Gather a few hundred IT executives in a room for a day, as we did recently at our CIO Perspectives Forum in New York, and talk of cloud computing billows \n\nforth. For CIOs who are already dabbling, projected savings are debated. From bullish analysts and eager vendors, more \n\ndazzling benefits are predicted. \n\nMore on CIO.com\nCloud Computing Vendors Seek Common Definition and Goals\n\nA Tale of Two Cloud Computing Conferences\n\nCloud Computing: Reality Check From Early Adopters\n\nAmazon.com Offers Compiere Enterprise ERP via the Cloud\n\nCloud Vendors: Comparison of Amazon EC2, Google, Skytap and VMware\n\nYet just as quickly come the caveats. Questions abound on security, reliability and control over corporate data. The biggest \n\nshadow of all is cast over what, exactly, cloud computing means.\n\nA recent academic study identified at least 22 definitions of "cloud computing" in common use, from the \n\nbroad notion of using the Internet to access any sort of managed technology services (a.k.a. SaaS or software as a service) to \n\nthe wide-eyed optimist's view that a diverse, powerful lineup of cloud services will be delivered in real time by crash-proof \n\ndistributed servers "without complicated deployment worries."\n\nThe sorry economy is prompting more CIOs to explore cloud computing and its cost-cutting promise, says Doug Tracy, former \n\nglobal CTO for Rolls-Royce. "But it's still an idea that a lot of people don't know a whole lot about."\n\nThe core attraction of cloud is that companies can avoid buying and running hardware, software and other equipment by \n\ncontracting with a services vendor to run selected systems or applications on its own infrastructure of virtualized servers. \n\nThe "services" you purchase are delivered in a standardized, multitenancy fashion that observers say will save one-third to \n\none-half of your current costs.\n\nThat's certainly appealing as this recession forces CIOs to seek ever-greater efficiencies from IT infrastructures already as \n\nlean as starving wolves.\n\n"We're under tremendous pressure to provide flexibility and agility and to be driving cost models down," says Charles Soto, \n\nvice president of IT at Motorola's Broadband Mobility Solutions business, which recently tested cloud computing services for \n\nfour different applications. But thinking that cloud computing will release an instant reservoir of savings is a mistake, he \n\nadds.\n\nTo Arthur Winn, head of pricing at BT Group, "cloud" is nothing but a marketing term. The $41 billion London \n\ntelecommunications company has been doing what could be considered cloud computing for several years, he says. That is, \n\nhanding over BT customer calling data to a third party to analyze and then let BT access via the Internet. "As long as we are \n\ngetting more service for less money each year, we're happy," he says.\n\nMaking decisions about an over-hyped, under-delivering technology amid today's unrelenting economic pressures certainly isn't easy. So to help uncloud your thinking, we looked into exactly how several companies across \n\nvarious industries are experimenting with cloud computing.\n\nWhat we found is that cloud is an umbrella term for many services, including SaaS and virtualization\u2014anything but \n\ntraditional computing behind the walls of your own data center. If you're worried about being behind the cloud curve, don't \n\nbe.\n\nSpinning the Hype Cycle\n\nCIOs recognize this latest hype cycle all too well. When client-server computing was all the early-90s' rage, every vendor \n\nslapped the term onto its marketing pitch whether it fit or not. Then it was data warehousing lining up to provide a single \n\nview of all your customers at the touch of a button. Next came ERP systems intended to replace the disparate best-of-breed \n\nsoftware across business operations.\n\nAll of these hype-cycled technologies eventually had a significant impact on corporate computing environments, but invariably \n\nat much greater complexity and expense \n\nthan initially promised. \n\nFirst, a definition of cloud that makes sense to most CIOs: You don't own the software or hardware and, unlike outsourcing, no \n\nspecific equipment is dedicated only to you. You access the vendor's systems over the Internet in some secured way. For that \n\naccess, you pay a subscription fee that rises or falls with how much or how often you draw on the vendor's systems.\n\nGoogle, for example, offers office basics such as e-mail and word processing, with password protection and a per-user fee. \n\nAmazon offers substantial systems such as complete e-commerce or storage facilities, and charges per hour or per gigabyte for \n\nvarious configurations. From a newcomer such as Seattle-based Skytap, which provides virtual data center services, you get \n\naccess to application development and testing environments for a monthly base charge and pay extra for virtual-machine, \n\nstorage and data-transfer options. Cloud permutations range from network plumbing to business applications (see Cloud Vendors: Comparison of Amazon EC2, Google, Skytap and VMware).\n\nBut using a cloud of someone else's technologies isn't as simple as telling Amazon to open its doors to accept your data, then writing a check every month, cautions Motorola's Soto. \n\nHe would love to rejigger Motorola's IT to match computing power and cost-to-user demand, whether it falls during a bad \n\neconomy or rises during a good one. "How do we find a consumption-based model to pay for what we use, to be able to spin them \n\nup quickly or shut down without having to be burdened with depreciation schedules in the normal IT process?" he asks.\n\nThat idea appeals to many IT leaders considering cloud computing, says Tom Pettibone, managing partner of consulting firm \n\nTransition Partners. CIOs have had to design their data centers to take peak loads. But during off-peak times, that capacity \n\nsits unused and idling at great expense, Pettibone says. "That costs you every day."\n\nIn the Skytap experiment, Motorola put four applications on Skytap servers: a project management tracker, a Web design \n\napplication, an IT asset management database and a Microsoft Active Directory application. For $1,000, a small group of \n\nMotorola employees could test how those applications worked on Skytap's cloud for 30 days.\n\nMotorola is used to getting IT from outside its own walls, with 33 SaaS applications in production, including Salesforce\n.com. \n\nBut what the cloud experiments showed, Soto says, is that agility and cost savings come with trade-offs. While he estimates \n\nthe cost at one-third to one-half of what Motorola normally spends on those applications, Skytap's security needs work, he \n\nexplains. Motorola's people could see each other's data, he says. "That's very significant."\n\nPlus, adds Sujit Sinha, senior director of IT strategy and architecture at Motorola, complying with Sarbanes-Oxley regulations \n\nabout segregation of duties in the cloud appears difficult. "We didn't see a way to segregate who has rights to do what," \n\nSinha says. That raises concerns about failing a Sox audit, which requires clear evidence of employee assignments that present \n\nno conflicts of interest when handling company financial data.\n\nSkytap is learning from its customers, says Ian Knox, the vendor's director of product management. Security settings can be \n\nchanged to protect data from the eyes of others, he says. A few weeks after Motorola's test ended, Skytap added several \n\nreporting and role-based access features to address Sox concerns, Knox adds. In cloud computing in general, Sinha notes, other \n\nissues also need to be worked out, such as who has rights to your data. With no universally accepted terms of what a cloud \n\nvendor can and cannot do, he says, "you have to work it out in your contracts."\n\nDespite the obstacles, Motorola is moving forward with its cloud initiatives. Next, they will pilot cloud services from a \n\nbigger player and, within the next quarter, they hope to have a small cloud application in production. Says Soto: "We'd do it \n\nyesterday if we could."\n\nPrice Modeling game changer\n\nAt BT, what Winn considers cloud began years ago. Winn's group, which sets rates and deals for cell phone calling plans, had \n\nto compete with other departments for time on BT's internal, massively parallel servers. The group couldn't get enough time to \n\nrun many queries to test new pricing ideas, Winn says, so they looked outside the company for computing power.\n\nBT contracted with Kognitio for "data warehousing as a service," done on the vendor's servers on data BT ships via the \n\nInternet. Each month, BT sends the vendor hundreds of millions of call center records, or about 3.6TB of data. Kognitio then \n\nperforms regression analysis so BT can study customer churn, for example, and what-if scenarios to discover how new price \n\nplans would play out.\n\nBT pricing specialists can log in to Kognitio's machines through a Citrix server to play around with the data, making queries \n\nusing Business Objects tools. "The concept of interested people sharing a common resource has been around forever," Winn says. \n\n"It's the model of the combine harvester."\n\nAugmenting its computing resources this way has allowed BT to launch ground-breaking cell phone plans. A few years back, cell \n\nphone competition was a race to the lowest per-minute rate.\n\nBT wanted to know whether capped pricing would be profitable. That is, no call would ever cost more than, say, five pence. By \n\napplying that theoretical pricing package to a month's worth of real calling data from every BT customer, the company \n\ndetermined that such a scheme would be profitable. So BT went ahead with it. "BT is never going to be the lowest per minute," \n\nWinn says. "We needed to change the game."\n\nWinn's group might have done such modeling with Excel spreadsheets on a subset of BT data. But aggregates and averages are a \n\nrisky way to model, he says. Abstractions can distort results. Working out pricing problems on Kognitio's servers lets BT use \n\nactual customer data\u2014and lots of it. "When the answer comes out, it has a lot more credibility," he says. "This isn't a \n\nfew assumptions in a spreadsheet. It is truly penny perfect."\n\nA Cloud By Any Other Name\n\nJim Swartz, CIO of Sybase, sees potential in cloud computing but isn't ready to give up his company's data to a third-party \n\nhost. Instead, he has virtualized Sybase's servers\u2014essentially creating his own private cloud\u2014so he can study the best way to use the architecture. \n\nAt Sybase, a private cloud of virtual servers inside its data center has saved nearly $2 million annually since 2006, Swartz \n\nsays, because the company can share computing power and storage resources across servers. The virtual setup also lets Sybase \n\nmove data electronically from one physical site to another, for a more agile disaster recovery program.\n\nWhenever you hear the term "private cloud," understand that it's "nothing more than virtualization," notes David Linthicum, \n\nprincipal of Linthicum Group, a consulting firm that specializes in enterprise architecture and Web technologies. \n\nVirtualization lets CIOs take advantage of the economics of cloud computing, he says, but within their own walls and under \n\ntheir own control.\n\nVirtualization has certainly saved money for Norton Healthcare, a nonprofit hospital system in Louisville, Ky., although CIO \n\nJoe DeVenuto declines to cite exact figures. Norton recently revamped its data center with vendor Emerson Network Power, installing 160 virtual servers. The \n\ngoal was to milk every drop of computing power and storage capacity from its machines. Virtual servers scale up and down fast, \n\nand new ones can be added in less time than it takes to configure a traditional server, DeVenuto notes. \n\nCloud vendors might be even more efficient than he is, De-Venuto says, but that extra oomph isn't worth the risk of letting go \n\nof patient data from Norton's four hospitals, 10 urgent care facilities and 60 doctor's offices. He would consider cloud for \n\ndisaster recovery, he says, but not for primary computing. "I'm fairly conservative. It's a struggle for me to put patient \n\ninformation in the public cloud."\n\nE-mail Options To explore \n\nOne organization more willing to farm out some of its data is the United States Golf Association, which governs the rules of \n\ngolf and runs 13 championships every year. Daily operations at the USGA rely heavily on their own e-mail system because they \n\nare in continual contact with their constituencies, such as state and regional golf associations, USGA members, championship \n\nhost clubs and the general golfing community. Even an hour of downtime would cause major disruption to this workflow, says \n\nJessica Carroll, managing director of IT.\n\nCarroll wanted to revise an existing e-mail backup plan that would take hours or days to recover. Under that plan, the IT \n\ndepartment would handle the entire recovery process, including ordering new hardware to start from scratch. To take the weight \n\noff her team's shoulders and to make sure the company wouldn't lose data or productivity, she signed a deal last year with IBM \n\nto host a replication of USGA's e-mail system in IBM's data centers. \n\nIf a USGA server hits a problem, Carroll can click a button to switch to the replicated version that IBM maintains for her, \n\nshe says, without USGA users noticing a thing. Then her IT department can fix the internal issues. The e-mail system carries \n\nUSGA's most critical data, such as membership information and correspondences between the constituents. \n\nBefore Carroll could feel comfortable with the deal, however, she extracted stringent service-level promises from IBM. For \n\nexample, in the event of a short-term outage such as a hardware failure, IBM must immediately provide a year's worth of \n\nbacked-up e-mails for senior management of the USGA staff so they can continue e-mailing without waiting for repair. In the \n\nevent of a full-blown crash, IBM would provide multiple years' worth of messages. The hardware and software for this kind of \n\nbackup and recovery system would have cost the USGA too much to do on its own, Carroll says. \n\nHamilton Beach Brands also dipped a toe into cloud computing via e-mail. When the time came to upgrade Lotus Notes last year, \n\nthe appliance company hesitated. Hamilton Beach hadn't refreshed Notes in three years and Jerry Hodge, senior director of \n\ninformation services, knew jumping from Notes 6.53 to version 8 would force him to upgrade his IBM iSeries servers and retrain the 500 users on the system. A lot \n\nof expensive work just for e-mail, he thought.\n\nHodge asked his staff to look into Google's Gmail service, among other alternatives. E-mail hasn't been a competitive \n\ndifferentiator for years, he reasoned. By subscribing to Gmail for a monthly per-user fee, Hamilton Beach would avoid the \n\nexpense of new hardware, software licenses and training. Because Google provides archiving and retrieval, Hodge also figured \n\nhe'd save on items such as backup tapes and disks and the IT labor to support electronic discovery for lawsuits or audits.\n"Over five years, the cost would be half," he says, looking at a spreadsheet comparing the Notes upgrade to Gmail. Such \n\nsavings in capital and ongoing operating expenses were too compelling to pass up, he says. "Let someone in the cloud run \n\ne-mail and free up my guys' time to work on stuff that does make a difference."\n\nDoubting the Cloud\n\nIt's one thing to put a basic, almost self-contained system like e-mail into the hands of an outside service provider. Quite \n\nanother to off-load more complicated, interdependent applications filled with sensitive customer or competitive data, says \n\nTracy, who recently left Rolls-Royce to become CIO of Dana Corp. "I don't think there's a mad rush for people to put their ERP systems in the clouds," he says.\n\nFor Tracy and other skeptics, security and reliability issues raise serious questions. Outages of Gmail for several hours in \n\nFebruary and April frustrated a mass of customers. Amazon, too, has experienced outages due to authentication overloads and other problems.\n\nHow much these issues matter will vary depending on the criticality of the system and the risk tolerance of the CIO, \nTracy \n\nsays. \n\nSecurity is especially important at Rolls-Royce, which makes such items as jet engines for military aircraft and power systems \n\nfor Navy ships. (The fancy cars are made by BMW.) As a defense contractor, the company is bound by strict federal technology \n\nand physical security regulations. He contemplated cloud computing but not with Amazon or Google partly because, he says, they \n\nwon't let customers inspect their data centers\u2014and that's a show-stopper for Tracy.\n"You say you want to try cloud computing, but it's only a few hundred bucks a month to them and they say it's not cost \n\neffective to allow this tour," he says.\n\nGoogle, for one, has heard this criticism before. Its response is that customers can feel comfortable with Google Apps because \n\nits systems and processes have passed a SAS 70 Type II audit of controls in place to protect data. Google has also \n\npublished on its enterprise blog some of the ways it manages customer information.\n\nThat helps a little, Tracy says, but it's far from enough when he worries about exporting sensitive data. "That requires us to \n\nunderstand where the data is hosted and who has access, [even] the nationality of everyone who is a system administrator," he \n\nexplains. "That's not feasible in cloud computing, where processing could be in any data center around the country at any \n\ngiven moment."\n\nThe People Costs \n\nAdopting cloud whole hog could cut IT staff by 10 percent to 15 percent, according to McKinsey. That's just what no one below \n\nthe CIO wants to hear. At Hamilton Beach, which simply handed over e-mail to Google, Hodge says he saw fear. "My team was \n\napprehensive about cloud. Thought it would put them out of a job." But no one has lost his job because of cloud computing, he \n\nadds. Instead, he's been able to reassign duties to let staffers do more productive work in areas such as business continuity.\n\nBack in New York, at the CIO Perspectives gathering of IT leaders, the enthusiasm about cloud computing's potential was \n\ntempered by sobering worries about early-stage hurdles. Still, the group estimated that within five years, as much as 25 \n\npercent to 30 percent of most companies' IT strategies will include services from the cloud. \n\n"The will to experiment is there," notes Shiva Swamy, \nexecutive vice president of IT services firm ZSL and one of the \n\nattendees. "Surely the bad economy provides the impetus, but there are many unknowns that we all have to figure \nout \n\ntogether."\n\nSenior Editor Kim S. Nash can be reached at email@example.com. Jarina D'Auria is a Boston-based freelance writer.\n\nDo you Tweet? Follow me on Twitter @knash99. Follow \n\neverything from CIO Magazine on Twitter @CIOMagazine.