who 4 Ray, P. P.; “An Introduction to Dew Computing:
refuse, to the greatest extent that they are allowed, Definition, Concept and Implications,” IEEE
to accept the new technology. This can make the Access, vol. 6, 2018, https://ieeexplore.ieee.org/
implementation of cloud-based services problematic. document/8114187
Developing a culture that encourages the acceptance 5 Mell, P.; T. Grance; The NIST Definition of Cloud
of technology is difficult. Creating open procedures for Computing, National Institute of Standards and
implementation, listening to concerns about perceived Technology (NIST), USA, 2011
usefulness and ease of use, supporting the movement
6 Eurostat, “Cloud Computing Services,”
to use new systems, and providing training will provide
23 September 2021, https://ec.europa.eu/
support to members of the enterprise and boost their
eurostat/databrowser/view/isoc_cicce_use/
proficiency in using the service.
default/table?lang=en
7 Davis, F. D.; “Perceived Usefulness, Perceived
Conclusion Ease of Use, and User Acceptance of Information
Migrating to the cloud seems to be the future for Technology,” MIS Quarterly, vol. 13, iss. 3, 1989
most software services, and the COVID-19 pandemic 8 Op cit Harvey
may have been the impetus needed to push these
9 Wray, J.; “Where’s the Rub: Cloud Computing’s
services into a self-sustaining orbit. The coming
Hidden Costs,” Forbes, 27 February 2014,
months and years will certainly bring many more
https://www.forbes.com/sites/centurylink/2014/
problems and roadblocks; therefore, it is more
02/27/wheres-the-rub-cloud-computings-hidden-
important than ever to stop treating each migration
costs/?sh=1192ba915f00
as a unique event that can be accomplished only by
10 Op cit Mell and Grance
the cleverest programmers. Migration to the cloud

26 ISACA JOURNAL VOLUME 1 | 2022

11 T
 roup, E. G.; “Growing Role of Platforms in 25 Alphabet, Alphabet Investor Relations, 2021,
Cybersecurity,” Cyber Defense Review, vol. 2, https://abc.xyz/investor/
iss. 1, 2017, https://www.jstor.org/stable/ 26 Salesforce, Financial Reports, 2021,
26267401?seq=1#metadata_info_tab_contents https://investor.salesforce.com/financials/
12 Ibid. default.aspx
13 B
 audoin, C. R.; "The Impact of Data Residency on 27 Synergy Research Group, “2020—The Year
Cloud Computing," 32nd International Conference That Cloud Service Revenues Finally Dwarfed
on Advanced Information Networking and Enterprise Spending on Data Centers,” 18 March
Applications Workshops (WAINA), 2018 2021, https://www.srgresearch.com/articles/
14 Ibid. 2020-the-year-that-cloud-service-revenues-finally-
dwarfed-enterprise-spending-on-data-centers
15 A zure, “Enabling Data Residency and Data
Protection in Microsoft Azure Regions”, 28 Alashhab, Z. R.; M. Anbar; M. M. Singh; Y.
28 October 2021, https://azure.microsoft.com/ Leau; Z. A. Al-Sai; S. A. Alhayja’a; “Impact of
en-us/resources/achieving-compliant-data- Coronavirus Pandemic Crisis on Technologies
residency-and-security-with-azure/ and Cloudcomputing Applications,” Journal of
Electronic Science and Technology, vol. 19,
16 Amazon Web Services, “Data Residency AWS
iss. 1, 2021, https://www.sciencedirect.com/
Policy Perspectives”, 28 October 2021,
science/article/pii/S1674862X20300665
https://d1.awsstatic.com/whitepapers/compliance/
Data_Residency_Whitepaper.pdf 29 Flexera, 2021 State of the Cloud Report, USA,
2021, https://info.flexera.com/CM-REPORT-
17 Ibid.
State-of-the-Cloud?lead_source=Website%20
18 Douligeris, C.; N. Polemi; A. Karantjias;
Visitor&id=Blog#download
W. Lamersdorf; Collaborative, Trusted and
30 Segal, E.; “Worsening Computer Chip Crisis
Privacy-Aware e/m-Services, 12th IFIP WG 6.11
Shows Supply Chains Are Still at Risk,” Forbes,
Conference on e-Business, e-Services, e-Society
12 July 2021, https://www.forbes.com/sites/
13E 2013, Springer-Verlag, Greece, 2013
edwardsegal/2021/07/12/worsening-computer-
19 Pahl, C.; H. Xiong; R. Walshe; A Comparison of On-
chip-crisis-shows-supply-chains-are-still-at-risk/
Premise to Cloud Migration Approaches, Dublin City
31 Iqbal, M.; “Zoom Revenue and Usage Statistics
University, Ireland, 2013
(2021),” Business of Apps, 2 September 2021,
20 Malvi, K.; “Cloud Migration—Benefits, Risks and
https://www.businessofapps.com/data/
How to Avoid Them,” Mind Inventory, 2021,
zoom-statistics/
https://www.mindinventory.com/blog/cloud-
32 Curry, D.; “Microsoft Teams Revenue and Usage
migration-benefits-and-risks/
Statistics (2021),” Business of Apps, 29 July 2021,
21 SAP, SAP Financial Reports and Presentations,
https://www.businessofapps.com/data/
2021, https://www.sap.com/investors/en/
microsoft-teams-statistics/
reports.html?sort=latest_desc&tab=reports
33 Aulakh, M., “SOC1, 2, and 3 Audit Reports, and
22 Amazon, Annual Reports, Proxies and Shareholder
Why You Need One,” Infosecurity Magazine, 2019,
Letters, 2021, https://ir.aboutamazon.com/
https://www.infosecurity-magazine.com/opinions/
annual-reports-proxies-and-shareholder-letters/
soc-audit-reports/
default.aspx
34 Al-Moshaigeh, A.; D. Dickins; J. Higgs;
23 Rackspace Technology, Investor Relations,
“Cybersecurity Risks and Controls: Is the AICPA’s
https://ir.rackspace.com/
SOC for Cybersecurity a Solution?” The CPA
24 Microsoft, Annual Reports, 2021, Journal, July 2019, https://www.cpajournal.com/
https://www.microsoft.com/en-us/Investor/annual- 2019/07/08/cybersecurity-risks-and-controls/
reports.aspx

VOLUME 1 | 2022 ISACA JOURNAL 27