The benefits of cloud computing have been well-documented. By choosing to make use of computing resources delivered over the internet, organisations are able to save money, replacing hefty capital costs with predictable operational costs. They can scale their computing resources up or down as required. By paying a third party to provide public cloud services, organisations can unburden themselves of the day-to-day responsibilities in administering IT and focus on innovation.

Cloud seems to represent the ideal solution for many departments and organisations. Smaller units can’t afford to invest large sums of money in computing hardware and software, and having a fixed operational cost allows them to control spend. The ability to scale up or down with ease is clearly beneficial to an organisation whose size may fluctuate in the next five years, or who may simply have to cope with occasional peaks in demand.

But for CIOs in larger organisations who would like to develop a cloud strategy, the picture is more complicated. A 2011 Ovum survey of multinational corporations, What multinationals want: Opportunities in cloud computing, found that 45% were already using cloud for sourcing some IT services, principally for cloud’s “speed of provisioning, flexible capacity and demand management benefits.” However, many large corporations will have already invested heavily in infrastructure, and the scale benefits will not be as easy to realise as for a smaller organisation.

Perhaps we should not be surprised that, although cloud computing is widely regarded by analysts, vendors and academics as the principal model for the delivery of IT in the future, some large organisations remain cautious about adopting it. A report by analyst Quocirca this year, entitled Next Generation Datacentre Cycle II – Cloud findings, based on interviews with more than 900 business respondents, found that a substantial minority saw cloud computing either as a “passing fad” (8%) or as something that had “no place in the future of my organisation’s plans” (11%). The public sector and financial services sector were particularly cautious about adopting cloud, the report found.

One of the things holding back uptake, it seems, is a concern about security. More than a third (36%) said either that security was a major issue at the top of their mind when they looked at cloud computing, or that concerns about security was stopping them from looking at cloud computing in the organisation.

Ian Brown, a senior analyst at Ovum, agrees that there is a widespread belief that data held in the cloud by a third party is less secure than data held on an in-house server. This concern is probably misplaced, he argues, given that a large cloud provider will have far more resources to direct at security than the average enterprise. Worries about compliance are probably more justifiable. Under the Data Protection Act, organisations have to agree that personal data will not be moved outside a particular group of named European countries, but a cloud provider may be storing data in multiple jurisdictions. This problem isn’t insurmountable (personal data can be anonymised, for example), but it does make the decision to move to the cloud a more complex one.

A more reasonable concern, says Brown, relates to resilience: “There are more problems around availability in public cloud than around security – or at least there seem to be, to date. You regularly hear about outages of Amazon or Microsoft, which would give you more reason for distrusting cloud than the security issues that have been reported.”

Implementing cloud does not require an all-or-nothing approach, however, and there are variants on the standard cloud model in which an organisation hires its computing resources from a large provider such as Amazon. Some organisations have adopted private clouds, run either in-house or by a third party, adopting a virtualised architecture that enables them to provide hosted services for business units within the organisation. Although private clouds lack the scale benefits of a public cloud, they do provide organisations with greater control over their data, and mean that the organisation isn’t reliant on the provider for continued uptime.

Private clouds also provide an opportunity for organisations to take a good look at their current software use and to take steps to manage it more effectively.  “In some cases there’s a degree of transformation that needs to take place, and quite often investment in private cloud is the instigator for that transformation that needs to take place,” says Brown. “One of the issues for all organisations is that they need to rationalise their applications footprint before they do anything. If you look at roadmaps for infrastructure maturity, quite often software rationalisation is high on the agenda because organisations are simply supporting too many applications, too many versions, too many releases, across the organisation. If they rationalise that, and start providing that from maybe one or two locations as a service to the rest of the business, that is clearly a way to go to provide more efficient IT.”

In fact, it need not be an either/or choice between public and private cloud. Quocirca believes that a hybrid cloud model, which combines a private cloud with use of a public cloud for some functions and services, will be an increasingly popular and workable model in future.

For public sector organisations, however, there are other attractive cost-saving models in addition to the standard public and private cloud options. One is shared services, in which different public sector organisations pool their IT resources to deliver back office functionality. Several shared services initiatives are already underway. NHS Shared Business Services (NHS SBS), a joint venture between the Department of Health and Steria, offers back office services such as finance & accounting and payroll & HR to NHS trusts. By centralising these functions, along with procurement services, NHS SBS believes it can save the NHS millions of pounds. Other organisations, such as academy schools and local councils, are banding together to achieve economies of scale through shared services. There are currently about 200 shared services projects in operation in local government. Two district councils, South Oxfordshire and Vale of White Horse, have jointly saved about £4m a year from sharing their IT services.

The really big initiative in the public sector, however, is the government’s £4.9m G-cloud programme, which it expects to save £120m between 2014 and 2015. The G-cloud is a private, government-controlled cloud that will offer four categories of IT service (infrastructure, software, platform and specialist service) to central government departments, local authorities and other public sector organisations. Currently each government department has its own set of IT systems, so there is needless duplication of functionality. The G-cloud will include an app store, enabling recommended tools to be shared among government departments. Procurement will also be easier – the CloudStore, hosted on Microsoft’s Azure platform, will enable public sector organisations to access centrally negotiated arrangements for products and services. Newly launched, it has already had its first customer ­– the Maritime and Coastguard Agency (MCA) has bought agile education services from Emergn, an SME, via the CloudStore.

G-cloud has its critics, but if it works, it will provide both central and local government organisations with a straightforward method of saving money. Most local councils perform similar functions, and therefore need similar applications, so it makes sense to develop or purchase a single application that can be scaled across multiple councils than for each council to buy its own application. At a time when local councils are facing a budget cut of, on average, 4%, a move to procure services from the G-cloud is a straightforward, relatively pain-free method of reducing costs.

For CIOs contemplating a move to the cloud, there are now several attractive options: the development of a private cloud, which enables them to save money by rationalising infrastructure and providing services on a hosted basis; a move to the public cloud, which provides economies of scale and a move from a capex to an opex payment model; and a hybrid model, in which the private cloud is used as the basic method of delivering applications and services, but mixed with functions and services from the public cloud, where it makes sense to do so (for example, if that function would be expensive or complicated to provision internally.) For public sector organisations, additional options include collaboration with other organisations to adopt shared services and the use of the emerging G-cloud. There is no reason why these different models cannot co-exist within the same organisation.

What works for a particular organisation will depend on the characteristics of that organisation: how large it is, which vertical sector it’s in, what investment it’s already made in infrastructure and how complex its IT needs are. Any move to the cloud, whether it’s private, public or hybrid, needs to begin with an analysis of the existing state-of-play and an assessment of the organisation’s future needs. This initial groundwork will be valuable in itself, and will pave the way for a strategic approach to cloud that will bring long-term cost savings and greater agility.