Much like most traditional enterprise organisations out there, the BBC's IT department is facing a number of challenges with the general availability and ease ofaccess to cloud-based services. In the past IT was able to maintain all control of the organisation's technology needs, and most likely got very used to saying 'no' to a lot of its users. However, now users have the ability to say 'screw you' and head to the cloud to make their own buying decisions – creating a host of problems with shadow IT. It is now highly likely that business users are handing over critical data to cloud providers, without a thought for control or back-up. This may be being done out of naivety, or frustration, but either way it is not an issue the IT department can ignore any longer.
The BBC has become wise to this and has begun taking measures to ensure that whilst it is offering its users and buyers of cloud some options to satisfy their needs, they are still monitoring purchases and maintaining control of data. Paul Boyns, the BBC's head of infrastructure strategy and architecture, was speaking last week at Cloud World Forum in London, where he said that he has identified four different types of cloud buyer within the organisation:
- Business leaders – these are users that are slightly more savvy to governance structures in place and as a result try to follow the correct protocols. Business leaders tend to come to IT to seek advice on whether or not they can buy a certain cloud service.
- Solution architects – they sometimes make use of the cloud, but they do so in a controlled environment and are usually monitored.
- Developers – these are frequent users of cloud technologies, but they also mostly do so in a controlled environment and are monitored on their use.
- End-users – the average employee uses cloud technology often and frequently. And they most likely do so without a care or worry, it is completely uncontrolled.
Boyns said that these users all need guidance on how to use and buy from the cloud – whether that be for simple needs, such as understanding the difference between a managed cloud service and the public cloud, or understanding contractual terms & conditions about who has control of the company's data and where it should be sitting. At present this education process and the awareness of the cloud is being managed through an internal group of cloud-bods that have been pulled together from across the Beeb. Boyns said:
“How are we going to be managing cloud within the BBC? One of the things we have done is establish a central group for the cloud that can focus on our current usage and how we think we should be trying to regulate, inform, and communicate the adoption of those services within the organisation.
“We have got representation from a number of different parts of the BBC - legal, information policy, security, architecture, IT delivery - but also from the large user communities within the BBC that are buying cloud services, to try and get a reasonable amount of coverage. That's where our cloud usage policies get set, agreed and communicated, as well as our compliance workflows. We have workflows which tell someone what they can do with any solution e.g. go to public cloud, but has to be within EU etc.
“We are also monitoring usage within the organisation – where are we seeing more contracts being signed within the organisation? Where are we seeing adoption going up? We are trying to make sure that if there's a new message that needs to go out, or if there's a new risk that's coming up, we can figure out how to confront that”
Brokering service and an internal catalogue
Although this internal group is satisfying the BBC's needs at present, Boyns expects that this will have to develop into a full-blown internal brokering service. He said that the BBC recognises that this isn't a capability that it has at the moment, but is one that it is planning for. Boyns added that there will always be technology that needs to be built internally at the organisation, but this will be technology that can prove to be a differentiator for the BBC. However, a significant amount of the technology currently bought is viewed as a commodity – and this is when buyers should go to the cloud. A brokering service would provide a mechanism for this to be done efficiently and effectively. Boyns said this brokering service will have a number of levels:
“So if we look at brokering functions – market awareness is at the bottom. This could include advising buyers on which vendors provide which services, which vendors we think have a good story to tell. It could also be about cautioning buyers to not purchase goods outside of the EU, perhaps. It's really about acting as an advisor.
“The next level up is procurement, so not only can we provide advice but we can also provide a procurement mechanism. It might be that we are putting in place framework agreements with certain cloud providers so that it makes it easier for businesses to buy those services, which also gives us the ability to put front and centre the vendors that we are comfortable with. The vendors that we have already done an assessment of.
“Then there are a number of other elements that kind of sit together that you would expect from a more conventional broker service. For example, dealing with the overhead that comes from cloud services - there are more vendors, more contract management etc. Actually getting to grips with the vendors' different billing mechanism, simplifying that.”
Boyns said that these traditional brokering services may not be provided by the BBC – in fact things at the top end of the scale e.g. consolidated billing andprivate cloud purchasing, will likely be outsourced. Whereas, the market awareness piece and the procurement side will likely be kept within the BBC.
Finally, Boyns said that the BBC may look to introduce an internal cloud catalogue for the organisation for users to buy pre-approved services that the IT department has an agreement with. Although Boyns didn't say so explicitly, it sounds a lot like the BBC is looking to introduce a G-Cloud type buying mechanism for the organisation. Boyns said:
“We are looking at mechanisms to put a service catalogue up on our intranet, so people can buy services and we can orchestrate to automate the provision of them. We are very interested in that. It's one of those areas where we think we can encourage people to use services that we have had an opportunity to look at.
“Cloud is something that is extremely hard to put a stop on and therefore we have to treat it as an audience and figure out how we are going to be associated with that.”