(English Version) Study On Cloud Computing in The Spanish Public Sector

Study on cloud computing in the Spanish public sector
NATIONAL INSTITUTE OF COMMUNICATION TECHNOLOGIES
Edition: July 2012
The Study on cloud computing in the Spanish public sector was carried out by the following working group from INTECO: Pablo Prez San-Jos (management) Susana de la Fuente Rodrguez (coordination) Laura Garca Prez Cristina Gutirrez Borge Eduardo lvarez Alonso
This study was funded as part of the SERPLAGO project (Cloud platform services for online e-Government and e-Administration processes) by the 2011 call for the INNPACTO subprogram of the National Plan 2008-2011 of the Ministry of Economy and Competitiveness, co-financed by the ERDF funds allocated by the EU.
This publication is the property of the National Institute of Communication Technologies (INTECO) and is licensed under a Creative Commons Attribution - Non-commercial 3.0 Spain Licence, and therefore, copying, distribution and public communication thereof is permitted under the following conditions: Attribution: The content of this report may be reproduced in full or in part by third parties, quoting its source and making express reference both to INTECO and its website: www.inteco.es. This attribution may under no circumstance suggest that INTECO endorses such third party or endorses the use it may make of its work. Non-commercial use: The original material and any derivative works may be distributed, copied or exhibited provided that their use is not for commercial purposes.
Any reuse or distribution of the work must clearly state the terms and conditions under which it is licensed. Certain of these conditions may be waived if permission is obtained from INTECO as the holder of the copyright. Nothing in this license diminishes or restricts INTECOs moral rights. http://creativecommons.org/licenses/by-nc/3.0/es/ This document complies with the conditions of accessibility for the Portable Document Format (PDF format) and is therefore structured and labelled and provides alternatives for all non-text elements, language mark-up and appropriate reading order. For further information on the construction of accessible PDF documents, please consult the guidelines provided under Accessibility > Training > Manuals e-trust in Spanish households (2nd quarter. 2010) Study on information security and and guidelines on the website http://www.inteco.es Page 2 of 178 Information Security Observatory
CONTENTS
KEY ISSUES ........................................................................................................................ 8 I II Knowledge and use of cloud computing in the Spanish public sector ....................... 8 Decision model on the adoption of cloud computing services ................................... 9
III Outcome of cloud computing implementation .......................................................... 10 IV Intended future use .................................................................................................. 11 V 1 SWOT analysis ........................................................................................................ 11 INTODUCTION AND AIMS ......................................................................................... 12 1.1 1.2 Presentation ......................................................................................................... 12 Study on cloud computing in the Spanish public sector ....................................... 14
1.2.1 General aim...................................................................................................... 15 1.2.2 Specific aims .................................................................................................... 15 2 METHODOLOGY ........................................................................................................ 18 2.1 2.2 2.3 Phase 1: Documentary analysis ........................................................................... 18 Phase 2: Interviews with professionals and experts ............................................. 19 Phase 3: Survey of public sector entities ............................................................. 20
2.3.1 Survey population and subject of study ........................................................... 20 2.3.2 Sample size and sampling distribution ............................................................. 21 2.3.3 Sampling error.................................................................................................. 22 2.3.4 Survey method ................................................................................................. 23 2.3.5 Preparing the survey questionnaire and conducting pre-tests ......................... 23 2.3.6 Model for data collection and use of information generated ............................ 24 3 INTRODUCTION TO CLOUD COMPUTING .............................................................. 25 3.1 Description and characteristics ............................................................................ 25
Study on cloud computing in the Spanish public sector National Institute of Communication Technologies (INTECO)
Page 3 of 178
3.2
Classification of cloud computing solutions .......................................................... 26
3.2.1 By service level ................................................................................................ 27 3.2.2 By deployment model....................................................................................... 29 3.2.3 By business model ........................................................................................... 32 3.3 4 Benefits ................................................................................................................ 32
SPANISH AND INTERNATIONAL CONTEXT OF CLOUD COMPUTING .................. 35 4.1 4.2 International cloud computing context .................................................................. 35 Spanish cloud computing context......................................................................... 39
REGULATORY FRAMEWORK ................................................................................... 42 5.1 Regulatory framework for the protection of personal data ................................... 43
5.1.1 Cloud computing services delivered to a Spanish public entity by a service provider located in Spain ............................................................................................. 44 5.1.2 Cloud computing services delivered to a Spanish public entity by a service provider located outside Spain .................................................................................... 45 5.1.3 Special cases in terms of access to administrative information by citizens ..... 47 5.2 5.3 Regulatory framework of the Law on Information Society Services ..................... 48 Regulatory framework in public sector procurement matters ............................... 48
5.4 Regulatory framework for the National Security Framework and the National Interoperability Framework.............................................................................................. 49 5.5 5.6 6 Regulatory framework in intellectual property matters ......................................... 49 Regulatory framework in criminal matters ............................................................ 50
RISK ASSOCIATED WITH CLOUD COMPUTING ..................................................... 51 6.1 6.2 Legal and contractual risks................................................................................... 51 Technical risks...................................................................................................... 52
7 KNOWLEDGE AND USE OF CLOUD COMPUTING IN THE SPANISH PUBLIC SECTOR .............................................................................................................................54
Page 4 of 178
7.1
Knowledge of cloud computing ............................................................................ 54
7.1.1 Information channels about cloud computing ................................................... 56 7.1.2 Cloud computing technologies known .............................................................. 57 7.2 Adoption of cloud computing ................................................................................ 59
7.2.1 Characterisation of services and platforms ...................................................... 61 7.2.2 Cloud computing providers .............................................................................. 69 7.2.3 Associated economic cost of adopting cloud computing .................................. 70 8 DECISION MODEL FOR THE ADOPTION OF CLOUD COMPUTING SERVICES ... 73 8.1 Strategy of companies with cloud computing services ......................................... 73
8.1.1 Motivations for adoption ................................................................................... 73 8.1.2 Considerations before adopting cloud computing ............................................ 75 8.1.3 Considerations to be taken into account during the provision of cloud computing services ...................................................................................................... 80 8.2 9 Strategy of agencies without cloud computing services ....................................... 86
RESULTS OF IMPLEMENTING CLOUD COMPUTING ............................................. 89 9.1 9.2 Benefits derived from the implementation of cloud computing solutions.............. 89 Difficulties in the implementation of cloud computing solutions ........................... 92
9.2.1 Economic difficulties......................................................................................... 94 9.2.2 Technical difficulties ......................................................................................... 95 9.2.3 Security difficulties ........................................................................................... 96 9.2.4 Legal and institutional difficulties ...................................................................... 97 9.3 9.4 10 Degree of satisfaction with cloud computing providers ........................................ 98 Overall result: fulfilment of expectatons ............................................................. 100 INTENTION OF FUTURE USE.............................................................................. 102
10.1 Expected use by authorities with cloud computing services .............................. 102
Study on cloud computing in the Spanish public sector National Institute of Communication Technologies (INTECO) Page 5 of 178
10.1.1 Expected maintenance of cloud computing solutions .................................... 102 10.1.2 Expected incorporation of solutions which have not yet been implemented .. 103 10.1.3 Oversight role of the public authorities ........................................................... 104 10.1.4 Expectations for obtaining benefits in the future ............................................ 106 10.2 Projections of entities without cloud computing services ................................... 107 11 SWOT ANALYSIS.................................................................................................. 110
11.1 Strengths ............................................................................................................ 111 11.2 Weaknesses ....................................................................................................... 113 11.3 Opportunities ...................................................................................................... 115 11.4 Threats ............................................................................................................... 116 12 GOOD PRACTICES AND RECOMMENDATIONS ............................................... 117
12.1 Strategic recommendations................................................................................ 117 12.2 Technological recommendations........................................................................ 118 12.3 Management recommendations ......................................................................... 119 12.4 Regulation recommendations............................................................................. 119 13 SUCCESS STORIES ............................................................................................. 121
13.1 International experiences ................................................................................... 121 13.1.1 United States - USA.gov Portal ...................................................................... 121 13.1.2 United States - Apps.gov Platform ................................................................. 122 13.1.3 United Kingdom - G-Cloud ............................................................................. 124 13.1.4 France - Andromeda Project .......................................................................... 125 13.1.5 Colombia - Proexport-CRM (Cloud-Based) Project for SMEs ........................ 126 13.1.6 Japan - Red cloud Kasumigaseki (Hatoyama ICT Plan) ................................ 128 13.1.7 Luxembourg - Integrated Biobank of Luxemburg (IBBL) ................................ 129 13.1.8 United States - NASA Nebula Project ............................................................ 130
Study on cloud computing in the Spanish public sector National Institute of Communication Technologies (INTECO) Page 6 of 178
13.2 Projects in Spain ................................................................................................ 131 13.2.1 Calpe Municipal Council - Virtual Desktop ..................................................... 131 13.2.2 Provincial Government of Salamanca - Web presence of the Municipal Council of Salamanca............................................................................................................. 132 13.2.3 Sociedad de Gestin Pblica de Extremadura (GPEX) - Electronic tendering platform...................................................................................................................... 133 13.2.4 Correos - SISNOT electronic notification platform ......................................... 134 13.3 The cloud strategy of the US Federal Government: the Vivek Kundra Model .... 135 APPENDIX I: BIBLIOGRAPHY ......................................................................................... 137 APPENDIX II: LIST OF EXPERTS ................................................................................... 139 APPENDIX III: SOLUTIONS WITH GREATEST PRESENCE AT NATIONAL AND INTERNATIONAL LEVEL ................................................................................................. 141 I II IAAS solutions........................................................................................................ 142 PAAS solutions ...................................................................................................... 143
III SAAS solutions ...................................................................................................... 146 APPENDIX IV: LIST OF BODIES PARTICIPATING IN THE SURVEY ............................ 151 INDEX OF CHARTS ......................................................................................................... 171 INDEX OF TABLES .......................................................................................................... 175 INDEX OF FIGURES ........................................................................................................ 176
Page 7 of 178
KEY ISSUES
The technological evolution experienced in the last few decades has enabled the development of a new computing model: cloud computing. Under this paradigm, information resources can be stored in third-party services and accessed via the Internet. Thus, in a cloud model, organisations will be able to move away from more traditional technological management (requiring substantial investments in resources, including hardware, software, data processing centres, networks, employees, security, etc.) to embrace the new cloud management model, which eliminates the need for large investments and fixed costs, and transforms suppliers into instruments providing users with instant and flexible computing capacity on-demand. The public sector has also become involved in the cloud computing paradigm. INTECO publishes the Study on cloud computing in the Spanish public sector which showcases the Spanish public sectors adaptation to a new technological paradigm, as represented by the cloud computing approach. In order to carry out this study, a survey was conducted on a representative sample of Spains public sector entities at central government, autonomous community and local government level. The survey also involved the participation of a group of experts in the public sector, who provided a qualitative vision of the area under study. The key points of the analysis are set out below: I KNOWLEDGE AND USE OF CLOUD COMPUTING IN THE SPANISH PUBLIC SECTOR
Although the spread of cloud computing among Spanish public sector entities is still limited, it is more common among local government authorities than among central government or autonomous community bodies. In any event, the most common implementation model observed is the private platform. 56.2% of the Spanish public authorities declare that they are, to a greater or lesser extent, familiar with the cloud computing concept (15.6% state they have an in-depth knowledge of it, whereas 40.6% state that although they have heard of it they do not master the subject). Use of cloud computing solutions in the Spanish public sector remains limited. Only 33.4% of the public entities are actually users of a cloud computing-type service. The remaining 66.6% have still not opted to include a cloud service. Local government authorities are markedly more active in the adoption of the cloud than their autonomous community and central government counterparts,
Study on cloud computing in the Spanish public sector Spanish National Institute of Communication (INTECO) Page 8 of 178
with 34.2% of local government authorities defining themselves as cloud computing users as compared to 28.7% and 23.4% at autonomous community and central government level, respectively. Cloud computing technology only reached the public sector domain fairly recently. 14.2% adopted it within the last twelve months and 51.2% within the last three years. Priority seems to have been given to the implementation of private cloud computing services (58.2% of the public authorities use this means, as compared to 31% which adopt a public implementation model). Behind these are the Spanish authorities adopting hybrid clouds, which accounted for 16.8% of those deployed, followed by entities deploying community model clouds, with a penetration rate of barely 3.9%. II DECISION MODEL ON THE ADOPTION OF CLOUD COMPUTING SERVICES
The quest for savings, efficiency and simplicity are the main circumstances which induce authorities to hire cloud computing services. Those public entities which decide to migrate to the cloud do so following a legal analysis which, above all, takes into account existing legislation on data protection. Economic savings and time-savings in the management of technological resources, quoted by 68.4% and 69.5%, respectively, head the list of the determining factors behind the hiring of a cloud computing-type service. 41.7% of the Spanish authorities carried out a risk analysis, performed either internally (29.9%) or with the assistance of an external provider (11.8%), before deploying the cloud computing service. When carried out, the analyses focused on the risks with regard to information integrity (70%) and privacy (52.4%). 66.9% of the public entities confirmed that they took the corresponding regulations into consideration prior to hiring a cloud computing service. Data protection regulations are those most widely considered (94.4%). Only 43.0% of the public sector authorities request compliance with some kind of security standards from service providers. Those agencies that choose to request standards opt, in most cases, to enter into business continuity and service agreements (55.2%), under ISO 27001 (30.7%) and ISO 9000 (13.1%).
Study on cloud computing in the Spanish public sector Spanish National Institute of Communication (INTECO)
Page 9 of 178
III
OUTCOME OF CLOUD COMPUTING IMPLEMENTATION
Those authorities that have adopted cloud computing see time and cost savings as the models main benefits, and service and data integrity issues as its main challenges. The Spanish public sector considers the cloud as a technological advantage and, above all, an operating advantage and their initial expectations have been fulfilled as regards cloud computing. The time and cost savings (66.5% and 53.7%, respectively) are the main benefits of cloud computing, followed by an increase in the range of services offered by the body (51.2%) and a general improvement in productivity (47.2%). In the analysis of the challenges faced by Spanish authorities adopting the cloud, 29.5% of the public bodies service and data integrity issues made cloud adoption very or rather difficult. In relation to this qualification, the bodies non-existent technical capacity (20.8%) and loss of control over processes and data (20.4%) were problems faced by the public sector in its transition to the cloud. Public sector entities are satisfied with their cloud computing providers. When measuring satisfaction in terms of service quality, the authorities that showed the greatest satisfaction were those which had hired their services from international providers. In conclusion, 79% of the entities hiring cloud services from an international company were very or quite satisfied with the quality of the installation, while those bodies whose services were provided by another public authority reported a 70.6% level of satisfaction. In contrast, on analysing satisfaction in terms of ease of contact with and availability of the provider, the results were better when the service provider was a public authority. 75.3% of the bodies working with public sector cloud providers declared that they were very or quite satisfied with their availability and ease of contact. However, in the case of private international providers, the level of satisfaction dropped to 60.4%. 59.5% of the public entities using cloud considered cloud computing a technological advantage as compared to 17.8% which did not share this opinion and a further 22.7% which abstained from giving an opinion in this regard. In any event, 85.9% of the authorities considered that cloud has a positive operating effect on the entitys performance. Three out of every four public bodies indicated that cloud computing had fulfilled their expectations and a further 9.4% deemed that they had been exceeded. Just 6.4% of the authorities considered that the outcome fell short of their initial expectations.
Page 10 of 178
IV
INTENDED FUTURE USE
For those authorities already using cloud computing, the outlook for the future is very positive: they intend to continue working within the cloud, will recommend its deployment to other public institutions and anticipate obtaining further advantages from cloud usage in the future. However, the bodies not yet in the cloud are more wary: few intend to include technological solutions and, of those, only a minority will implement a cloud computing model. The majority of the authorities using the cloud (94.5%) intend to continue using cloud computing for the solutions that have already been migrated to this technology. Only 0.2% of the user-entities state that they will not continue to use cloud technology in the future, while the remaining 5.3% are undecided. The representative power held by the authorities as cloud users is important. Three out of every four entities state that they would certainly recommend the use of cloud computing to other authorities and an additional 17.2% agree that they would probably recommend its deployment. 81.6% of the public authorities believe that further benefits will be gained from using cloud computing technology as compared to 3.4% which disagree and a further 15% which remain unsure. SWOT ANALYSIS
WEAKNESSES Lack of specific procedures for hiring cloud computing services. Governance issues arising in the process of transformation towards shared services Delocalisation of the information and loss of control Provider dependence Lack of flexibility for HR reorganisation Failure to depreciate IT resources Lack of bandwidth at certain locations Inadequate analysis of relevant issues prior to hiring the services and during provision thereof THREATS Absence of an international legal framework legislation to regulate the cloud computing model Over-sizing of provider capabilities degenerates service provision
STRENGTHS Economic savings Concentration and strengthening of security management Flexible demand variability management Elimination of duplicities and redundancies Service availability Main benefits are citizen-oriented Accessibility and mobility Large number of possible providers
OPPORTUNITIES Sharing of common resources and standardisation Provision of services and resources to other organisations Lessons learned from private sector Preference for Spanish providers
Page 11 of 178
1
1.1
INTODUCTION AND AIMS

PRESENTATION
The Instituto Nacional de Tecnologas de la Comunicacin (INTECO) is a Government body attached to the Ministry of Industry, Energy and Tourism through the Secretariat of State for Telecommunications and the Information Society. INTECO is a centre of development which is innovative and serves the national public interest. It is committed to adding value to the industry and to users, and to the dissemination of new information technology systems and information and communication technology (ICT) in Spain, in line with Europe. Its fundamental objective is to serve as a vehicle to develop the Information Society, with its own activities in the field of innovation and development of projects associated with ICT, based on three fundamental pillars: applied research, service provision and training. INTECOs mission is to add value and innovation for individual citizens, small and medium sized enterprises (SMEs), public service bodies and the information technology sector. It does this through the development of projects which contribute to reinforcing confidence in the services of the Information Society in our country, in addition promoting a route for international participation. Based on the aforementioned, INTECO is developing actions in the following areas: Technological security: INTECO is committed to making the services of the Information Society more secure, to protecting the personal details of interested parties, their privacy and the integrity of the information and to preventing attacks which put at risk the services provided. There is of course guaranteed strict compliance with the legal and material rules of ICT. It coordinates a range of public initiatives in terms of ICT security, which materialise in the provision of services by the Information Security Observatory, the Centre for Response to Security Incidents in Information Technology (INTECO-CERT), with its index of companies and ICT solutions and the Office of Internet User Security (OSI), which can be of benefit to individuals, SMEs, public service bodies and the technology sector. Accessibility: INTECO encourages the services of the Information Society to be more accessible, the removal of barriers to access, whether these are due to a lack of technology or complexity of the technology, including when users are disabled. It facilitates the progressive integration of all user groups, with the aim of enabling all to benefit from the opportunities offered by the Information Society. In particular INTECO has wide experience in the development of projects in the field of accessibility to digital television, as well as those geared towards securing the
Page 12 of 178
ICT Quality: INTECO encourages improvements to quality of Information Society services to guarantee an adequate level of service which translates into more robust applications and systems. It commits to availability and response times, an adequate support system for users, precise and detailed information about the development of service functionalities and in the continual improvement of services. In this context there is an aim to improve the competitiveness of the software industry by encouraging better quality and certification of companies and software engineering professionals, through the National Software Quality Laboratory.
Training: Training is a determining factor in attracting talent and improving competitiveness between companies. For this, INTECO promotes university and professional training in the technologies most demanded by the industry.
One of the aims of INTECO is to describe in a detailed and systematic way the level of security and confidence in the Information Society and of generating specialised knowledge in the material. From this came the service for individual citizens, businesses and public service bodies in Spain to explain, analyse, assess and disseminate the culture of information security and e-confidence. INTECO has designed an Action and Study Plan with the aim of producing specialised and useful knowledge in terms of security for INTECO, as well as developing recommendations and proposals which define valid trends for future decision making by public authorities. This action plan contains research tasks, analysis, studies and advice and it will commit to, among other things, the following strategies: Develop its own studies and reports in relation to information and communication technology security, with particular emphasis on internet security. Follow the main indicators and related public policies regarding information security and be knowledgeable about the national and international context. Create a database which enables the analysis and evaluation of security and give reliable time factors. Initiate research projects on ICT security.
Page 13 of 178
Disseminate studies and reports published by other national and international bodies and organisations, as well as information about the current situation nationally and in Europe about security and confidence in the Information Society.
Advise public service bodies in terms of information security and confidence, as well as support the development, follow up and evaluation of public policies in this sphere. STUDY ON CLOUD COMPUTING IN THE SPANISH PUBLIC SECTOR
1.2
The cloud computing model is currently one of the main trends to be considered when outsourcing services. The benefits of this information services model influence the decision-making process adopted by companies, despite the fact that hiring this service implies relinquishing direct control over technological infrastructure, applications and/or processes. Cloud computing-based service models offer advantages, but also present risks for the users thereof. In this regard, it is crucial that any entity considering working in the cloud is fully aware of how to deal with certain key issues such as, for example, management of the relationship with the service provider, the definition of service levels or the applicable legislation. Failure to take the impact of these and other circumstances into consideration could mean that authorities fail to take advantage of the opportunities offered by cloud computing. Spanish public authorities and bodies make intensive use of information technologies and, therefore, are not adverse to new market trends. In this context, INTECO has identified the need to carry out a study on the use of cloud computing-based service models in the Spanish public sector. The study includes an assessment of the actual degree of commitment and knowledge of cloud computing held by Spanish public authorities and bodies. The results are grouped into three conceptual blocks: Implementation. Analysis of the degree of deployment of the cloud in its information systems, the model used to adopt these services and those aspects considered when making the decision. Risks. Performance of a risk analysis prior to adopting a cloud computing model. Reasons against: Detail of the reasons and motives for not adopting the cloud computing model. Service supervision. Detail of the requirements to be fulfilled by providers in terms of the service levels requested and follow-up of their fulfilment.
Page 14 of 178
Future possibilities and benefits. Review of the future improvements in terms of technological performance and economic benefits obtained as a result of adopting the cloud computing model.
Difficulties: Analysis of the main disadvantages associated with the implementation of the cloud computing model from a security, economic, technical and legal standpoint.
Finally, this study provides a general overview of the positioning of the public authorities and bodies in terms of the models for the provision of technological services based on cloud computing. 1.2.1 General aim
The main aim of the study is to gain an understanding of the position taken and the perception held by the Spanish public authorities in relation to cloud computing, based on the information provided directly by the Spanish public authorities, bodies and entities, complemented by the input of a team of experts. 1.2.2 Specific aims
More specifically, following is a detail of the individual aims of each of the sections in which the study is organised: Cloud computing context Describe the cloud computing context, its evolution and the main key concepts of this type of services. Outline the state of the art of cloud computing services at national and international level. Examine the various security and regulatory requirements. Identify the main benefits to the organisations which have adopted cloud computing. Knowledge and use of cloud computing in the Spanish public sector Describe the degree of knowledge of cloud computing held by authorities in terms of the territorial scope of the public authority (central government, autonomous community, local government). Quantify the degree of implementation and acceptance of the cloud model in the public sector and examine the various features of the services and platforms.
Page 15 of 178
Investigate the economic cost of implementing the model. Ascertain what kinds of providers are providing cloud computing services to the Spanish public authorities.
Decision model on the adoption of cloud computing services Analyse the current decision model followed by the various public authorities and bodies to adopt the service. Detail the necessary requirements requested from the provider. Assess the risk analysis carried out prior to implementation. Define the main means defined between the public body and the provider to ensure quality supervision of the service: control mechanisms installed, security standards required and the service-level agreements signed. For those authorities which opted not to adopt cloud computing services, detail the reasons behind the decision not to adopt the model.
Outcome of cloud computing implementation Detail the benefits and difficulties experienced following service implementation. Describe the overall position from a technological and operational perspective. Define the level of satisfaction shown by the authorities with regard to the services provided by providers. Intended future use Provide a vision of the future of cloud computing in the coming years and how this will affect the Spanish public authorities and bodies. Detail the next steps for those entities which have adopted the cloud model. Describe the possible future cloud computing implementation models.
SWOT analysis Undertake an analysis of the main strengths, opportunities, weaknesses and threats facing the Spanish public sector following its adoption of cloud computing.
Page 16 of 178
Good practices and recommendations Provide a list of the good practices to be followed to adopt the cloud computing model. Detail the strategic, technological, managerial and regulatory recommendations.
Success stories Describe Spanish and international experiences of successful implementation of cloud computing-based solutions.
Page 17 of 178
METHODOLOGY
Fulfilment of the study aims required the development of an analysis methodology which enabled a series of conclusions and recommendations to be drawn from a study of the sources and existing literature available on the area of study, an analysis of expert opinions and the results of a survey conducted among the Spanish public sector entities. The methodological approach provided below includes a summary of the main technical parameters adopted for the performance of the study. Three analysis processes were carried out which provided various sources of complementary information: Desk-research of secondary sources. The analysis of existing Spanish and international documentary sources on cloud computing enabled the definition of the key concepts of the study and the obtainment of comparative data for the results generated by the study. Qualitative research. In-depth interviews were carried out with experts in this industry, professionals within the various public authorities with positions of responsibility in the area of technology management. Quantitative research. A telephone survey was conducted with a representative sample of entities in the Spanish public sector which generated numerical data. The results obtained from the three sources of information enable reflections, assumptions and conclusions to be drawn which were used to organise the main sections of this report. Accordingly, the study provides a precise view of the perception and state of the art of cloud computing within the context of the Spanish authorities. 2.1 PHASE 1: DOCUMENTARY ANALYSIS
Prior to detailing the methodological instruments used to conduct the field work, an analysis was carried out of the main bibliographical resources, specialist magazines, news, on-line opinion and information blogs relevant to this line of study and the foundations of cloud computing at national and international level. The aims of the preliminary documentary analysis were to: Specify the underlying principles and basic terms of cloud computing and compile a glossary of terms and concepts used for all the areas under study. Analyse international studies of similar themes, with the aim of identifying the main benefit and risk axes evaluated by other authors and experts.
Page 18 of 178
Ascertain the state of the art of cloud computing among public authorities within the Spanish and international context.
Identify common practices in the analysis of cloud computing phenomena, in addition to success stories in the context of the public sector. Learn the perspective of and opinion held by the opinion leaders of cloud computing: prospective reports of strategic consultancy companies, papers delivered by officials of the Spanish Data Protection Agency, informed opinions held by Spanish and international public officials, etc.
Learn the opinion and positioning of the Spanish ICT industry in the cloud market, its maturity curve, the services and products offered, fees and any other relevant issues. Establish the regulatory framework for cloud computing at Spanish, European and international level (legislation on data protection, National Security Framework, etc.).
The sources and references used may be consulted in the bibliographical references to the study detailed in Appendix I. Throughout the report any concepts, expressions or conclusions based on the opinion of a source or author other than INTECO will be highlighted. 2.2 PHASE 2: INTERVIEWS WITH PROFESSIONALS AND EXPERTS
This phase involved the collaboration of experts in this field, with whom a qualitative research methodology was adopted based on the performance of in-depth interviews. Ten Spanish experts at various levels of government were chosen, all of whom held, at the time of the interview (or had held in the past), public office in relation to public management of ICTs, administrative modernisation, security and fostering the information society. The agents selected have knowledge of and real effective experience in the analysis, design or implementation of cloud alternatives within a framework based on the development of technological solutions for the improvement of public services and policies. When selecting the experts, the objective pursued was to ensure the presence of professionals in the Central Government authorities, autonomous community authorities, provincial or local authorities and public bodies or entities. The interviews were conducted in the form of standardised open-ended questions with a view to obtaining the opinion of the respondents, using a predefined script to ask the experts about their personal experiences in the development of cloud projects, their perception of the threats and opportunities arising from the implementation of the cloud for
the Spanish public authorities, their view of the future for the coming years, and any recommendations which, in their personal experience, they might make to the industry. The list of experts can be found in Appendix II. 2.3 PHASE 3: SURVEY OF PUBLIC SECTOR ENTITIES
The purpose of the quantitative research phase is to obtain primary data to ascertain the degree of implementation of cloud computing-based systems in Spanish public authorities, bodies and entities, and how they are perceived. Based on this general aim, the survey has enabled the characterisation of other multiple factors of interest, such as the types of services implemented, the perceived risks and opportunities of this technology and the future prospects for use by the authorities consulted. The research process was regulated by the principle of information protection. Therefore, the contact details of the research units were treated with the utmost confidentiality, and the consulting team undertook to ensure strict observance of the privacy and confidentiality of any kind of information handled or generated in the course of the work. The anonymity and the protection of the information included in the questions are ensured pursuant to Organic Law 15/1999, of 13 December, on the Protection of Personal Data, and Royal Decree 1720/2007, of 21 December, approving the Regulations implementing Organic Law 15/1999, of 13 December, on the Protection of Personal Data The main features of the methodological design for the quantitative field study are summarised in the following subsections: 2.3.1 Survey population and subject of study
The population of the survey comprises the whole of the Spanish public sector: authorities, bodies, foundations, public entities, etc. throughout the State, irrespective of their territorial jurisdiction (local government, autonomous community or central government) or legal status. The profile of the professionals chosen for consultation was, in general terms, an official in charge of the IT or technology area. In those cases in which the bodies did not have an official with this kind of profile, the questionnaire was forwarded to key personnel in the decision-making process to hire service providers or officials coordinating the bodys IT requirements.
Page 20 of 178
Table 1: Survey population
Public sector entities Central government Autonomous community Local government Total
Number
470 2.19% 2,388 11.12% 18,608 86.69% 21,466 100.00%
Source: Inventory of State Public Sector bodies of the Ministry of Tax and Public Administration
2.3.2
Sample size and sampling distribution
A sample was taken of 500 Spanish public sector entities spread throughout Spain. Stratified sampling was used as the sampling method, the variable for subpopulation stratification being the territorial jurisdiction of the public authority, i.e. central government, autonomous community or local government. The sampling distribution of the study population is skewed, as there is a higher proportion of local authority entities than the other two subpopulations or stratum (see Table 1). If the initial sampling distribution had been used, sufficient variability would not have existed in the central government and autonomous community subpopulations to ensure that the data was sufficiently representative. Therefore, a minimum sample size was established in each subpopulation (105). Although the allocated sample size was proportionately higher than that which would have existed for the autonomous community and central government subpopulations had the distribution in the sampling population been applied, it ensured maximum variability in terms of responses and sample units.
Table 2: Sampling distribution
Sample 107 136 257 500
% 21.4% 27.2% 51.4% 100.0%

Source: INTECO
This design inevitably creates structural differences in terms of the total population, which need to be adjusted using a weighting factor. The weighting factor enables the proportionality of each subpopulation in the sample to be maintained in relation to the target population under study. In other words, the weighting
Page 21 of 178
factor changes the weighting of the various sample groups to ensure that they relate to the population groups. In this way, differences may be observed between the results calculated without the weighting factor, taken directly from the field work, and the results calculated once the real proportionality weighting factor of each group within the sampling population had been applied. In this case, the application of the weighting factor implies proportionately allocating more weight to the replies provided by local government entities and less to those of the autonomous community and central government entities, as there is a difference between the numbers of bodies of each type in the target population.
Figure 1: Weighting factor
N i
N t ni n t
Ni= number of bodies in each subgroup Nt= number of bodies in the sampling population ni= number of bodies in each subgroup of the sample nt= total number of bodies in the sample
Source: ONTSI 1
The population data used to prepare the weighting factor were obtained from information published by the Ministry of Tax and Public Administration, particularly the Inventory of State Bodies, the Inventory of Bodies dependent on Autonomous Communities and the Register of Local Government Entities. 2.3.3 Sampling error
Bearing in mind the aforementioned criteria and assuming a 95% confidence level, under the most unfavourable sampling conditions (=2, p=q=0.5), a sampling error for the global data of 4.3% is ensured. This level of error ensures the representativeness of the data and, as such, the quality of all the results obtained from subsequent statistical treatment of the data as the sampling error corresponding to each of the three subpopulations or stratum will always be under 10%.
The National Observatory of Telecommunications and the Information Society ("NOTIS") is a body attached to Red.es, the main mission of which is the study and analysis of the Information Society in Spain.
Page 22 of 178
Table 3: Sampling error
Sample 107 136 257 500
Sampling error 8.3 8.1 6.0 4.3

Source: INTECO
2.3.4
Survey method
The survey was conducted in November and December 2011. The survey technique used was Computer Assisted Telephone Interviewing (CATI). The interviews were conducted directly from a specialised call centre by a team of telephone operators with prior experience in telephone interviewing and adequate training in the area of study. This survey method was supplemented with e-mail and fax channels, used to forward the questionnaire to the survey respondents, and phone support for completing the questionnaire and facilitating receipt of effective answers. 2.3.5 Preparing the survey questionnaire and conducting pre-tests
The items and questions used in the questionnaire were designed to be multi-optional and quantitative. In some cases, open-ended options were included, generating qualitative data for specific analysis. Prior to conducting the survey, the questionnaire was pre-tested and improved using a random subsample of Spanish public bodies which met the requirements for inclusion in the target population. The respondents in this case were officials in charge of IT departments or heads of their related public authority or body. The pre-test was conducted on a small sample of respondents in charge of bodies in the various subpopulations of the sampling population for the purpose of obtaining opinions from all the profiles and analysing the greatest variety of situations possible for the survey. The aim of conducting a pre-test was to obtain a range of preliminary findings and/or methodological conclusions in relation to: The adequacy of the questions for the purposes of the research. The harmony and balance of the questionnaires structure and the layout of the various thematic sections. The order of the questions in each section.
Page 23 of 178
The length and rhythm of the interviews. The lack of relevant questions or the inclusion of redundant or repetitive questions. Model for data collection and use of information generated
2.3.6
The final database created on completion of the fieldwork and preliminary data processing (filtering, coding and validation) phases served as the starting point for its statistical analysis in order to obtain results which help to clarify all of the questions raised at the start of the research process. Excel spreadsheets and SPSS 19 statistical package were used to process and use the data collected. Data generated following the analysis process was summarised and presented using graphical models, simple statistical indicators which facilitate interpretation of the results and help draw hypotheses and conclusions. The main methods used for statistical representation of data were frequency charts and graphical representations.
Page 24 of 178
3
3.1
INTRODUCTION TO CLOUD COMPUTING

Description and characteristics
According to the official definition of the National Institute of Standards and Technology (NIST), cloud computing is model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction 2 . A complementary definition is offered by Berkeley Universitys RAD Lab 3 , which explains that cloud computing refers both to applications provided via the Internet, commonly known as Software as a Service or SaaS, and to the hardware and software of the datacentres providing the services, which is known as the cloud. Based on these definitions, it appears that cloud computing represents a significant change in how public entities and bodies process information and manage IT departments. Employing this paradigm allows organisations to change from traditional IT management (requiring large investments in resources, including hardware, software, data processing centres, networks, staff, security, etc.) to the cloud, the new IT management model (eliminating the need for large investments and overheads), transforming providers into tools offering users access to computing capacity, which is both flexible and instantaneous, on demand. A series of characteristics arise repeatedly when defining the differences between cloud computing and traditional IT models. In order to gain a better understanding of these characteristics and how they are used throughout this document, a brief description of the key concepts of cloud computing is provided below: Abstraction Capacity to isolate the IT resources hired from the provider from the information systems of the user deploying the services, ensuring completely transparent management (from the users point of view) thanks to the use of virtualisation. As a result, the client does not require staff to deal with infrastructure maintenance, system updates, testing procedures and other tasks associated with the hired service.
NIST (2011). The NIST Definition of Cloud Computing. Available at: http://csrc.nist.gov/publications/nistpubs/800145/SP800-145.pdf University of California at Berkeley (2009). Above the Clouds: A Berkeley View of Cloud Computing. Available at: http://www.eecs.berkeley.edu/Pubs/TechRpts/2009/EECS-2009-28.pdf
3
Page 25 of 178
Scalability Capacity to increase or decrease the functionalities offered to the client, scaled up or down to their immediate needs, without the need to process new agreements or impose penalties. This characteristic avoids the inherent risks arising from over- or underprovisioning of resources in terms of use or requirements. Pay-per-use This is an extension of scalability, whereby the cost of the related service is also scaled up or down based on the actual use of the solution. Therefore, the amount payable by the client varies depending on its usage of the cloud service hired. On-demand self service This characteristic enables users to access cloud computing capabilities automatically on an as-needed basis, without the need for human interaction with its cloud computing services provider 4 . Unlimited, multi-platform access This characteristic provides users with the possibility of accessing the cloud computing services hired from any location, at any time and using any terminal with an Internet connection. Cloud computing services are accessed via the Internet, implying that a wide range of different devices, i.e. smartphones, tablets or laptops, are able to access the same service offered on-line by means of standard access procedures. 3.2 CLASSIFICATION OF CLOUD COMPUTING SOLUTIONS
The different cloud computing solutions currently offered on the market can basically be classified on the basis of three characteristics: service level, deployment model and business model. These three characteristics, together with the various types of related solutions, may be represented schematically using a three-dimensional cube, as shown in Figure 2 below, which makes it possible to visualise the number of possible combinations.
Fundacin ideas (2011). Cloud Computing: Retos y Oportunidades (Cloud Computing: Challenges and Opportunities). Available at: http://www.fundacionideas.es/sites/default/files/pdf/DT-Cloud_Computing-Ec.pdf
Page 26 of 178
Figure 2: Classification of cloud computing solutions
Deploymentmodels
Source: prepared in-house
The three foregoing dimensions are combined to create the various types of cloud computing systems found on the market. Following is a detail of these models, and their main characteristics: 3.2.1 By service level
This classification refers to the type and level of abstraction of the solutions offered by the cloud provider. The main types of service model under this classification are: Infrastructure as a Service (IaaS). Platform as a Service (PaaS). Software as a Service (SaaS).
Servicelevels
Page 27 of 178
Infrastructure as a Service A cloud computing model offering computer infrastructure (processing capacity, disk space/storage capacity and databases, etc.) as a service. Users can, if they wish, deploy their own services in the traditional way using this infrastructure. Those users opting for this type of cloud model, rather than directly investing in resources such as servers, data centre space or network equipment, opt for outsourcing as a means of reducing the investment in IT systems. Under this outsourcing model, the invoices associated with this kind of service are calculated on the basis of the clients actual resource usage, i.e. based on the pay-peruse model. Platform as a Service A cloud computing suite offering, as a service, a combination of computing platforms for the development, testing, deployment, hosting and maintenance of the clients own operating systems and applications. In this case, the provider is responsible for infrastructure management, although the client is responsible for platform and application management. The main characteristics associated to the PaaS model as a cloud solution are as follows: Facilitates deployment of the users software, without the cost and complications involved in the purchase and management of hardware and the associated layers of software. Offers, on-line, all the resources required to create and deliver services and applications via web.
Software as a Service A cloud computing model offering, as a service, the use of applications in accordance with a software deployment model, whereby the provider offers users licences of its software for use as an on-demand service, thus releasing the user from the need to invest in infrastructure or platform management. Providers of SaaS services can host the application in their own web services (providing end-users with access, e.g. via a web browser), or run the software on the systems of the client hiring the service. In this case, the application would be deactivated when the service ends or the clients software license agreement expires.
Page 28 of 178
The SaaS cloud computing solution model may be orientated towards different kinds of clients depending on their status: 3.2.2 Private users (i.e.: office automation, social networks, Web 2.0, etc.). Professional users (i.e.: CRM 5 , ERP 6 , etc.). By deployment model
A classification by deployment model refers to the level and kind of pooling of the resources hired in the cloud with other users of a different or similar nature. The main types of deployment model observed in this classification are as follows: Public cloud. Private cloud. Hybrid cloud. Community cloud.
Figure 3: Type of cloud computing by deployment model
Public
Private
Hybrid
Community
Source: prepared in-house
Public cloud A feature of this type of deployment model is the delivery of virtualised computing services (databases, operating systems, development platforms, applications, etc.) by the service provider for diverse, multiple end users, accessing the services via the Internet or VPNs 7 . Following is a detail of some of characteristics inherent to this deployment model: Offers quicker service start-up.
5 6 7
Customer Relationship Management applications. Enterprise Resource Planning applications. Virtual Private Networks
Page 29 of 178
No capital investment required for deployment. Enables the outsourcing of all the companys basic functions to the cloud services provider. Allows for possible use of the service providers infrastructure, offering greater scalability and flexibility when changing service dimensions. Favours use of software packages. Gives rise to lower initial fees than the other deployment models. Public cloud costs vary widely in application of the pay-per-use principle. Corporate information is hosted in the public cloud together with that of the providers other clients. Since the data is not physically located on the clients premises and its availability is not uninterrupted, a series of strict requirements is imposed on the provider in terms of security and data protection.
Private cloud A feature of this type of deployment model is the delivery of environments, which may be implemented by the end user or hosted by a provider, and are used and controlled by the company hiring the service. This type of deployment may be managed internally, by the client, or externally, by the provider, and may be deployed on the premises of the former or the latter. Following is a detail of some of the characteristics inherent to this deployment model: Offers quicker service start-up and a high degree of flexibility in relation to resource allocation. Unlike the public cloud model, it requires capital investment in order to deploy the solution hired. Associated with local systems and databases. Allows advantage to be taken of existing staff and earlier investments in IT systems. Involves greater specificity in the solution hired, since it is designed to adapt to the individual needs of the company hiring the solution. Makes it possible to achieve full control over the infrastructure, the systems and the corporate information processed therein.
Page 30 of 178
Hybrid cloud A characteristic of this type of cloud deployment model is that it is composed of two or more clouds (private or public), which continue to be unique entities but are interconnected using standardised or proprietary technology and enable data and application portability (e.g. cloud bursting for load balancing between clouds). An entity implementing this type of solution could take advantage of the benefits associated with the type of cloud used for each of the services hired, as well as a series of additional features: Offers greater flexibility in the provision of IT services, while maintaining greater control over corporate services and data. As in the two preceding cases, a hybrid cloud solution offers quick service startup. Involves greater complexity in the integration of the cloud solution, since it comprises various types of deployment of cloud services. Allows the integration of the best features of the various types of cloud solutions, in relation to data control and management of basic corporate functions. Enables the selection, by the provider, of scalable, flexible infrastructure, delivering enhanced agility in solution resizing. Allows internal control of the cloud services from the clients premises.
Community cloud Community clouds are used by various organisations with common functions and services, thus enabling cooperation between interest groups. When analysing a community cloud it is necessary to consider that, in principle, its strengths and weaknesses lie between those of a private and a public cloud. In general, a community cloud offers a greater number of resources than a private cloud, with the obvious associated advantages in terms of flexibility. However, fewer resources are offered than in the case of a public cloud solution, since flexibility is more limited than in the case of a public model. On the other hand, this type of cloud deployment model has fewer users, allowing greater benefits in terms of security and privacy 8 .
ENISA (2011): Security & Resilience in Governmental Clouds. Available at: http://www.enisa.europa.eu/act/rm/emergingand-future-risk/deliverables/security-and-resilience-in-governmental-clouds
Page 31 of 178
3.2.3
By business model
A detail of the main existing business models would include the following: Provider: this business model consists of the provision of services to subscribers or intermediaries through the cloud, i.e. a service offered by the provider to the client, either directly or through an intermediary. The counterparty to the provider is the subscriber, who would be the user of the cloud services. Intermediary: this business model consists of the provision of services as intermediaries between the end users and the providers, in a dynamic supply and demand market such as that offered by cloud computing. Facilitator: this business model is generally focused on the cloud provider market. These companies sell software and hardware to third parties (providers) who then develop and offer users cloud services. Auditor: this business model is responsible for carrying out independent assessments of the cloud services, of the operations associated with the IT systems, of performance and of security when using the cloud solution. BENEFITS
3.3
Cloud services currently constitute one of the main options available to organisations for outsourcing their technology processes. This fact is motivated by the wide range of benefits offered by the cloud computing service model, as underlined by Deloitte in its report 9 : swift access to services; investment expenditure required and scalability of technical resources on demand. A detail of the main benefits which may be gained from adopting a cloud computing model is provided below. Benefits in terms of service start-up IT projects based on a physical infrastructure require a preliminary analysis to help achieve seamless interoperability across all the technological components in the system (hardware, software, communications, etc.). The scope of the aforementioned analysis may be reduced if a cloud-based option is chosen. Facilitating service start-up is achieved using a simple set-up and using the appropriate media to enable users to gain access. The benefits associated with service start-up relate to the following aspects:
Deloitte (2009): Cloud Computing. Forecasting Change. Available at: https://www.deloitte.com/assets/DcomGlobal/Local%20Assets/Documents/TMT/cloud_-_market_overview_and_perspective.pdf
Page 32 of 178
Immediacy: A qualified and productive service can be delivered very quickly without the need to invest excessive amounts of time in earlier stages. In this way unnecessary tasks can be avoided, such as undertaking a technology compatibility study or performing capacity tests.
Initial investment: It is not necessary to allocate any amount to the purchase of servers or the refurbishment of a possible data processing centre. Convenience: User may use the new service without the need to update their equipment or paralyse systems.
Offering: The success of cloud computing lies in the wide range of services delivered by providers, which include all kinds of solutions: financial management, communication systems, etc.
Economic benefits The adoption of cloud computing provides numerous economic benefits. An article in Forbes magazine 10 , quoted the economic benefits as the main reason for transferring to the cloud: Hire on-demand: The hiring entity pays solely for the use it makes of the service. Technical capacity may be extended directly in the cloud in response to an increase in the number of operations. Likewise, in periods of reduced activity the services hired may be downsized, minimising the amount payable to the provider. Dynamic provisioning 11 : It enables access to any information system simply via any computing device or Internet connection. Expenditure in technology infrastructure is not required in order to operate. Human resources: The provider is responsible for hiring specialised staff to manage technologies. As a result of future evolution to more advanced environments, the supplier will be in charge of training and hiring qualified employees on an ongoing basis in order to preserve contractual quality with its clients. Physical space: Allocation of physical space to a data processing centre is avoided. Nor is it necessary to invest in the adequate refurbishment of computer
10
Forbes (2011): The Economic Benefits of Cloud Computing. Available at: http://www.forbes.com/sites/kevinjackson/2011/09/17/the-economic-benefit-of-cloud-computing/
Forrester Research (2011): The ROI of Cloud Apps. Available on registration at: http://www.forrester.com/rb/Research/roi_of_cloud_apps/q/id/59277/t/2
11
Page 33 of 178
rooms (special fire extinguishing systems, physical security backups, industrial air conditioning systems, etc.). Power supply: Savings in electricity consumption costs due to the installation of uninterrupted power supplies, air conditioning, etc. The adoption of a Green IT mentality 12 will enhance corporate reputation while generating direct cost savings. Competitiveness among providers: The wide range of providers currently on the market is reflected in price competitiveness.
Ease of use and operation The cloud computing model enables full operability in a short period of time, with minimum resource requirements and simple management of technical requirements. The hiring body is solely a user of the service. The provider will be responsible for the other tasks associated with management and maintenance. Accessibility: In order to access a cloud service you just need a terminal and an Internet connection, enabling the user to connect from a computer located at home or from a Smartphone. Maintenance and management tasks: User management, including the performance of backup copies, can be provided with full transparency for the client entity. High availability: It is possible to hire the appropriate availability measures in terms of the criticality of the services hosted in the cloud, avoiding data and/or service loss. Duplication of high-level information is guaranteed by the provider. Common access to resources: Access to computer resources via the Internet allows concurrent access by multiple users and the possibility of sharing documents, which means improved productivity and performance. Updates: Application, operating system and database versions can be managed with a very small impact on user operations and avoiding the need to allocate additional resources for this type of activity. Ease of dispensing with the service: If the service hired is no longer required, the investment made would have related exclusively to the hiring of a service over a limited period of time.
Forbes (2011): Cloud Computing hidden Green Benefits. Available at: http://www.forbes.com/sites/joemckendrick/2011/10/03/cloud-computings-hidden-green-benefits/
12
Page 34 of 178
SPANISH AND INTERNATIONAL CLOUD COMPUTING
CONTEXT
OF
Cloud computing arose as a new alternative or model of technology services based on the optimisation of costs, efficiency and flexible access to technological resources by organisations, citizens and public entities. The implementation of cloud computing emerged in a context of a serious international economic recession, marked by the need to reduce costs and boost the competitiveness of businesses and public authorities through ICTs. The cloud dividend: Part One. The economic benefits of cloud computing to business and the wider EMEA economy. France, Germany, Italy, Spain and the UK study carried out in 2010 by the Centre for Economics and Business Research (CEBR), indicated that cloud computing may generate an economic impact by combining five main European economies (EUR 763,000 million) in the 2010-2015 period. This economic impact would be the combined result of a series of factors: the development and creation of new businesses, savings in operating costs, the direct or indirect creation of more than 2.3 million jobs in same period and multiplying effects in other sectors of the economy. Aware of this potential economic benefit and of the clouds numerous other advantages, European institutions have recognised the need to boost the development of the cloud computing market in the new European Digital Agenda 13 . To do so they adopted the directive for the development of a European Cloud Strategy, aimed at giving impetus to a common market of technology services, enabling Europe to compete in the international ICT market, in which North American companies currently have a strong foothold. This section of the report offers an overview, based on external sources, of the degree of cloud computing implementation at Spanish and international level and the main contextspecific factors influencing the deployment and evolution of this market in Spain. 4.1 INTERNATIONAL CLOUD COMPUTING CONTEXT
Global revenue from cloud services is expected to reach USD 55,500 millions by 2014 (IDC 14 ). Cloud computing will be the main driving force for development in the ICT industry and will condition the development scenario of numerous other economic sectors in the coming years.
13
European Digital Agenda (2011): Commission seeks views on how best to exploit cloud computing in Europe. Available at: http://europa.eu/rapid/pressReleasesAction.do?reference=IP/11/575 IDC (2010): Worldwide and Regional Public IT Cloud Services 2010-2014 Forecast.
14
Page 35 of 178
In a survey conducted by the consulting firm Avanade 15 at international level, 74% of all organisations were already using some kind of cloud service. The countries with the highest growth rates in cloud computing implementation in the 2009-2011 period were: Italy (89%), Canada (68%), France (43%), Germany (43%), Australia (31%) and the US (19%), although it should take into consideration that the level of maturity and implementation period for cloud technology in the US market is considerably greater. This survey also reported a 15% growth rate in Spain. The study conducted by Avanade referred to three issues of great interest which were contrasted with the Spanish situation: The adoption of private clouds is seen as the best alternative by the bodies under analysis. It should be borne in mind that Avanades sample mainly included large companies in the most important economic groups which have been committed to technological optimisation through virtualisation for many years and have the financial capacity to implement private cloud services. Although the level of development of public authorities is less advanced, it is considered that public entities could follow this trend, at least at central government and autonomous community level, and maximise the benefits to be obtained from cloud computing through the implementation of private clouds. The perceived lack of security and trust are the main risks and barriers reported by those bodies surveyed in all the studies conducted for the development of cloud computing migration projects. The main advantages perceived in the cloud are the cost savings and the flexibility delivered in relation to the adoption of technological resources. The development of cloud computing as a technology concept involved the consolidation of a series of earlier tendencies at international level, such as service hosting and technology infrastructure virtualisation. In 2011 Dynamic Markets published a survey targeting 1,616 CIOs in eight European countries (Germany, Spain, France, Italy, the Netherlands, Poland, UK and Russia). Following is a detail of some of the conclusions of the survey: 73% had virtualised a portion of their technical infrastructure and IT services. 79% of those who had adopted the cloud as a service model had adopted virtualisation solutions as an initial step.
15
Avanade (2011): Research & Insights: Global Survey: Has Cloud Computing Matured? Third Annual Report June 2011.
Page 36 of 178
Of those who had migrated solutions to the cloud, 56% had opted for storage services, 33% for computing resources and 27% for desktop services.
The applications most frequently migrated to the cloud are e-mail (61%) and office automation (45%).
On the other hand, public authorities worldwide are operating within a context of significant financial pressure and conversion with the aim of improving efficiency, productivity and cost control. Against this backdrop, the implementation of cloud computing is being examined as a possible means of optimisation which could lead to significant savings in technology costs. Gartner 16 , the consulting firm, published an article indicating the distribution by sector of public cloud solutions based on figures for 2010. Gartner concludes that public authorities, together with the finance industry, are the sectors that most clearly committed to the adoption of cloud computing as a technological alternative. Although the cloud computing market is currently enjoying a growth phase, it still needs time to mature, particularly in certain sectors and economies. Gartner undertook an analysis of cloud computing evolution and maturity, in an attempt to establish a timescale for the various stages of maturity, which revealed the following: From 2007 to 2011 it was at a stage of market development reserved for entrepreneurs/pioneers. The lack of maturity of the solutions led to investments in which time to market and productivity were more important than long-term technical viability. The technical virtues of the solutions took precedence over safeguarding the investment. From 2011 to 2013 a stage of market consolidation is being observed. The cloud computing infrastructure and platform markets will become very large, offering a wide range of solutions through large and small providers alike. Infrastructures will become more attractive and will increase the client base which to date comprised more reactive users. From 2013 to 2015 the cloud will undergo an offer and sector concentration process. The consolidated client base will expand the market and shift its efforts towards stability, reducing costs and safeguarding investments. Public authorities are leading this transformation at an international level, supporting expansion in this sector and, above all, undertaking investments and in-house projects which act as a driving force behind technological trends giving impetus to cloud-based in16
Gartner (2011): Forecast: Public Cloud Services, Worldwide and Regions, Industry Sectors, 2010-2015.
Page 37 of 178
house projects with a significant strategic impact: telework, interoperability between public authorities, open government, e-Government, medical records, etc. The considerable development of the US market positions American technology companies at the forefront of the cloud computing market, and is a threat to the sectors possibilities for competitiveness in Europe. The European Union, aware of this situation and committed to giving impetus to this market, has introduced specific directives and recommendations in the European Digital Agenda and in the 2011-2015 e-Government Action Plan to promote: Stimulation of the sector by public authorities and the creation of a regulatory framework to dispel any doubts as to the security of this market. Development of public-private partnership schemes and European technology standards. The 2012 European Cloud Computing Strategy, establishing the common guidelines for a common European market.
As a forerunner to the pan-European cloud initiatives, in a report published by the European Commission 17 , a panel of experts carried out a thorough initial diagnosis in order to build the new European cloud space. Two key issues raised in the report were as follows: That Europe must commit itself as a whole to the development of the cloud computing market, by drawing on its main competitive strengths in the technology industry: the maturity of the companies in the technology and telecommunications industries and the cohesion of its institutions, enabling the consolidation/development of common and open technological standards. Cloud computing must be one of the principal axes for fostering the economic and social development of the European Union. The cloud must provide the impetus for improvements in telecommunications networks, enhancing the competitiveness of EU companies, for building more open and efficient governments, for consolidating innovation, research and development networks in Europe and for improving social welfare and the quality of life through education, healthcare, and the Information Society. The European Commission underlines that EU member states need to overcome structural barriers: obsolete technological and communications infrastructures, failure to
17
Expert Group Report (2010): The Future of Cloud Computing.Oopportunities for European Cloud Computing beyond 2010.
Page 38 of 178
integrate the ICT industry, the competitive position currently held by the US market and, above all, the barrier created by confidence in and concerns about the security of the model. 4.2 SPANISH CLOUD COMPUTING CONTEXT
In accordance with a study carried out by IDC 18 , in 2012 18% of Spanish companies will be using software in cloud computing mode. The cloud computing industry could generate EUR 1,870 million in 2012. IDC indicates that 51% of Spanish organisations are acquainted with cloud computing, although only 15% actually use it. Although the process of its adoption by public authorities will follow this trend, significant increases are also expected in 2012. Irrespective of the figures shown by Spanish studies prepared to date in this connection, which make it impossible to obtain a precise idea of the degree of cloud deployment, the Spanish market is conditioned by a series of factors that forecast an opportunity for its future development, although certain barriers need to be overcome in the Spanish economy and institutional framework. According to the experts consulted and certain informed opinions 19 , the Spanish context for the development of cloud computing may be conditioned by the following issues: From the point of view of the sectors development in Spain, it is noteworthy that traditionally Spain has been a very attractive market for the implementation of IT development and service centres. The professional qualifications of Spains workforce, employment costs, Spains strategic positioning in the African and South American markets, as well as the efforts made by Spanish institutions to promote the sector, have made Spain a highly valued location for setting-up data processing centres. Spain has an effective legal framework for the protection of personal data, which guarantees the security of cloud technology deployment. The framework of the Organic Law on the Protection of Personal Data (LOPD), protects the development of the market with adequate guarantees, although certain issues in the area of international data transfer have yet to be finalised. The Spanish public authorities are pioneers in the assessment and promotion of the cloud model. The current environment of cost savings and optimisation means that the cloud has become a conductor for achieving efficiency and savings. The
IDC Espaa (2011) Cuando las empresas se rinden al Cloud (When companies embrace the Cloud). Sponsored by Microsoft Espaa EMC and Acens. Fundacin Bankinter (2010): Cloud Computing The Third Wave of Information Technologies. Available at: http://www.fundacionbankinter.org/system/documents/8156/original/XIII_FTF_CloudComputing.pdf.
19
18
Page 39 of 178
motivating effect of the public authorities will act as a driver in this sector, which will be able to take advantage of this impetus to develop cloud solutions and services in public/private partnership models. The Spanish ICT sector is firmly committed to the development of cloud computing. The main service providers in this sector are currently undergoing an important phase of business transformation, orientating their catalogues (hosting, licences, products, services, etc.) to cloud models offering greater cost efficiency to the market. In addition to the ICT sector, telecommunications operators are taking advantage of their commercial position, their service experience and, above all, their network of telecommunications infrastructures to position themselves in this sector. Important companies are investing significant amounts in order to operate in the cloud computing market and, according to the experts consulted, the traditional telephony, network or ADSL service offering will be expanded to include infrastructure services or IaaS- or SaaS-type applications for corporate and private users alike. Cloud computing in Spain (and in other economies) does not imply an aggressive transition to a new technology paradigm. Over the last decade, the concept of service and infrastructure virtualisation and technology externalisation models using hosting and outsourcing has become consolidated in Spain in both the public and private sectors, and in large and small companies. This situation means that the Spanish market enjoys a certain level of maturity and a base which ensures a more natural process of change management and cloud model adoption. In terms of the barriers that contextualise the development of the cloud computing sector in Spain, it is noteworthy that Spain (and Europe) needs to promote the implementation of more modern telecommunications infrastructures in order to guarantee the performance and proper functioning of the cloud computing networks, and to overcome the resistance to change and lack of confidence shown by large companies and public authorities alike, since their example will be key to cloud computings definitive roll-out in other sectors and types of companies. If we look at Spanish public authorities, the budgetary availability situation and the adjustments required in terms of spending and deficit have led public authorities to view cloud computing as a potential instrument to save costs and optimise technology. In this regard, the Central Government sources consulted informed that analyses and studies have been initiated at ministerial level to promote a shared-services platform, deployed using private cloud technology, which makes it possible to integrate and bring together the services common to all the authorities in shared-service infrastructures and centres.
This approach, which is as yet in the strategic analysis phase, assumes that the main saving and optimisation will be gained through the unification and concentration of common shared services for various public bodies (even considering the possibility of integrating autonomous community and local government authorities in the project) and that cloud computing is the technological instrument for implementing this model. The Central Governments expectations also contemplate the possibility of promoting this project through investment and public/private partnership models. An initiative of this size, if undertaken in the coming years, would undoubtedly have a parallel impact on the Spanish ICT industry, where it would fuel a scenario of real investment and development in the consolidation of services, technologies and experiences which can then be extended to other services and countries.
Page 41 of 178
REGULATORY FRAMEWORK
Among the public-based business models, cloud computing involves a series of legal considerations in terms of the confidentiality and security of the data managed and the conditions under which the providers deliver the service and apply information security and protection controls. In addition, cloud computing can also imply the storage of information in other countries in which the legal framework for data protection differs from that in Spain, in which case a series of specific conditioning factors need to be taken into consideration, as stipulated in the Spanish regulatory framework for the protection of personal data. In any event, despite the aforementioned implications, Spain has a legally binding framework that encompasses the development of the cloud computing market. The framework laid down in Organic Law 15/1999, of 13 December, on the Protection of Personal Data (LOPD) and Royal Decree 1720/2007, of 21 December, (RLOPD), establishes the necessary basic conditions to regulate the security and protection of personal data for Spain to be considered a secure legal environment for the deployment of cloud computing. Nevertheless, some experts would welcome the development of a specific Instruction in relation to cloud computing by the Spanish Data Protection Agency. Also, within a European context, the legal aspects of data protection are supported by Directive 95/46/EC 20 , which provides a common regulatory framework, as well as a group of European Commission decisions and communications, the opinions of the Article 20 Working Party 21 , and the reports and working documents of the European Network and Information Security Agency ("ENISA") 22 . In any event, it should be noted that there is a proposal of the European Commission for the adoption of a new EC Regulation in relation to data protection which, if ultimately approved by the European Parliament, would bring significant reforms in terms of personal data protection and would be directly applicable in all member states. 23 The existing regulatory context applicable to this sector is basically conditioned by the regulations detailed below, which are binding for public authorities (in their role as clients of cloud services) and for providers of cloud services in fulfilment of certain security and protection conditions on technological assets and files containing personal data.
Directive 95/46/EC of the European Parliament and of the Council, of 24 October 1995, on the protection of individuals with regard to the processing of personal data and on the free movement of such data. An advisory body on data protection comprising representatives from the EU member states data protection authorities. Further information at: http://ec.europa.eu/justice/policies/privacy/workinggroup/index_en.htm
22 23 21 20
Further information at: http://www.enisa.europa.eu/
For further information and follow-up of the reform process of European data protection legislation, see http://ec.europa.eu/justice/data-protection/index_en.htm
Page 42 of 178
5.1
REGULATORY FRAMEWORK FOR THE PROTECTION OF PERSONAL DATA
The LOPD and the RLOPD provide the legal and technical requirements applicable to the processing of data of a personal nature, and also establish, inter alia, the specific conditions and procedures for access thereto by external services providers. The Spanish Data Protection Agency (SDPA) 24 is the supervisory body responsible for ensuring compliance with these regulations throughout Spain 25 . Under current legislation, in whatever circumstance, both the entity hiring the services and the provider thereof must bear in mind that, if the data subject to management in the cloud is of a personal nature 26 (Article 3 of the LOPD and Article 5 of the RLOPD), the party responsible for processing the data 27 is previously obliged to fulfil a series of obligations under the LOPD and RLOPD: registration of files; responsibilities relating to the information obtained during data collection; consent in terms of data processing and, if required, disclosure; the quality of the data; protection of so-called ARCO rights (access, rectification, cancellation and objection); and the adoption of security measures. If the data subject to management in the cloud is not of a personal nature, the conventional provisions in relation to the confidentiality of information need to be applied rather than the rules and obligations provided in the LOPD and RLOPD. It should be borne in mind that the definition of data of a personal nature provided under data protection legislation and the interpretation given to it by the SDPA is fairly broad. Accordingly, it will be understood that the data processed in the cloud are not of a personal nature when the data do not enable, advertently or inadvertently, the identification of the owner thereof, or this would involve a disproportionate amount of effort. Access to cloud computing services by an entity, whether it is a company regulated by private law or a public authority, will generally be considered a provision of services, and will be regulated by the related agreement. Accordingly, we need to consider the figure of the processor 28 .
24 25
Further information at: https://www.agpd.es/
There are various other Data Protection Agencies of an autonomous community nature, in the Regional Government of Madrid, Catalonia and the Basque Country, with responsibility in terms of data processing carried out by the public authorities with their headquarters in each of the aforementioned territories, respectively.
26
Definition of data of a personal nature: any information concerning identified or identifiable natural persons (Article 3 of the LOPD); any alphanumeric, graphic, photographic, acoustic or any other type of information pertaining to identified or identifiable natural persons (Article 5 of the RLOPD).
Processor: the natural or legal person, public authority, which determines the purpose, content and use of the processing (Article 3 of the LOPD).
28
27
Processor: the natural or legal person, public authority, service or any other body which alone or jointly with others processes personal data on behalf of the controller (Article 3 of the LOPD).
Page 43 of 178
Accordingly, when in the context of the provision of services by a provider to the party responsible for a file, the provider is required to access the personal data of the responsible party, whereby such access is necessary to provide the services subject to the legal relationship established between the two parties, it shall be deemed that there is no communication or assignment of personal data, but rather a so-called commission to process the personal data or to access the data on behalf of third parties. 5.1.1 Cloud computing services delivered to a Spanish public entity by a service provider located in Spain The provision of cloud computing services by a service provider located in Spain to a Spanish authority will be regulated by that provided in Article 12 of the LOPD and Articles 20 and 22 of the RLOPD. In particular, access to Central Government data by a cloud service provider located in Spain will necessarily be regulated in an agreement pursuant to Article 12 of the LOPD. The agreement shall be in writing (or any other format that provides proof of its execution and content), it being expressly laid down that the processor shall process the data only in accordance with the instructions of the entity responsible for the file (controller), shall not apply or use them for a purpose other than that set out in the aforementioned agreement, and shall not disclose them to other persons. The agreement should also set out the security measures 29 for data of a personal nature which the service provider is obliged to implement, on the basis of the nature of the data to which it has access, taking special care when processing data deemed to be particularly sensitive 30 . Also, once the agreed service has been provided, the personal data shall necessarily be destroyed or returned to the data controller, together with any media or documents containing any processed data of a personal nature. 31 Furthermore, Article 21 of the RLOPD regulates the possibility of the data processor subcontracting the services commissioned thereto and, therefore, provides that subcontracting may be performed provided that the data processor has received due
Also, it shall guarantee that the software used by the data processor meets the appropriate security measures for the level of security of the data, pursuant to the Sole Additional Provision of the RLOPD. In any case, nothing stops the provider from complying to other security standards, such as ISO standards, provided that the requirements under Title VIII of the RLOPD are met. Although to date the SDPA has not issued an instruction or a recommendation in terms of cloud computing, some of its members have established certain recommendations in various forums which may be considered as an enabling framework when assessing the legal conditions and risks assumed when integrating cloud-based solutions. See, for example, the paper given by Mara Jos Blanco Antn, Deputy Director of the General Data Protection Registry, in January 2011 during the seminars held by SOCINFO (further information at http://www.socinfo.es/contenido/seminarios/virtual3/aepd.pdf). Also the SDPA, at its IV Annual Open Session held in January 2012, addressed the specific issue of the various ways of hiring cloud computing services at public authorities (http://www.agpd.es/portalwebAGPD/jornadas/4_sesion_abierta_2011/common/Preguntas_cloud_computing.pdf). In December 2011 and January 2012 the SDPA public consultation/enquiry to gain the opinion and record the experiences of service providers, users and experts in cloud computing (https://www.agpd.es/portalwebAGPD/revista_prensa/revista_prensa/2011/notas_prensa/common/diciembre/111228_NP_C onsulta_Computacion_en_Nube.pdf ).
31 30 29
Page 44 of 178
authorisation from the data controller, in which case the subcontracting will always be done in the name and on behalf of the data controller 32 . Notwithstanding the foregoing, the aforementioned Article 21.2 of the RLOPD provides that subcontracting without authorisation will be possible provided that the following requirements are met: The agreement between the data controller and the party responsible for processing services specifies which services may be subject to subcontracting and, where possible, the company to which they shall be subcontracted. When the subcontracted company is not identified in the agreement, the data processor shall inform the data controller of the subcontracted companys identifying data before proceeding with the subcontracting. The subcontractor processes the personal data following the instructions of the data controller. The data processor and the subcontracted company enter into the agreement, under the terms provided in Article 12 of the LOPD.
Additional Provision 26 of Legislative Royal Decree 3/2011, of 14 November, approving the Consolidated Public Sector Procurement Law ("TRLCSP"), includes the considerations set out above in terms of access to data on behalf of third parties within the framework of the provision of services to a public authority. 5.1.2 Cloud computing services delivered to a Spanish public entity by a service provider located outside Spain The cloud computing market is global. It is generally the case that the data is located outside Spain and even in several different countries which may not provide a level of data protection in line with that currently provided in Spain. Article 33 and Article 34 of Title V of the LOPD and Title VI of the RLOPD, respectively, respond to the question raised in those situations when data is processed by service providers located outside the Spanish territory. International data transfer is defined as data processing which implies the transfer thereof outside the European Economic Area ("EEA"), constituting either an assignment or communication of data, or for the purpose of processing data on behalf of the data controller located in Spain. In this case, the legal scenario differs slightly on the basis of the country in which the provider of the cloud computing services is located:
32
The SDPA is currently working on the preparation of a framework agreement for subcontracting the data processing service, which should be fulfilled when the provider initially contracted is located in Spain but the subcontractor is located outside Spain.
Page 45 of 178
If the provider is located in a country outside the EEA or provides a level of data protection equivalent to that in force in Spain 33 , the provisions of the agreement in terms of data protection to be entered into between the data file controller and the service provider shall comply with that provided in Article 12 of the LOPD and in Article 21 of the RLOPD in terms of subcontracting, in accordance with that detailed in the preceding section.
In the case of providers located outside the EEA in jurisdictions failing to offer an equivalent level of data protection, as a general rule they shall obtain express authorisation from the Director of the SDPA 34 (except in those cases specifically provided for in Article 34 of the LOPD 35 ) and execute an international data transfer agreement drafted pursuant to the clauses of the Decision of the European Commission 2010/87/EU, of 5 February 2010, for the transfer of personal data to processors established in third-party countries, pursuant to Directive 95/46/EC 36 . When the International data transfer agreement is pursuant to the provisions of the model standard contractual clauses established by European Commission Decision 2010/87/EU, Article 70.2 of the RDLOPD states that adequate guarantees shall be deemed established. 37
Notwithstanding the foregoing, it should not be forgotten that certain standards of other jurisdictions with extraterritorial vocation might confer on a foreign authority the possibility of accessing information owned by a Spanish data processor located within its territory (e.g. the US Patriot Act, which legitimates the US Governments right to inspect, in the interest of national security and the fight against terrorism, any file located in US territory or owned by a US company). This circumstance could imply a violation of Spanish data protection legislation and may be particularly sensitive when the data to be exported is owned by a public authority. This issue should therefore be taken into consideration when hiring cloud computing services.
Andorra, Argentina, Australia, Canada, Switzerland, Pharaoh Islands, Guernsey, Isle of Man, Israel, Jersey and the US (Safe Harbour and PNR).
34 35
33
Procedure envisaged in Title IX, Chapter V, Section One of the RLOPD.
For example, when the consent of the interested party has been given, when the international transfer of personal data is the result of applying treaties or agreements to which Spain is a party, when the transfer serves the purpose of offering or requesting international judicial aid and whenever it is deemed necessary for medical prevention or diagnosis, etc. The security measures to be adopted under the aforementioned agreement will be those provided in Title VIII of the RLOPD. In addition, that provided in Instruction 1/2000, of 1 December, of the SDPA, relating to the standards regulating the international movements of data, should be considered. In this respect, the considerations issued by Article 29 Working Party, in the document of 12 July 2010, are of interest with regard to the FAQs in relation to the entry into force of European Commission Decision 2010/87/EU. Of particular interest is the fact that the aforementioned clauses may not be used when the data processor is located in the EEA or a country which provides an equivalent level of data protection, even when the data processing service is subsequently subcontracted to a provider located outside the EEA in a country not providing an equivalent level of data protection. For further information, see http://ec.europa.eu/justice/policies/privacy/docs/wpdocs/2010/wp176_en.pdf
37 36
Page 46 of 178
5.1.3
Special cases in terms of access to administrative information by citizens
Although the LOPD and the RLOPD are fully applicable to the processing of personal data by public authorities, a series of special cases arise in relation to the administrative legislation which need to be taken into consideration when analysing access to information held by public authorities. Article 105-b) of the Spanish Constitution recognises the possibility that citizens have right of access to the information contained in the administrative files and registers, indicating that the law will regulate the scope of this access, except when it affects the security and defence of the State, criminal investigations and the privacy of individuals. 38 This principle of public transparency can be summarised as the right held by all citizens to access the records and documents which, forming part of administrative proceedings, are found in administrative files, whatever the mode or form of expression or media used. However, there are a series of limits to the general rule (Article 37 of Public Authorities and Common Administrative Procedure Law 30/1992, of 26 November): Access to documents containing data relating to the privacy of individuals will be reserved to those individuals, and in those cases in which the data is included in proceedings in exercise of the law -except in the case of penalisation and disciplinary proceedings- and which, in view of their content, may be enforced for the exercise of the citizens rights, it may also be exercised, not only by the owner of the data, but by third parties demonstrating a direct, legitimate interest. The exercise of the aforementioned rights of access may be denied when reasons of public interest prevail, when third-party interests more worthy of protection prevail or when thus provided for by the Law, in which case the competent body will issue a reasoned decision. Documents containing personal data of a police, procedural or clinical nature or of any other kind which may affect the security, honour, privacy or personal image of the individual, may not be consulted publically without the express consent of the person concerned or until 24 years have passed following their death, if the date is known, or otherwise, until 50 years have passed since the date of the documents. The right of access may not be exercised in relation to files containing information on the actions of the Spanish Government or of the Regional Governments, in the
Recently, various initiatives have been heard in Parliament for the enactment of a law to regulate access to public information by citizens. At present a Draft Law for Transparency and Access to Public Information is being processed, which aims to regulate citizens access, preferably by electronic means, to public information contained in administrative files and registers, pursuant to Article 105-b) of the Spanish Constitution, in order to guarantee the transparency of the public authorities activity. It is advisable that the progress of these legislative initiatives be monitored in view of the impact they might have in relation to the information that public authorities are required to place at the disposal of its citizens and their implications in the hiring of cloud services.
38
Page 47 of 178
exercise of their constitutional powers not subject to Administrative Law; files containing information on the National Defence or State Security; those files processed to investigate crimes when they might jeopardise the rights and freedoms of third parties or the requirements of investigations underway; files in relation to those issues protected by commercial and industrial secrecy; files in relation to administrative proceedings arising from monetary policy. As a result, when the Government hires a cloud computing services provider, it should ensure, on the one hand, that the citizens are able to exercise the right of access to the information contained in public archives pursuant to Law 30/1992 and, on the other, that classified or restricted information is protected through the implementation of the appropriate security and restriction measures. 5.2 REGULATORY FRAMEWORK OF THE LAW ON INFORMATION SOCIETY SERVICES Law 34/2002, of 11 July, on Information Society Services and E-Commerce (LSSI), is the regulatory framework in terms of information society services and e-commerce. Thus, insofar as the hiring of cloud computing services is carried out by electronic means, it would be necessary to meet the obligations contained in the LSSI. However, given the special nature of public authorities and that the hiring of services thereby is subject to specific mandatory/binding legislation, we understand that the hiring of cloud computing services by public authorities will be subject to the conditions and the procedure established in the aforementioned legislation, as analysed below. 5.3 REGULATORY FRAMEWORK IN PUBLIC SECTOR PROCUREMENT MATTERS
Legislative Royal Decree 3/2011, of 14 November, approving the Consolidated Public Sector Procurement Law (TRLCSP) regulates the procurement procedures of the Spanish public authorities, which, inter alia, cloud-based contracts will have to adhere to. Accordingly, the administrative specifications and the contract document entered into by the authority and the provider of cloud services will provide the basis on which their relationship should be governed. The agreements entered into with cloud computing services providers will, in general, be deemed service contacts, pursuant to Article 10 of the TRLCSP, it being possible to appoint someone as the person responsible for the agreement, as provided in Article 52 of the aforementioned law. The contracting procedure will be that provided in the TRLSCP, which under its Additional Provision One establishes certain particularities in relation to hiring overseas.
Page 48 of 178
The minimum content of the agreement, as well as the other conditions it is required to fulfil, the prohibitions on contracting and the restrictions in terms of aptitude, solvency, duration and other applicable circumstances, are provided in the aforementioned Law. Although the TRLCSP provides a collection of alternatives and instruments for contracting, cloud computing-based services models require greater flexibility and dynamism in terms of demand management and the Spanish public authorities should use these alternatives to adapt them to this type of service. Features such as pay-per-use or the dynamic resizing of demand by means of flexible agreements are not easy to encompass within the framework of the TRLSCP, and this situation requires many public authorities to undertake an exercise of tender specification adaptation and of change management with control and audit units to find formulae which enable public authorities to hire and take advantage of the benefits and opportunities of the cloud in the public sector. 5.4 REGULATORY FRAMEWORK FOR THE NATIONAL SECURITY FRAMEWORK AND THE NATIONAL INTEROPERABILITY FRAMEWORK Royal Decree 3/2010, of 8 January, regulating the National Security Framework in the field of e-Government and Royal Decree 4/2010, of 8 January, regulating the National Interoperability Framework, are applicable to security matters and interoperability standards in the field of public authorities. Both decrees include provisions in relation to the standards and procedures applicable in the field of security and interoperability in public authorities, provisions that cloud computing providers are required to provide and, in many cases, implement and manage when providing services to public bodies. 5.5 REGULATORY FRAMEWORK IN INTELLECTUAL PROPERTY MATTERS
Another issue that should be given special consideration in the field of cloud computing is the appropriate definition, under the provision of services agreement, of the ownership of the developments, creations and other benefits which might have associated inviolable rights to which access is gained or are developed within the framework of the provision of cloud computing services. The principle set out in Article 43 of the Consolidated Intellectual Property Law in force, approved by Legislative Royal Decree 1/1996 ("LPI"), is that intellectual property rights are freely assigned or transferred and will have the scope agreed by the parties in the agreement, the assignment being limited to the right or rights assigned, the forms of operation expressly provided for and at the time and in the territory established. In those cases where the time and the territory are not established, the time limit of the assignment will be five years and the territory will be the country where the assignment is carried out.
Page 49 of 178
In addition, if the type of operation is not specifically and expressly foreseen, the assignment will be limited to the method deduced from the contract deemed necessary and indispensable in order to fulfil the purpose thereof. In relation to the developments that might be undertaken by the provider within the context of the provision of its cloud services to the public authorities, Article 301.2 of the TRLSCP which, unless provided otherwise in the administrative clause specifications or in the contract, those service agreements for the development and delivery of products protected by an intellectual property right will include the assignment thereof to the contracting public authority. In any event, even when the assignment of intellectual property rights is excluded, the contracting body may always authorise the use of the related product to the bodies and entities in the public sector. 5.6 REGULATORY FRAMEWORK IN CRIMINAL MATTERS
In the Internet environment, and more specifically in relation to cloud computing services, many types of criminal behaviour can arise, which is further propagated by the alleged ease with which the criminals can avoid detection and remain anonymous, not to mention the skill with which certain individuals take advantage of weaknesses and breakdowns in information system security in an environment where thousands of transactions occur simultaneously. The Spanish Criminal Code provides for certain offences such as the revelation of secrets (Article 197), or electronic fraud, which require service providers to implement the appropriate security measures to create a reliable environment which fosters hiring and trust.
Page 50 of 178
RISK ASSOCIATED WITH CLOUD COMPUTING
The need to meet users demands may on occasion prevent adequate management of the risks that might hinder your business activities. Therefore, identification of the risks in relation to cloud computing is highly recommended. The main disadvantage observed is the lack of control and supervision on the part of the entity hiring the services, as the system is hosted in the cloud. A detail of the main risks associated with the adoption of cloud computing services is provided below. 6.1 LEGAL AND CONTRACTUAL RISKS
A common framework for action is required both for the client (in this case, the Government) and the cloud services provider which is in compliance with the law and delimits and defines, inter alia, responsibilities, communication channels and possible penalties on breach of contract. A summary of the main risks of a legal and contractual nature that need to be taken into consideration in relation to cloud computing is as follows: Data protection: The parties should enter into an agreement drafted pursuant to Article 12 of the LOPD, if the cloud service provider is located in Spain or in a country providing an equivalent level of data protection to that currently provided in Spain. Otherwise, the contract should be drawn up in line with the clauses set out in European Commission Decision 2010/87/EU, of 5 February 2010. In any event, the security measures the provider is required to apply are those provided in Title VIII of the RLOPD. The administrative penalties set out in data protection legislation in the event of a breach can amount to EUR 600,000. Access to government information by citizens: The provider will be required to guarantee that citizens may exercise their right to access public information and implement the appropriate security and, where necessary, restriction measures. Ownership of rights: Those issues relating to the intellectual property of the developments, creations and other benefits which might have associated inviolable rights to which access is gained or are developed by the provider should be expressly regulated in the agreement. Delocalisation of the information: The hiring entity is required to know the exact location of the data, as well as the possible involvement of subcontractors in the provision of the services.
Page 51 of 178
Provider dependence: Hiring a cloud computing service without having studied future interoperability with other providers could give rise to serious drawbacks for the public authority when hosting or migrating the services directly to another provider of better characteristics and, for this reason, these issues should be appropriately provided for in the agreement. The application of penalties to the provider may also be foreseen in the agreement in the event of failure to comply with its obligations in terms of interoperability.
Unavailability of the service: It is essential that both the public authority and, where applicable, those governed by it are able to access the service on an asneeded basis. Otherwise, the image and/or productivity of the public authority could be affected by the inability to provide its normal service. Therefore, it is necessary to properly define permissible downtime and acceptable information loss by means of a Service Level Agreement (SLA) with the provider, which provides consistent availability rates and appropriate compensatory measures in the event of non-compliance.
Reporting of serious security incidents: The provider is responsible for security maintenance and management. In the event of unauthorised access to the data processing centre or a hacker attack, the quality of the service may be affected. The provider should manage these events in a timely manner and report them immediately to the public authority to enable it to take any measures it deems necessary. Providers refusal to be audited: In spite of the trust the public authority hiring the service might have in the provider, the qualities agreed upon should be evaluated by means of an audit. In certain cases, the provider may refuse to be audited. When a situation of this kind arises it may be useful to request formal auditors reports (ISAE 3402) 39 or certifications (ISO 27001) 40 which guarantee the appropriate level of quality.
6.2
TECHNICAL RISKS
The confidence that a user may place in a cloud computing service depends directly on all the other actions performed by the provider. Even though a service offers good characteristics from a functional point of view, the technical risks also need to be considered. Inappropriate sizing: The determination of the resources required to enable users to gain access normally should be taken into consideration at all times. In
39 40
For further information: http://isae3402.com/ISAE3402_overview.html Standard for Information security management systems. For further information: http://www.iso27000.es/
Page 52 of 178
the event that a certain stage is deemed to be more demanding, e.g. concurrent access by multiple users, the provider should be notified in order to resize the service appropriately. Resource pooling: The providers systems may be pooled by various clients. Appropriate security controls need to be implemented to ensure that users are not able to access third-party data. Insecure communications: Internet provides the main channel for a user to gain access to a cloud computing service. In particular, the provider must ensure that all communications are properly encoded. Abuse of privileges: The providers administrators are going to have full privileges over the outsourced service. It should be possible to monitor or trace all the actions that may be performed by the power users. Distributed denial-of-service (DDoS) 41 : The companies providing cloud services may be subject to external attacks and cyber delinquency. One of the most common attacks is denial of service, preventing users from accessing the system. Incomplete deletion of information: The provider is required to guarantee complete deletion of the data treated by users in its systems. This agreement should be formalised in a contract and conclude with the presentation of the relevant destruction or deletion certificates.
41
Cloud Computing Journal (2011): Denial of Service. Attacks and the Cloud. Available at: http://cloudcomputing.syscon.com/node/1747821
Page 53 of 178
KNOWLEDGE AND USE OF CLOUD COMPUTING IN THE SPANISH PUBLIC SECTOR

KNOWLEDGE OF CLOUD COMPUTING
7.1
First of all, it is necessary to assess the level of familiarity with the term cloud computing shown by the Spanish public sector entities. To this end, this chapter focuses on discovering the level of knowledge held by those responsible for technology in Spanish public authorities in terms of cloud computing technology, describing the main information channels through which this knowledge was gained, and detailing which of the cloud technologies are most widely known. In recent years, Spains economic model and positioning with regard to new technologies has undergone a transformation. Nevertheless, only 56.2% of respondents declared that they were familiar, to a greater or lesser extent, with the cloud computing concept (15.6% stated they have an in-depth knowledge of it, whereas 40.6% stated that although they have heard of it they do not master this subject). However, 43.8% of the entities confirmed that they were unfamiliar with cloud computing.
Chart 1: Knowledge of cloud computing technology (%)
15.6%
43.8%
40.6%
Yes, familiar and has in-depth knowledge
Yes, familiar but has superficial knowledge
Unaware of cloud computing
Basis: total number of public entities contacted (n=889)
Source: INTECO
The competencies of the public service entities vary depending on their territorial jurisdiction. The public authorities at state level manage larger budgets and implement farther-reaching networks and technology, requiring greater training and knowledge of the industry, which should, therefore, imply a greater knowledge of cloud computing technology.
This circumstance was confirmed by the analysis by territorial jurisdiction, which indicated that 91.5% of the central government authorities are familiar with cloud computing technology (to a greater or lesser extent), as compared to 75.5% and 43.4% of the autonomous community and local government authorities, respectively. In addition to having a better general understanding, the central government authorities also appear to have more in-depth knowledge than their autonomous community and local government authority counterparts. In fact, 53% of the central government authorities indicated that they had an in-depth understanding (as compared to 38.5% which stated that they had a superficial understanding of cloud computing), while only 20% and 11.8%, of the authorities at autonomous community and local level, respectively, considered that they had an in-depth understanding of cloud computing. A much greater proportion of autonomous community and local authorities confirmed that they had only a superficial knowledge of the cloud: 55.5% and 31.6%, respectively.
Chart 2: Knowledge of cloud computing technology, by territorial jurisdiction of the public entity (%)
100% 8.5% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Local government Unaware of cloud computing Autonomous community Central government Yes, familiar and has in-depth knowledge Yes, familiar but has superficial knowledge 11.8% 20.0% 31.6% 53.0% 55.5% 56.6% 38.5% 24.4%
Basis: total number public entities (Local govt. n=593, Auton. com. n=179, Central govt. n=117) Source: INTECO
This initial indicator provided the filter for conducting the questionnaire. Accordingly, the survey data is based on the replies of those public authorities with a more or less thorough understanding of cloud computing technology. As a result, 43.8% of the public authorities were excluded from the analysis since they confirmed that they had no knowledge of the cloud.
Page 55 of 178
7.1.1
Information channels about cloud computing
The Internet and specialised media technology (in both digital and traditional format) are currently the most popular media for training in and gaining an understanding of cloud computing. These channels were the means by which a large majority of the public authorities gained knowledge of cloud technology. More specifically, 36.4% of the entities became aware of cloud technology through the Internet and a further 34.6% through other specialised media. Commercial forces and the exchange of knowledge with other professionals in this sector are also important channels, providing knowledge in 20% and 18.7% of the cases, respectively. Only 11.4% of the authorities surveyed claimed that they discovered cloud computing through public initiatives.
Chart 3: Information channels used to discover cloud computing (%)
40% 35% 30% 25% 20.0% 20% 15% 10% 5% 0.0% 0% Internet Specialised media Private business channels Sector professionals Public initiatives Other N/A 3.5% 18.7% 24.1% 34.6%
11.4%
Basis: Total public entities (n=500)
Source: INTECO
Observing a breakdown of the results obtained segmented by territorial jurisdiction of the public entity, differences can be seen in the information sources used in each case: the Internet continued to be the main information channel for local government authorities mentioned by 37.4% of respondents. The same cannot be said for autonomous community authorities, where the information channels most frequently used were the specialised media, mentioned by 48.5% of respondents. In the case of central government authorities, more intensive use of specialised information channels was observed (71% mentioned private business channels and 54.2% use industry media channels), to the detriment of more general media such as the Internet (only 16.3% of the central government authorities use the Internet). This may be
explained by the higher budgets available to central government authorities, a circumstance which has in turn resulted in greater commercial interest on the part of providers offering solutions based on the cloud computing model.
Chart 4: Information channels used to discover cloud computing, by territorial jurisdiction of the public entity (%)
80% 71.0% 70% 60% 50% 40% 30% 20% 10% 0% Local government Internet Sector professionals Autonomous community Specialised media Public initiatives Central government Private business channels Other 37.4% 32.3% 24.9% 21.1% 16.3%16.3% 10.9% 13.2% 16.3% 10.8% 20.6% 31.8% 48.5% 38.2% 33.1% 40.2%
54.2%
Basis: Total public entities (Local govt. n=257, Auton. com. n=136, Central govt. n=107)
Source: INTECO
7.1.2
Cloud computing technologies known
Following the analysis of a more general knowledge of the cloud computing concept in Chart 1, this section offers a more in-depth analysis of the specific knowledge held of its more representative products and technologies. The conclusion reached is that those responsible for technology in Spanish public authorities have a sound knowledge of cloud technologies. In this regard, of those responsible for IT, 68.4% and 68.8% identified third-party server virtualisation and HR applications as a service, respectively, as the cloud computingrelated technologies which they know best. An acceptable level of knowledge was also shown of the housing of services in third-party servers (62.5%) and the housing of servers (54.1%).
Page 57 of 178
Chart 5: Types of cloud computing technologies known (%)
80% 70% 60% 50% 40% 30% 20% 10% 0% Applications used as a service Third-party server virtualisation Housing of services on third-party servers Housing of servers in third-party facilities 68.8% 68.4% 62.5% 54.1%
Source: INTECO
In terms of type of entity, central government entities demonstrate a greater knowledge of cloud computing-based technologies than their autonomous community or local government, recording significantly high levels of knowledge of each technology.
Chart 6: Types of cloud computing technologies known, by territorial jurisdiction of the public entity (%)
100% 90% 80% 70% 60.7% 60% 50.6% 50% 40% 30% 20% 10% 0% Local government Applications used as a service 66.5%66.5% 71.3% 77.2% 80.9% 73.5% 86.9%
95.3%95.3% 94.4%
Autonomous community Central government Third-party server virtualisation Housing of servers in third-party facilities
Housing of services on third-party servers
Source: INTECO
Page 58 of 178
7.2
ADOPTION OF CLOUD COMPUTING
In general terms, use of cloud computing solutions by Spanish public authorities is still limited. Just 33.4% of the authorities used an ICT service in cloud computing mode. The remaining 66.6% have yet to decide to include a service with these characteristics in their systems map.
Chart 7: Use of cloud computing solutions (%)
33.4%
66.6%
Yes
No
Source: INTECO
Local government authorities showed greater willingness to incorporate solutions in cloud computing format (34.2%). The limited financial capacity and resources of many local government entities, together with the development of cloud-based solutions and applications for municipal bodies by higher-level authorities or by the Spanish ICT industry itself, may help to explain these findings. The infrastructures and applications offered by higher-level authorities (autonomous community or central government) to Spanish local government entities in recent years, through schemes such as Avanza Local, mean that many Spanish municipal councils now have a significant volume of ICT services and applications provided remotely running in service mode. The level of cloud technology adoption among autonomous community authorities was 28.7% and 23.4% in the case of central government entities.
Page 59 of 178
Chart 8: Use of cloud computing solutions, by territorial jurisdiction of the public entity (%)
40% 35% 30% 25% 20% 15% 10% 5% 0% Local government Autonomous community Central government 34.2% 28.7% 23.4%
Source: INTECO
Another issue of interest is the period of time over which cloud services and applications have been used by those public authorities classifying themselves as users. The adoption of cloud computing by Spanish public entities is a fairly recent phenomenon: 51.2% have adopted it within the last one to three years and a further 14.2% within the last twelve months. Only 33.6% of the Spanish public sector entities have been working with the cloud for more than three years.
Chart 9: Period of cloud computing usage (%)
1.0% 14.2%
33.6%
51.2%
Less than 12 months
From 1 to 3 years
More than 3 years
N/A
Basis: public entities using cloud computing (n=152)

Source: INTECO
Page 60 of 178
An analysis segmented by territorial jurisdiction reveals that local public authorities pioneered the adoption of cloud computing: 34.1% already used cloud technology more than three years ago (as compared to 30.8% in the case of autonomous communities and just 24% in the case of central government).
Chart 10: Period of cloud computing usage, by territorial jurisdiction of the public entity (%)
100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Local government Less than 12 months Autonomous community From 1 to 3 years Central government 13.6% 17.9% 24.0% 51.3% 51.1% 52.0% 34.1% 30.8% 24.0%
More than 3 years
Basis: public entities using cloud computing (Local govt. n=88, Auton. com. n=39, Central govt. n=25) Source: INTECO
7.2.1
Characterisation of services and platforms
This section develops the analysis and characterisation of the cloud computing services used by the Spanish public authorities, by taking into consideration the areas targeted for use of cloud solutions, the types of deployment models and the specific products used. Areas within public bodies targeted for cloud computing The integration of cloud computing in Spanish public bodies has an uneven impact on the various areas within them. The value provided by any cloud computing solution is conditioned by the administrative/business process in which it is implemented. Services to citizens and e-Government are the areas in which public authorities are making the biggest efforts to adapt to cloud, with 53.2% of the entities allocating the cloud computing solutions adapted to these areas. Administrative management of dossiers (mentioned by 41.4%) and budget and finance management (mentioned by 32.5%) are other areas where public authorities are adopting cloud solutions.
Page 61 of 178
Chart 11: Areas involved in cloud computing implementation (%)

Services to citizens and e-Government Administrative management of dossiers (authorisations, etc.) Budget and finance management Open government and citizen participation System management and operation Relations with companies and suppliers HR management Other service 0% 10% 15.7% 11.1% 11.0% 8.8% 20.1% 20% 30% 40% 50% 60% 32.5% 41.4%
53.2%
Source: INTECO
A further 20.1% stated that they used cloud computing in other services. An in-depth analysis of the comments provided by these authorities revealed that those who chose Other Services actually used cloud in all areas, or in internal technology, security or communication functions applicable in all the administrative areas. Interesting differences are revealed between the three territorial jurisdictions under analysis. For example, areas such as systems management and operation, provider relations and HR management are hardly affected by cloud computing technology at local government level, although it has a relevant weight in autonomous community and central government authorities.
Page 62 of 178
Chart 12: Areas involved in cloud computing implementation, by territorial jurisdiction of the public entity (%)
54.5%
60% 50% 40% 30% 20% 10% 0%
43.2%
43.6%
38.5%
33.0%
30.8%
32.0%
36.0%
25.6%
25.6%
25.6%
24.0%
23.1%
23.1%
24.0%
28.0%
19.3%
14.8%
8.0%
9.1%
Local government Services to citizens and e-Government Open government and citizen participation HR management
6.8%
Autonomous community Administrative management of dossiers (authorisations, etc.) System management and operation Other service
Central government Budget and finance management Relations with companies and suppliers
Types of deployment model There is currently a clear preference for the deployment of private cloud computing services (58.2% of public authorities implement this model). These findings are logical when you consider the short period of time this technology has been in use, and that virtualisation and deployment of private cloud computing service models is recommended as the first step in the road map for the deployment of cloud technology in other more open environments. It would be interesting to monitor the evolution of this indicator to observe whether the public authorities migrate to public environments or retain their own private environments. Public cloud computing services, offering enhanced levels of flexibility and scalability, were implemented by 31% of the public authorities. This type of deployment is the second most common model used, followed by hybrid clouds, which were implemented by 16.8% of the Spanish public authorities. Implementation of community cloud models barely accounts for 3.9% of the systems in use, which is logical if we consider that this type of solution is scarce and currently targeted for specific niches (education, health, etc.).
20.0%
Page 63 of 178
20.0%
44.0%
Chart 13: Type of cloud computing deployment (%)
3.9% 3.0%
16.8%
58.2% 31.0%
Private
Public
Hybrid
Community
N/A
Source: INTECO
An analysis by territorial jurisdiction of the entity identifies a slight trend on the part of central government authorities to use public infrastructures more than their counterparts (36% as compared to 31.8% for local government authorities and 23.1% for autonomous community authorities). In any event, the private cloud model is favoured by the three types of entities.
Chart 14: Type of cloud computing deployment, by territorial jurisdiction of the public entity (%)
100% 3.4% 90% 80% 70% 31.8% 60% 50% 40% 30% 58.0% 20% 10% 0% Local government Private Public 17.0%
7.7% 15.4%
8.0% 12.0%
23.1%
36.0%
61.5% 52.0%
Autonomous community Hybrid Community
Central government N/A
Page 64 of 178
These findings are in line with the general consensus voiced by experts that private clouds and infrastructure and platform services will be implemented first and more extensively by public authorities. The outlook is that hybrid models will be implemented, combining in-house information systems, system hosting and a range of cloud models. Products used Following an analysis of the areas of the organisation targeted by the cloud computing solutions adopted and the type of deployment model chosen, it seems appropriate to analyse the actual products currently being used in the cloud by Spanish public authorities. The first step before undertaking the aforementioned analysis is to identify the software solutions, cloud based or otherwise, currently being used by public authorities. The findings are displayed in the chart below. Storage, email, computing resources, in addition to backup and office automation tools are the solutions most widely used in the Spanish public sector. For more theoretical information, Appendix III to this study provides an analysis of the most widespread solutions at Spanish and International level.
Page 65 of 178
Chart 15: Use of software solutions, cloud computing or otherwise (%) 42
Storage E-mail Computing Backup Office automation tools Virtual desktops DBMS Collaborative tools CCC MFT CRM ERP ALM Other (PPM, SCM, etc.) 0% 7.6% 10% 20% 30% 40% 50% 60% 70% 18.2% 40.4% 38.1% 34.2% 33.6% 32.1% 28.3% 25.5% 46.4% 65.4% 59.8%
75.5% 74.1%
80%
Basis: public authorities using cloud computing (n=152)
Source: INTECO
For a more detailed analysis, the aforementioned information is segmented by territorial jurisdiction.
42
Storage: Technological resources offered by providers for the purpose of storing client data in their databases.
Email: Software enabling e-mail management (draft, dispatch, receipt, storage, organisation, etc.). Computing: Computing resources offered by providers (computing capacity of providers servers). Backup: Technological resources enabling temporary storage of client data, for its recovery in the event of loss. Office automation tools: Collection of applications enabling the creation, organisation, scanning, printout, etc. of files and documents. Virtual desktops: Technology enabling a user to work on a computer using his/her user interface from another terminal located elsewhere. DBMS: Database management system: product used to store and organise e-Government data. Collaborative tools: Systems providing access to certain services which enables users to communicate and collaborate when in different physical locations. CCC: IT systems enabling the creation and management of content (text, images, video, etc.), and providing the option of sharing the content with team members. MFT: Managed file transfer. Solutions supporting secure data transfer from one computer to another via a network. CRM: Customer relationship management. Dedicated software for integrated management of customer- or citizen-related data. ERP: Enterprise resource planning. Collection of tools enabling integrated management of the processes and information relating to the various business areas. ALM: Application lifecycle management. A continuous process of managing the life of an application through the governance, development and maintenance thereof. PPM: Project portfolio management. Process for describing the methods for analysing and collectively managing a group of current, proposed or imposed projects. SCM: Supply chain management. Tools and application thereof to improve and automate supply by reducing inventories and delivery times.
Page 66 of 178
In order to provide a more detailed analysis, these data are shown below segmented according to the territorial jurisdiction of the public authorities. In general, all the solutions are used more at central government and autonomous community authority level than at local government authority level.
Chart 16: Use of software solutions (not necessarily under cloud computing), by territorial jurisdiction of the public entity (%)
0% Storage E-mail Computing Backup Office automation tools Virtual desktops DBMS Collaborative tools CCC
20%
40%
60%
80%
100%
Local Gov.
Central Gov.
Autonomous Com. MFT CRM ERP ALM Other (PPM,SCM, etc.)
The following analysis focuses on the public authorities actually using each of the solutions in an attempt to clarify whether they are using cloud computing technologies or not. The findings are conclusive: when a public authority is a cloud user, it adopts this model with most of the software solutions it implements. Use of more traditional formulae only exceeds the adoption of cloud-based solutions in the case of office automation tools and CRM solutions. However, when interpreting this data, it should be borne in mind that they are based on those authorities using each solution. In some cases the calculation base is so small that extreme caution should be exercised when drawing conclusions. The calculation base is provided in brackets to provide the reader with details of the magnitude of each variable.
Chart 17: Use of software solutions in cloud computing mode or otherwise (%)
Storage (n=120) E-mail (n=116) Computing (n=104) Backup (n=99) Office automation tools (n=85) Virt. desktops (n=68) DBMS (n=66) Collab. tools (n=65) CCC (n=61) MFT (n=52) CRM (n=48) ERP (n=46) ALM (n=31) Other (PPM, SCM, etc.) (n=13) 0% 10% 20% 30% 40% 50% 60% 70% N/A 80% 90% 100%
Use in cloud
Use outside cloud
Basis: public entities using each solution (see basis in brackets)
Source: INTECO
The next step is to analyse whether public authorities opt for paid or free cloud computing solutions.
Chart 18: Use of paid or free cloud computing software solutions (%)
Storage (n=120) E-mail (n=116) Computing (n=104) Backup (n=99) Office automation tools (n=85) Virt. desktops (n=68) DBMS (n=66) Collab. tools (n=65) CCC (n=61) MFT (n=52) CRM (n=48) ERP (n=46) ALM (n=31) Other (PPM, SCM, etc.) (n=13) 0% 21.8% 33.9% 31.9% 19.8% 10% 20% 22.5% 34.9% 33.0% 13.3%
54.7% 51.1% 50.0% 40.3% 23.0% 45.5% 31.4% 28.2% 37.7% 24.5% 21.8% 16.9% 40.8% 46.4% 30% 40% 50% 60% 28.4% 19.6%
31.0% 28.4% 37.5%
45.0%
70%
80%
90%
In free cloud
In paid cloud
Basis: public entities using each solution (see basis in brackets)
Source: INTECO
The current economic crisis may be influencing a large majority of the public authorities, causing them to opt for the use of free cloud-based software solutions, as shown in the foregoing chart. Noteworthy among the main free applications and tools chosen are those
used for storage, email, computing, virtual desktop and MFT (management file transfer) tasks. However, those tools designed for CCC (content creation, management and distribution) and ALM (application lifecycle management) activities are the most widespread among paid cloud solutions. 7.2.2 Cloud computing providers
On the whole the public authorities implementing cloud computing solutions choose to hire Spanish service providers. Almost 55% of the cloud-using public authorities have a service hired from a Spanish company in the cloud, as compared to the 20.5% of authorities which place their trust in international providers. The provider of the cloud services is often a government body, whether at local government (41.6%), autonomous community (34%) or central government level (19%).
Chart 19: Cloud computing providers (%)
Spanish company Other local public authority (town and city councils, etc.) Other autonomous community authorities (departments, etc.) International company Other central government authorities (general government, state agencies, etc.) Other types of companies and bodies 0% 1.3% 10% 20% 30% 40% 50% 20.5% 34.0%
54.6%
41.6%
19.0%
60%
Source: INTECO
The experts consulted argue that Spanish cloud computing providers are currently progressing in the improvement of the services they offer. They view it as a rapidly growing industry, implementing new solutions in an attempt to attract substantial projects and accounts which will allow them to stabilise the provision of this type of service. Similarly, the experts assert that cloud computing may lead to the concentration of the ICT industry in Spain, depending on how its responsible growth is planned and managed over the coming years. As a result, a reduced number of providers at national level will have the solvency required to manage and host the system of a large public authority in cloud mode.
The differences in the fields of activity of the various authorities are illustrated in the following chart. In general, central government entities hire cloud computing services from entities in the private sector, mainly in Spain (76%) but also internationally (28%). Only 8% of central government authorities stated that they designated another central government authority as their cloud computing provider. Regional and, in particular, local government authorities often resort to the cloud services offered by the public sector. For example, 45.5% of local authority entities have another local government entity as a cloud provider.
Chart 20: Cloud computing providers, by territorial jurisdiction of the public entity (%)
Central government
28.0% 8.0% 30.8% 28.2% 51.3%
76.0%
Autonomous community 2.6% Local government 1.1%
7.7%
12.8%
19.3% 20.5%
54.5% 35.2% 45.5%
0% 10% 20% 30% 40% 50% 60% 70% Spanish company International company Other autonomous community authorities (departments, etc.) Other local public authority (town and city councils, etc.) Other central government authorities (general government, state agencies, etc.) Other types of companies and bodies
80%
7.2.3
Associated economic cost of adopting cloud computing
The investment made to implement cloud computing strategies is an indicator of public authority commitment to this technology. Therefore, respondents were asked what percentage of the overall IT budget for 2011 was allocated to cloud computing technology. The conclusion, as illustrated in the chart below, is that Spanish public entities do not have sound knowledge of how the costs associated with cloud computing are distributed. More than half (64%) affirm that they are unable to provide an estimate of this figure. (It should be borne in mind that the profile of the person responding to the questionnaire is generally of a technical nature, which may explain their lack of knowledge in this connection). A further 19.5% use free cloud computing technology and, accordingly, the direct economic cost associated with adoption is zero. Just 16.5% actually knew what percentage of the total IT budget for 2011 was allocated to cloud computing. The limited
number of bodies that were able to estimate their investment in cloud computing makes an analysis of tranche-based investment, which may then be extrapolated to all the authorities, inadvisable. However, on an informative level, it should be noted that approximately half stated that they had invested no more than 5% of their technology budget in cloud computing products. In relation to the other bodies, the next-largest sector was 6-25%, which accounted for almost a quarter of those surveyed.
Chart 21: Knowledge of budget allocated to cloud computing in 2011 (%)
16.5%
19.5% 64.0%
Unaware of investment in cloud computing Aware of the investment in cloud computing
Use of free cloud technology, at no cost
Source: INTECO
The results segmented by territorial jurisdiction show that local government authorities (64.8%) are less likely to know about the investment than autonomous community (59%) and central government (48%) authorities. Also, as you would expect in view of the aforementioned technological and budgetary limitations, local government authorities are to a large extent more likely to use free versions of the cloud computing solutions, the difference being significant in relation to central government usage (20.5% as compared to 8%).
Page 71 of 178
Chart 22: Knowledge of budget allocated to cloud computing in 2011, by territorial jurisdiction of the public entity (%)
100% 90% 80% 20.5% 70% 12.8% 60% 50% 40% 30% 20% 10% 0% Local government Autonomous community Unaware of investment in cloud computing Use of free cloud technology, at no cost Aware of the investment in cloud computing Central government 64.8% 59.0% 48.0% 8.0% 14.8% 28.2% 44.0%
Page 72 of 178
DECISION MODEL FOR THE ADOPTION OF CLOUD COMPUTING SERVICES
This section analyses the decision model applied by Spanish public authorities in relation to their cloud computing strategy. The analysis presents separately those companies which have implemented the cloud and those which have not. 8.1 STRATEGY OF COMPANIES WITH CLOUD COMPUTING SERVICES
The strategy for adopting cloud computing involves various phases that provide guarantees to the public authority that hires the service. Aspects such as the evaluation of the possible risks associated with the implementation of cloud computing and the definition of measures to assure service quality and compliance with proven standards are aspects that help to increase trust in the service. The following sections analyse the strategy adopted by user entities of cloud computing, including an in-depth study into the motivations prompting its adoption and the analyses of risks and standards made prior to the taking the leap to cloud computing. They also analyse what type of mechanisms have been established to control and supervise their cloud computing providers, with a view to guaranteeing service quality. 8.1.1 Motivations for adoption
Experts confirm the importance of the clouds most common benefits, such as cost savings, management flexibility based on demand variability and efficiency in the management of technological services. However, they also believe that the main potential of this model lies in the ability to share common resources among various bodies, assuming the optimisation of processes and, ultimately, the generation of savings opportunities. The benefits reported by the model are set out in section 3.3: a service that is easy to use and start up, increased productivity (avoiding the centralisation of resources dedicated to technical aspects) and the economic savings resulting from outsourcing specialised human resources and technology elements are highlighted as the main motivations of public authorities to migrate their services to the cloud environment. Is this actually what the Spanish public authorities in the cloud perceive? What has influenced their decision to start using cloud computing technology? The following graphic responds to these questions: savings, efficiency and ease of use are the reasons that motivate the public authorities. Both the economic savings, declared by 68.4% of the authorities, and the time savings in technology resource management, at 69.5%, top the list of reasons that influence hiring a cloud computing service. These results may be an indication of the current economic situation and the need to optimise public budgets is critical to the public sector as a whole.
Another valid reason is the quest for efficiency. 55.5% of authorities seek increased productivity and 43.2% are motivated by a broader range of services. Ease of use (52.8%) and implementation (51.6%) are, likewise, decisive factors which have influenced the authorities in their cloud computing adoption strategies. Other factors that motivate the public sector in their leap towards the cloud include promotion of the development of e-Government and the possible interoperability between different bodies and authorities, as stated by 50% and 52.4% of these, respectively. Bringing the advantages of the new technologies and the possibility to share resources between public organisations closer to citizens is an incentive to use cloud computing.
Chart 23: Reasons that influenced the decision to hire a cloud computing service (%)
Time savings in IT resource management Cost savings in IT resource management Improved productivity User-friendly systems Greater interoperability between public authorities Ease of system implementation Promotion of e-Government Extension of services Greater level of open government and participation Modification of internal management models Reorganisation of in-house personnel Other reasons Unknown reasons 0% 10.0% 8.9% 8.1% 10% 20% 30% 40% 50% 60% 31.6% 25.0% 55.5% 52.8% 52.4% 51.6% 50.0% 43.2%
69.5% 68.4%
70%
80%
Source: INTECO
In the analysis of each public authority, by territorial jurisdiction, subtle differences can be observed. The savings in time and money represent a motivation for all public authorities, regardless of their territorial jurisdiction, in the same way as productivity. However, ease of use is more highly valued among central government and autonomous community authorities than among local government authorities. The opposite occurs on analysing interoperability: it constitutes a relevant motivation for 54.5% of the local government authorities, well above their autonomous community (35.9%) and central government (28%) counterparts.
Page 74 of 178
Chart 24: Reasons that influenced the decision to hire a cloud computing service, by territorial jurisdiction of the public entity (%)
0% Time savings in IT resource management Cost savings in IT resource management Improved productivity User friendly systems Greater interoperability between public authorities Ease of system implementation Promotion of e-Government Extension of services Greater level of open government and participation Modification of internal management models Reorganisation of in-house personnel Other reasons Unknown reasons
20%
40%
60%
80% 100%
Local gov.
Central gov. Autonomous Com.
Basis: public entities using cloud computing (Local govt. n=88, Auton.com. n=39, Central govt. n=25) Source: INTECO
8.1.2
Considerations before adopting cloud computing
It is essential to seek security guarantees and limit the risks within any technology environment. The main measures taken into account by the Spanish public authorities before implementing cloud computing are analysed below. Risk analysis One of the main aspects that help to identify and quantify the materialisation of undesired events relates to risk analysis.
Page 75 of 178
Chart 25: Performance of risk analyses prior to implementing cloud computing (%)
15.6% 29.9%
42.7%
11.8%
Yes, internally
Yes, externally
No
N/A
Source: INTECO
42.7% of the Spanish authorities have not carried out any type of risk analysis prior to implementing the cloud computing service. The fact that there is no legislation or law that makes this practice mandatory contributes to this. For their part, 41.7% do perform a risk analysis, either internally (29.9%) or with the help of an external provider (11.8%).
Chart 26: Performance of risk analyses prior to implementing cloud computing, by territorial jurisdiction of the public entity (%)
100% 90% 80% 70% 60% 50% 40% 11.4% 30% 20% 29.5% 10% 0% Local government Yes, internally 42.0% 17.0%
5.1%
46.2%
56.0%
15.4%
12.0%
33.3%
32.0%
Autonomous community Yes, externally No
Central government N/A
Page 76 of 178
Significant differences were not observed between the local government, autonomous community and central government authorities, as shown in the foregoing chart. In those cases where the authorities choose to perform a preliminary analysis, on the basis of what kind of risks would it be performed?
Chart 27: Type of risk analysis performed (%)
Information integrity risks
70.0%
Privacy risks
52.4%
Legal risks
45.1%
Business continuity risks
35.2%
N/A
15.7%
0%
20%
40%
60%
80%
Basis: public entities that have performed risk analysis (n=65)
Source: INTECO
70% of public authorities analyse risks relating to information integrity. With a fewer number of mentions, privacy risks (52.4%), legal risks (45.1%) and business continuity problems (35.2%) are aspects that public authorities take into account before taking the leap to the cloud. The reader must take into account that the calculation base is reduced in size, due to which caution must be exercised when drawing conclusions. Legislation considered There are various standards of particular relevance to the field of new technologies. The negative impact, both economic and reputational, that can arise from non-compliance with the applicable legislation, drives authorities to ensure their legal compliance prior to implementing a cloud-based project. Thus, 66.9% of the public authorities confirm having considered the relevant legislation prior to hiring a cloud computing service. For their part, 14.9% admit not having taken any standard into consideration and 18.2% are unaware if a prior legal compliance analysis was carried out.
Page 77 of 178
Chart 28: Consideration of the applicable legislation prior to implementing cloud computing (%)
18.2%
14.9%
66.9%
Yes
No
N/A
Source: INTECO
Mention should be made of the zeal of the Spanish Central Government, with 96% of entities that recognise having taken into account the legal implications arising from cloud computing prior to hiring the related services.
Chart 29: Consideration of the applicable legislation prior to implementing cloud computing, by territorial jurisdiction of the public entity (%)
100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Local government Autonomous community Yes No N/A 64.8% 82.1% 14.8% 20.5% 17.9%
4.0%
96.0%
Central government
Basis: public entities using cloud computing (Local govt. n=88, Auton. com. l n=39, Central govt. n=25) Source: INTECO
Page 78 of 178
Legislation on data protection is, without a doubt, the most widely considered among public authorities. Its repercussions in the media and the heavy fines arising from noncompliance therewith (up to EUR 60,000) represents a strong incentive for public authorities to take its implications into account prior to embarking on a cloud computing project.
Chart 30: Type of legislation considered (%)
Protection of personal data
94.4%
Intellectual property
39.3%
e-Administration
28.5%
Information society
18.9%
National security and interoperability framework
18.0%
Other legislation 0%
2.6% 20% 40% 60% 80% 100%
Basis: public entities that take into account legislative considerations prior to hiring cloud computing services (n=113) Source: INTECO
Thus, 94.4% admit having taken into account the Data Protection Organic Law when hiring a cloud computing service. The proportion of authorities that take other legislation into account is considerably lower: Intellectual Property (39.3%), e-Government (28.5%), Information Society (18.9%) and National Security and Interoperability Framework (18%). In the analysis segmented by jurisdiction of the public authorities, it should be noted that there is a greater level of consideration of the different types of legislation under analysis at central government level. Mention should also be made that, in this case, the calculation bases are very small.
Page 79 of 178
Chart 31: Type of legislation considered, by territorial jurisdiction of the public entity (%)
0%
20%
40%
60%
80%
100%
Protection of personal data
Local gov. Intellectual property Auton. com.
e-Administration
Information society
National security and interoperability framework
Central gov.
Other legislation
Basis: public entities that take legislative considerations into account prior to hiring cloud computing (Local govt. n=57, Auton. Com. n=32, Central govt. n=24) Source: INTECO
8.1.3 Considerations to be taken into account during the provision of cloud computing services Cloud computing providers play a vital role in the success of the project. Thus, the definition of an adequate management strategy for measuring the performance of their duties is key for the service to achieve adequate levels of satisfaction. Following is an analysis, in the case of public authorities which have adopted cloud computing, of the degree to which service control and supervisory mechanisms have been defined and whether they have requested any proven security standard from the provider. Mechanisms for controlling and supervising cloud computing services The hiring of mechanisms for controlling and supervising cloud computing services is one of the main aspects that must be arranged with the provider. In most cases, the authorities have not adequately established monitoring controls that will ensure that the provider is correctly carrying out the established tasks. More specifically, 30.1% of public authorities admit not having established any kind of service control and supervision mechanism, while 31.3% were unable to respond.
Only 38.6% affirm having implemented mechanisms for controlling and supervising the cloud computing service being provided.
Chart 32: Implementation of mechanisms for controlling and supervising cloud computing services (%)
31.3% 38.6%
30.1% Yes No N/A
Source: INTECO
Autonomous community and central government authorities display more caution than local government authorities when implementing cloud control and supervisory mechanisms. Only 36.4% of local government authorities acknowledge having defined control mechanisms compared to 56.4% in the case of autonomous community authorities and 56% in the case of central government authorities.
Page 81 of 178
Chart 33: Implementation of mechanisms for controlling and supervising cloud computing services, by territorial jurisdiction of the public entity (%)
100% 10.3% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Local government Autonomous community Yes No N/A Central government 36.4% 56.4% 56.0% 29.5% 34.1% 44.0% 33.3%
In the case of all those public authorities that confirmed having implemented mechanisms for controlling and supervising cloud services, an in-depth analysis was performed of the methods used: audits were highly valued, both those performed by civil servants (46.3%) and those performed independently (35.5%), while mechanisms such as entering into agreements to regulate specific security issues (12.5%), requesting reports on the fulfilment of security measures (12.4%) or conducting periodic tests to check the proper functioning of the disaster recovery plan (11.6%), seemed to be of less importance to public authorities.
Page 82 of 178
Chart 34: Control and supervisory mechanisms implemented (%)
Periodic audits performed by in-house personnel
46.3%
Periodic audits performed by external auditors
35.5%
Contracts with specific security legislation to be fulfilled
12.5%
Periodic reports on compliance with security measures
12.4%
Periodic testing of the disaster recovery plan
11.6%
0%
10%
20%
30%
40%
50%
60%
Basis: public entities which have implemented mechanisms for controlling and supervising the cloud computing services hired (n=68) Source: INTECO
Mandatory security standards According to the experts, the experience accumulated by the Spanish Central Government groups in charge of standardisation and organising common services reflects a governance and coordination problem in the process of transformation towards shared and cloud services. For each selected service we recommend creating an oversight body to manage the related area of competence, while disabling the decentralised management of the same service in other bodies. Gartner Consulting Group affirms in one of its latest reports 43 that potential cloud computing platform customers require a set of predefined requirements to evaluate the degree of compliance of cloud computing providers in terms of security. At present these requirements are poorly developed and their evolution would represent a significant increase in benefits for the sector. The adoption of standards allows providers to certify and add value to the service or work being carried out. However, public authorities do not always include requesting standards among their usual practices when evaluating the possibility of hiring a service. Only 43.0% of public authorities request some kind of security standard, in view of which the proportion of authorities that are unaware of whether some kind of security standard was requested at the time of hiring the cloud computing service is of particular significance
43
Gartner (2011): Hype Cycle for Cloud Computing. Available at: http://www.gartner.com/id=1753115.
Page 83 of 178
(37.4%). Moreover, 19.6% admit that no type of security standard was requested on hiring their cloud computing solution(s).
Chart 35: Mandatory security standards for cloud computing providers (%)
37.4%
43.0%
19.6% Yes No N/A
Source: INTECO
The level of requirement differs according to the jurisdiction of the authority. Central government and autonomous community public authorities request security standards from their providers with greater frequency than local government authorities, as shown in the following chart.
Page 84 of 178
Chart 36: Mandatory security standards for cloud computing providers, by territorial jurisdiction of the public entity (%)
100% 10.3% 90% 80% 70% 60% 50% 40% 69.2% 30% 20% 10% 0% Local government Autonomous community Yes No N/A Central government 39.8% 68.0% 19.3% 40.9% 20.5% 28.0%
4.0%
Those public authorities that choose to request standards opt, in most cases, to enter into continuity and service agreements, mainly because they allow greater flexibility and adaptability than a specific standard (55.2%), ISO 27001-compliant agreements, the main security standard (30.7%) and ISO 9000-compliant agreements, one of the first standards to regulate the quality offered by a provider (13.1%).
Chart 37: Mandatory security standards for providers (%)
Continuity contracts and service level agreements
55.2%
ISO 27001 (information security)
30.7%
ISO 9000 (service provision quality)
13.1%
BS 25999 (business continuity)
4.1%
Other formulae
12.2%
0%
10%
20%
30%
40%
50%
60%
70%
Basis: public entities that require security standards (n=79)

Source: INTECO
Page 85 of 178
8.2
STRATEGY OF AGENCIES WITHOUT CLOUD COMPUTING SERVICES
On analysing the level of adoption of cloud computing, it was observed that there are currently 66.6% public authorities that are not cloud users (see Chart 7). An in-depth analysis of the reasons which have motivated public authorities and entities which do not use cloud computing to rule out its adoption was carried out among this collective. In order to structure the answers, the reasons have been classified under four categories: cost, technical reasons, security doubts and institutional and legal matters.
Table 4: Description of reasons for not adopting cloud computing High cost Lack of aid and grants Cost reasons Generation of uncontrolled variable costs Existence of recently acquired computer hardware not yet depreciated Lack of technological capability Provider dependence Lack of qualified personnel Doubts as to the integrity of the services and public data Loss of control over processes and data Absence of provider liability in the event of security incidents Lack of a specific legal framework Legislative diversity and incompatibility between Spanish legislation and provider country legislation (Data Protection Law or otherwise) Lack of an oversight body or National Plan of reference
Source: INTECO
Technical and awareness reasons
Security reasons
Institutional and legal reasons
Chart 38 shows the results of the analysis of the reasons that prevent adoption of the cloud by the Spanish public sector. The bars are colour-coded to help identify the motivation category to which they belong, in accordance with the table above, and therefore, make it easier to draw conclusions. It is noteworthy that, in the same way that cost and time savings are seen to be the main reasons among user authorities for taking the leap to the cloud (see Chart 23) the economic aspect is also stated as the most common reason among agencies that are not cloud users for not adopting cloud computing. In particular, the high cost of the solutions (28.7%) and the lack of aid and grants (28.6%), are the reasons most frequently cited. After cost, the lack of a need for solutions is a widely alleged reason (28.2%). The doubts with regard to cloud security are also determining factors in the adoption of cloud computing, with 22.5% of non-cloud user authorities raising doubts over the loss of control
Page 86 of 178
over processes and data, and a further 22.2% had doubts as to the integrity of the services and data. It seems that the fear of loss of control over the information stored in the cloud is, together with the perceived cost, the main reason preventing deployment of cloud computing in the public sector. Technical and legislative issues are mentioned to a lesser degree. 17.1% of authorities consider that public authorities lack of technological capability has been a critical factor in preventing the leap to the cloud. Other less compelling reasons given by authorities for not adopting cloud computing include the absence of a specific legal framework (12.1%) and the lack of an oversight body (11.9%).
Chart 38: Reasons which have, greatly or substantially, influenced the decision not to adopt cloud computing (%)
High cost Lack of aid and grants Other (lack of need) Loss of control over processes and data Doubts about integrity Uncontrolled variable costs Lack of personnel skills Lack of liability Non-depreciated computer equipment Lack of technological capability Non-existence of specific legal framework Non-existence of oversight body Dependence on provider Regulatory diversity and incompatibility 0% 12.1% 11.9% 9.3% 7.5% 10% 20% 30% 40% 22.5% 22.2% 21.4% 20.4% 17.8% 17.7% 17.1% 28.7% 28.6% 28.0%
Basis: public entities not using cloud computing (n=348)
Source: INTECO
The analysis, segmented by type of authority, reveals some very interesting differences. The figures shown in Table 5 are presented, for comparison purposes, in the same descending order as in the preceding chart. The colour code used to identify each motivation category is included on the left: red (cost reasons), light pink (technical and qualification reasons), brown (security reasons) and dark pink (institutional and legal reasons). Local government authorities allude mainly to reasons of an economic nature for not adopting cloud computing. However, central government authorities take other types of restraints into consideration. Some mention the lack of need (41.3%) as a reason for not embarking on a cloud project, while others comment that security-related matters, rather than cost, have prevented their possible adoption of cloud computing, with 40.2% of
Page 87 of 178
central government authorities making reference to doubts about service and data integrity, 37.8% making reference to the loss of control over processes and data, and the same percentage expressing their concern about the absence of provider liability in the event of a security incident. Central government agencies show greater sensitivity to security than their autonomous community and local government counterparts.
Table 5: Reasons which, to a larger and lesser degree, have influenced the decision not to adopt cloud computing, by territorial jurisdiction of the public entity (%)
Reasons High cost Lack of aid and grants Other (lack of need) Loss of control of over processes and data Doubts as to the integrity of the services and public data Generation of uncontrolled variable costs Lack of qualified personnel Absence of provider liability in the event of security incidents Existence of recently acquired computer hardware and not yet depreciated Lack of technological capability Lack of a specific legal framework Lack of an oversight body or National Plan of reference Provider dependence Legislative diversity and incompatibility between Spanish legislation and provider country legislation (Data Protection Law or other)
Local Autonomous Central government Community government 29.0% 29.0% 28.8% 20.7% 21.3% 21.9% 21.9% 16.6% 14.8% 18.3% 10.6% 11.2% 8.8% 6.5% 27.8% 26.8% 24.3% 32.0% 24.8% 18.6% 11.4% 21.7% 38.1% 9.3% 20.6% 15.5% 12.4% 12.4% 24.4% 23.1% 41.3% 37.8% 40.2% 19.6% 9.8% 37.8% 19.5% 13.4% 20.8% 18.3% 12.2% 18.3%
Basis: public entities not using cloud computing (Local govt. n=169, Auton.com. n=97, Central govt. n=82) Source: INTECO
The evaluation of risks in cloud computing, together with the variety and maturity of the necessary security mechanisms, will continue to change rapidly in the coming years. As would be the case with a more traditional provider, at present it is reasonable to assume that cloud platform customers will continue to be reluctant to upload sensitive data to the cloud.
Page 88 of 178
RESULTS OF IMPLEMENTING CLOUD COMPUTING
This section focuses on an analysis of the results obtained by public authorities on adopting cloud computing. Accordingly, it provides an in-depth study of the benefits perceived after taking the leap to the cloud, as well as the difficulties identified during the implementation process. In short, it is aimed at determining whether or not the expectations of the Spanish public sector have been met with regard to cloud computing. 9.1 BENEFITS DERIVED FROM THE IMPLEMENTATION OF CLOUD COMPUTING SOLUTIONS Section 8.1.1 identified the motivations that influenced public authorities to transfer their services and systems to the cloud model, with particular emphasis on time and cost savings. Following is an analysis of the extent to which cloud users effectively consider each of these aspects to be beneficial. To this end, Chart 39 confirms that time and cost savings are the main gains arising from cloud computing, followed by the extension of the services offered by each public authority and a general improvement in the productivity thereof.
Chart 39: Degree to which the effects of adopting cloud computing have been beneficial to the public entity (%)
Time savings Cost savings Extension of the services offered by the body Improvement in general productivity of the body Modification of internal management models Promotion of e-Government Promotion of interoperability and cooperation between public authorities Reorganisation of in-house personnel 23.5% 23.0% 12.2%
66.5% 53.7% 51.2% 47.2% 16.9% 10.9% 12.8% 26.5%
18.7% 30.0%
14.0% 15.4%
35.2% 21.7%
58.2% 63.9% 66.8% 78.0%
19.5%
9.3% 11.3%
0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%
Greatly and total Average Little or none N/A
Source: INTECO
The opinion expressed by the public authorities that use cloud computing solutions in relation to the technological and operating advantages that they have contributed to their organisation, from the point of view of an effective implementation experience, is a factor
Page 89 of 178
that can influence the decision of other public authorities which are in the process of evaluating alternatives. Most public authorities concluded that the cloud provides technological advantages for those public authorities that choose to implement it. In fact, 59.5% of the public authorities that use the cloud consider cloud computing to be a technological advantage, as opposed to 17.8% which do not consider it as such and an additional 22.7% which are undecided.
Chart 40: Consideration of cloud computing as a technological advantage for Spanish public authorities (%)
22.7%
17.8%
59.5%
It is an advantage
It is not an advantage
N/A
Source: INTECO
This consideration was unanimous among the three types of public authorities consulted. Local government authorities showed a certain tendency to consider cloud computing as an advantage to a lesser degree than their autonomous community and central government counterparts.
Page 90 of 178
Chart 41: Consideration of cloud computing as a technological advantage for Spanish public authorities, by territorial jurisdiction of the public entity (%)
100% 90% 80% 70% 60% 50% 40% 69.1% 30% 20% 10% 0% Local government Autonomous community It is not an advantage Central government N/A It is an advantage 58.0% 67.1% 17.8% 12.4% 24.3% 18.6% 18.3%
14.6%
The perceived operating advantages provided by cloud computing were also studied. The vast majority of public authorities (85.9%) acknowledge that the cloud provides advantages and elements for the functional optimisation and transformation of the Spanish Public Authorities.
Chart 42: Consideration of cloud computing as an operational advantage for Spanish public authorities (%)
0.2% 3.3% 10.6%
85.9%
Positive impact on operations
No impact on operations
Negative impact on operations
N/A

Source: INTECO
Page 91 of 178
The assessment given by the public authorities of the impact of cloud computing from an operational perspective was particularly positive, especially in the case of the local government authorities (86.4%). The opinion that cloud computing has little or no operating impact acquired certain relevance among central government authorities (20%).
Chart 43: Consideration of cloud computing as an operational advantage for Spanish public authorities, by territorial jurisdiction of the public entity (%)
100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Local government Positive impact on operations Autonomous community No impact on operations Central government N/A Negative impact on operations 86.4% 82.1% 76.0% 10.2% 12.8% 20.0%
9.2 DIFFICULTIES SOLUTIONS
IN
THE
IMPLEMENTATION
OF
CLOUD
COMPUTING
The adoption of cloud computing by public authorities is fraught with difficulties. This section analyses the problems encountered by the Spanish public sector when addressing migration to the cloud. Methodologically speaking, the same structure was followed as that used to identify the motivations for not adopting cloud computing, the model applied being as follows:
Page 92 of 178
Table 6: Description of the difficulties encountered on implementing cloud computing solutions High cost Lack of aid and grants Cost difficulties Generation of uncontrolled variable costs Existence of recently acquired computer hardware not yet depreciated Lack of technological capability Provider dependence Lack of qualified personnel Doubts as to the integrity of the services and public data Loss of control over processes and data Absence of provider liability in the event of security incidents Lack of a specific legal framework
Technical and qualification difficulties
Security difficulties
Legislative diversity and incompatibility between Institutional and legal difficulties Spanish legislation and provider country legislation (Data Protection Law or otherwise) Lack of an oversight body or National Plan of reference
Source: INTECO
The main difficulties encountered by Spanish authorities when adopting cloud computing relate to security and technical issues. Thus, 29.5% of public authorities find that service and data integrity issues have greatly or substantially hindered the adoption of cloud computing. The lack of technological capability on the part of the public body (20.8%) and the loss of control over processes and data (20.4%) are also cited as problems encountered by the public sector bodies during their transition to the cloud. Institutional and legal factors, however, are not considered to be an obstacle by the authorities using cloud computing.
Page 93 of 178
Chart 44: Factors which have, greatly or substantially, hindered the adoption of cloud computing (%)
Integrity of services and data Lack of technological capability Loss of control over processes and data Lack of aid and grants Lack of qualified personnel High cost Provider dependence Absence of provider liability Undepreciated computer equipment Uncontrolled variable costs Lack of a specific legal framework Legislative diversity and incompatibility Lack of oversight body 0,0% 5.8% 10,0% 20,0% 30,0% 12.6% 11.8% 10.9% 10.7% 8.8% 20.8% 20.4% 20.0% 19.2% 18.5% 18.2%
29.5%
40,0%
Source: INTECO
9.2.1
Economic difficulties
Following is an analysis of the extent to which economic factors hindered the adoption of cloud computing by local government, autonomous community and central government authorities. The economic aspect was a concern shared by all the public authorities surveyed. Autonomous community authorities mention more frequently having undergone economic difficulties in the implementation of the cloud computing model, as can be seen in the chart below, although caution must be exercised when drawing conclusions due to the limited range of the calculation bases. Autonomous community and central government authorities agree that one of the difficulties associated with the adoption of cloud computing lies in the existence of computer hardware recently acquired and not yet depreciated. The experts who participated in the study also point out that the economic issues which can have the most negative effect are normally linked to the authorities depreciation policy with respect to their technology systems and resources. The cloud model is characterised by the fact that it generates less expenses than traditional technology models; despite this, in some cases authorities must continue with and complete the implementation of their information system strategy plans.
Page 94 of 178
Chart 45: Economic factors which have, greatly or substantially, hindered the adoption of cloud computing, by jurisdiction of the public entity (%)
60% 51.3% 51.3% 50% 46.2% 40% 38.5% 36.0% 40.0%
30%
26.1% 20.5% 17.0% 17.0%
28.0% 24.0%
20%
10%
0% Local government High cost Lack of aid and grants Autonomous community Uncontrolled variable costs Central government
Undepreciated computer hardware
9.2.2
Technical difficulties
The cloud computing model is currently undergoing expansion in Spain, which could lead to certain initial technical difficulties in its implementation. Here, yet again it is the autonomous community authorities which perceive the greatest technical difficulties, expressing particular concern over the increased dependence on cloud computing providers and their lack of qualified personnel.
Page 95 of 178
Chart 46: Technical factors which have, greatly or substantially, hindered the adoption of cloud computing, by public entity (%)
60% 53.8% 50% 48.7% 43.6% 40% 38.6% 33.0% 30% 29.5% 36.0% 40.0% 48.0%
20%
10%
0% Local government Autonomous community Central government Lack of qualified personnel Dependence on provider Lack of technological capability
9.2.3
Security difficulties
The general analysis provided in Chart 44 identified service and data integrity as the greatest difficulty faced by public authorities when taking the leap to the cloud. This shared concern for integrity is further confirmed by an analysis segmented by type of authority, although it appears to be of particular importance among central government (60%) and autonomous community (59%) authorities.
Page 96 of 178
Chart 47: Security factors which have, greatly or substantially, hindered the adoption of cloud computing, by territorial jurisdiction of the public entity (%)
70% 60% 50% 40.9% 40% 30% 20% 10% 0% Local government Service and data integrity Autonomous community Loss of control over processes and data Central government Lack of provider liability 29.5% 26.1% 43.6% 38.5% 59.0% 60.0% 52.0% 48.0%
9.2.4
Legal and institutional difficulties
Within the legal sphere, one of the main elements to be noted is the current lack of legislation and/or regulations that provide a legal and institutional framework for hiring and using cloud computing services. The general analysis revealed that the difficulties relating to the lack of a specific regulatory and institutional framework affected the public authorities to a lesser degree in their cloud computing implementation process. However, an in-depth vision segmented by type of authority reveals interesting differences which demonstrate that central government and autonomous community authorities do show concern over the lack of a legal framework and oversight body, as well as over the legislative diversity and incompatibility in the case of operations that span several countries.
Page 97 of 178
Chart 48: Legal and institutional factors which have, greatly or substantially, hindered the adoption of cloud computing, by territorial jurisdiction of the public entity (%)
50% 46.2% 45% 40% 35.9% 35% 30% 25% 20% 15% 10% 5% 0% Local government Lack of a specific legal framework Autonomous community Legislative diversity and incompatibility Central government Lack of an oversight body 19.3% 17.0% 13.6% 41.0% 44.0% 40.0% 40.0%
9.3
DEGREE OF SATISFACTION WITH CLOUD COMPUTING PROVIDERS
It is interesting to analyse the overall level of public authority satisfaction with cloud computing service providers, in order to ascertain to what extent the service offering meets the needs and demands of Spanish public authorities. Generally speaking, a high level of satisfaction was observed in the cloud services received by the authorities. Between 65% and 70% of the authorities highlighted the fact that the level of satisfaction generated by the cloud services hired was high or very high. Criteria such as service quality, in terms of maintenance and support, installation and ease of contact were valued highly by the authorities and indicate that service follow-up was deemed satisfactory.
Page 98 of 178
Chart 49: Satisfaction with the cloud computing service provider (%)
Service quality (support, maintenance, response to contingencies)
22.2%
41.3%
24.8%
Service quality (installation and redimensioning)
21.1%
39.7%
30.2%
Ease of contact with and provider availability
18.3%
36.0%
35.7%
0% Dissatisfied Not very satisfied
20% Somewhat satisfied
40%
60%
80% Very satisfied
100% N/A
Quite satisfied
Source: INTECO
In order to obtain a more in-depth analysis of the degree of satisfaction with the cloud computing service hired, the results have been segmented in accordance with the type of provider who provides the cloud service. The results, which are quite revealing, are shown in the following chart. When measuring the degree of satisfaction with service quality, whether in terms of support and maintenance or in terms of installation and resizing of the technology solution, the most satisfied authorities are those that hired their services from international providers. Thus, 79% of the authorities that hired cloud services from an international company are very satisfied or quite satisfied with the quality of the implementation; in the case of authorities whose provider is another authority, the degree of satisfaction was 70.6%. However, when analysing the degree of satisfaction in terms of ease of contact with the provider and availability thereof, the results are better when the service provider is a public authority. 75.3% of the public authorities that work with public sector cloud providers are very satisfied or quite satisfied with their availability and ease of contact. In the case of private international providers, this percentage drops to 60.4%.
Page 99 of 178
Chart 50: Public authorities that are satisfied and quite satisfied with their cloud computing service provider, by type of provider (%)
Service quality (support, maintenance, response to contingencies)
72.6% 68.9% 66.7%
Service quality (installation and resizing)
79.0% 71.8% 70.6%
60.4% Ease of contact with and provider availability 71.8% 75.3% 0% International company Spanish company Other public authority (local govt., auton. com. or central govt.) 20% 40% 60% 80%
Source: INTECO
9.4
OVERALL RESULT: FULFILMENT OF EXPECTATONS
Three out of four public authorities consider that their expectations have been fulfilled in relation to cloud computing, and an additional 9.4% consider that they were exceeded. Only 6.4% of the authorities surveyed consider that the results were below their initial expectations.
Chart 51: Fulfilment of initial expectations of cloud computing (%)
8.4% 6.4% 9.4%
75.8%
Fulfilled
Exceeded
Not fulfilled
N/A
Source: INTECO
Page 100 of 178
In the analysis segmented by territorial jurisdiction, it seems that central government and autonomous community authorities expressed the highest degree of satisfaction with regard to the fulfilment of expectations in terms of cloud computing.
Chart 52: Fulfilment of the initial expectations about cloud computing, by territorial jurisdiction of the public entity (%)
100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0%
6.8% 9.1% 9.1%
2.6% 12.8%
4.0% 4.0%
75.0%
82.1%
88.0%
Local government Fulfilled
Autonomous community Exceeded N/A Not fulfilled
Central government
Page 101 of 178
10
INTENTION OF FUTURE USE
10.1 EXPECTED USE BY AUTHORITIES WITH CLOUD COMPUTING SERVICES It is always complicated to make predictions about the use of a technology which is currently under development and expansion, but even more so in the current context of budgetary uncertainty in Spanish public authorities and entities. However, four indicators have been identified which can contribute to making a prediction about the future use of cloud computing among those public authorities currently working in the cloud. The aforementioned indicators are as follows: 10.1.1 Expected maintenance of cloud computing solutions which are already implemented. Expected incorporation of solutions which have not yet been implemented. Recommendation to other authorities. Expected future benefits derived from cloud computing. Expected maintenance of cloud computing solutions
The intention of those authorities currently using cloud solutions is analysed first. In this connection, the opinion of the majority (94.5%), as shown in the following chart, is to maintain the cloud computing use strategy in those solutions which have already been migrated to this technology. Only 0.2% of authorities state that they will not maintain the current cloud technology in the future and a further 5.3% remain undecided.
Chart 53: Stated intention to maintain the currently adopted cloud computing solutions in the future (%)
0.2% 5.3%
94.5%
Yes
No
N/A
Source: INTECO
Page 102 of 178
The following chart analyses the differences observed between the three territorial jurisdictions analysed. The central government authorities unanimously considered that they would maintain the currently adopted cloud computing solutions in the future. However, a small proportion of autonomous community authorities (2.6%) expressed their intention not to maintain cloud technology in the future. Local government authorities, on the other hand, showed a certain level of indecision with around 5.7% of those surveyed, stating that they were undecided.
Chart 54: Stated intention to maintain currently adopted cloud computing solutions in the future, by territorial jurisdiction of the public entity (%)
100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0%
5.7%
2.6% 2.6%
94.3%
94.9%
100.0%
Local government
Autonomous community
Yes No N/A
Central government
10.1.2
Expected incorporation of solutions which have not yet been implemented
The following is an analysis of the expected incorporation of solutions not yet adopted. In this case, the calculation base is made up of those authorities that use some kind of cloud computing solution, which are not currently using (neither in cloud mode nor in any other mode) the specific solution in question. The results are shown in Chart 55 and some interesting conclusions can be drawn therefrom. Firstly, it is forecast that few new solutions will be incorporated, regardless of any foreseeable technological paradigm shift .There does appear to be some degree of prevision for the incorporation of backup services, albeit less than 12%. Secondly, and this constitutes a good indicator for cloud computing, in those cases where the authorities surveyed do plan to incorporate a new solution, they showed a clear preference for doing it in cloud mode. Also, in the case of some specific solutions (backup, virtual desktops,
Page 103 of 178
DBMS, ALM, e-mail, computing and storage) all those authorities that plan to incorporate these solutions stated their intention to do so in cloud mode. These data confirm the existence of a certain pull effect, i.e. once an organisation starts working in cloud mode, successive solutions are also incorporated using cloud computing.
Chart 55: Expected future incorporation of solutions not yet implemented at public entities using cloud computing (%)
14% 12% 10% 8% 6% 4% 2% 0%
Probability of inclusion Probability of inclusion in cloud computing mode
Basis: public entities not using cloud computing (see calculation bases in brackets) Source: INTECO
Experts agree that cloud computing will be implemented by Spanish public authorities less quickly than in the private sector. The public sector has traditionally adopted a more conservative approach due to the critical nature of and the risks inherent to its systems. 10.1.3 Oversight role of the public authorities
Those public authorities using cloud computing solutions were asked if they would recommend the use thereof to other authorities with similar needs. The results largely show the important oversight role that can be played by the authorities when recommending the use of the cloud. Thus, three out of four authorities surveyed expressed that they would recommend the use of cloud computing to other authorities without a doubt, while an additional 17.2% admitted that they would probably recommend it.
Page 104 of 178
Chart 56: Intention to recommend the use of cloud computing to other public entities (%)
4.1% 2.0% 17.2%
76.6%
Yes, without a doubt
Probably
No, definitely not
N/A
Source: INTECO
In the analysis performed by territorial jurisdiction of the public authority, no significant differences were observed. In the three jurisdictions analysed (local government, autonomous community and central government), the intention of recommending the use of the cloud to other authorities was high.
Chart 57: Intention of recommending the use of cloud computing to other public authorities, by territorial jurisdiction of the public entity (%)
100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Local government
Yes, without a doubt
2.3% 17.0%
17.9% 24.0%
76.1%
82.1% 72.0%
Probably No, definitely not
Central government
N/A
Page 105 of 178
While expectations for implementing new software solutions in the future are limited in the short- and medium-term, the trend followed by those authorities which have already migrated to cloud computing is favourable towards the use of new cloud solutions in future. 10.1.4 Expectations for obtaining benefits in the future
This section analyses whether or not public authorities using cloud computing expect to obtain additional future benefits as a result of its adoption. Spanish public authorities are optimistic in this regard. 81.6% of public authorities believe that they will gain further advantages as a result of using cloud computing technology, compared to 3.4% which do not agree and an additional 15% which remain undecided.
Chart 58: Expectations for obtaining further benefits in the future, in addition to those already obtained, as a result of adopting cloud computing (%)
15.0%
3.4%
81.6%
Yes
No
N/A
Source: INTECO
The only significant difference revealed by the indicator segmented by territorial jurisdiction is that, despite being the most selected option, the percentage of authorities that expect to obtain future benefits is slightly lower in the case of central government entities (68.0% compared to 81.8% in the case of local government authorities and 82.1% in the case of autonomous community authorities).
Page 106 of 178
Chart 59: Expectations for obtaining further benefits in the future, in addition to those already obtained, as a result of adopting cloud computing by territorial jurisdiction of the public entity (%)
100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Local government
Yes
14.8% 3.4%
15.4% 24.0% 2.6% 8.0%
81.8%
82.1% 68.0%
No N/A
Central government
10.2 PROJECTIONS OF ENTITIES WITHOUT CLOUD COMPUTING SERVICES Following is an analysis of the strategy followed by those authorities which have not yet adopted cloud computing. Do they intend to leap to the cloud in the future? As in the case of public authorities using cloud computing, the vast majority of those surveyed expressed their intention to not implement any new solutions in the short or medium term under any kind of technological paradigm. However, unlike in the past, in this case future use tends to be focused on non-cloud computing strategies. In other words, those public authorities which have experience in the use of cloud computing show a predisposition to include it in any new solutions, while those who have not yet used this technology are reluctant to do so. The non-user authorities which intend to specifically include cloud computing solutions are a minority, as shown in the chart below.
Page 107 of 178
Chart 60: Projected future incorporation of as yet unincorporated solutions at public entities not using cloud computing (%)
35% 30% 25% 20% 15% 10% 5% 0%
Probable inclusion Probability of inclusion in cloud computing mode
Basis: public entities which are non-users of cloud computing not using each solution (calculation bases provided in brackets) Source: INTECO
Of those public authorities which expressed an intention to include cloud computing, 42% will opt for free solutions. However, as can be observed, a large percentage were undecided (27.6% were unable to respond).
Chart 61: Type of cloud computing (free or pay-per-use) that public entities intend to incorporate (%)
27.6% 42.0%
33.5%
Free
Pay-per-use
N/A
Basis: public entities not using cloud computing which intend to do so (n=70)
Source: INTECO
Page 108 of 178
Finally, those public authorities which have not yet adopted cloud computing but intend to do so, will request external assessment for the implementation thereof. This is confirmed by the survey data, where 61.9% of the Spanish public entities affirm that they will seek third party support to implement cloud computing.
Chart 62: Stated intention to engage external advisors to adopt cloud computing (%)
26.8%
11.4%
61.9%
Yes
No
N/A
Basis: public entities not using cloud computing which intend to do so (n=70)
Source: INTECO
Page 109 of 178
11
SWOT ANALYSIS
Cloud computing is a reality within the technological infrastructure of the Spanish public authorities. Although its presence is still limited (33.4% of Spanish public authorities use cloud computing), the forecast for the coming years is for gradual, steady growth. Accordingly, following the general statistical analysis of the Spanish public sectors approach to the cloud, conclusions must be drawn that will allow detailed guidance to be offered in relation to the positive and negative points of the Spanish public sectors outlook with regard to cloud computing. In order to prepare these conclusions, all the information gathered was taken into account: the survey conducted among the IT managers of 500 Spanish public authorities, in-depth interviews with ten Spanish experts and the bibliography consulted on cloud computing trends in the public sector. The conclusions drawn are summarised using a SWOT analysis model (Strengths, Weaknesses, Opportunities and Threats), which includes the most relevant aspects to be considered in the present and future in relation to cloud computing implementation in the Spanish public sector. A SWOT analysis provides an efficient technique to reflect and enhance awareness of the real situation faced by public authorities and entities with respect to cloud computing. This analysis compares and contrasts in detail and in just one analysis all the issues addressed by the study, from internal aspects of the authorities (strengths and weaknesses) to external factors beyond their control related to external agents and situations (opportunities and threats). The following table provides a summary of the points set out in more detail below.
Page 110 of 178
Table 7: SWOT Analysis POSITIVE STRENGTHS Economic savings Concentration and strengthening of security management Flexible demand variability management Elimination of duplicities and redundancies Service availability Main benefits are citizen-oriented Accessibility and mobility Large number of possible providers NEGATIVE WEAKNESSES Lack of specific procedures for hiring cloud computing of services Governance issues arising in the process of transformation towards shared services Delocalisation and loss of control of the information Provider dependence Lack of flexibility for HR reorganisation Failure to depreciate IT resources Lack of bandwidth at certain locations Inadequate analysis of relevant issues prior to hiring the service and during the provision thereof THREATS Absence of an international legal framework to regulate the cloud computing model Over-sizing of provider capabilities degenerates service provision
INTERNAL ORIGIN
EXTERNAL ORIGIN
OPPORTUNITIES Sharing of common resources and standardisation Provision of services and resources to other organisations Lessons learned from the private sector. Preference for Spanish providers
Source: INTECO
11.1 STRENGTHS a) Economic savings Economic savings is one of the main advantages of adopting the cloud computing model. While it is true that, taking into account the economic planning of public authorities, the impact on savings is not as direct as in private entities (i.e. public authorities do not report, for example, staff costs, due to which the HR savings generated are not directly recognised by cloud-using public authorities). The perceived economic benefits generated would increase considerably if the public authorities followed a common management model that allowed resources to be shared.
Page 111 of 178
b)
Concentration and strengthening of security management All those authorities with common services can delegate security management to a single provider, without the need for local resources or large, individual budgets. Security measures against undesired attacks can be increased in the platform that supports the service, increasing reliability in relation to the needs identified within the service.
c)
Flexible demand variability management Public authorities value positively the adaptability of the cloud computing model with respect to the changes arising from the demand. The ease with which resources are optimised and scaled with respect to different peaks in demand avoids the need for authorities to embark on large-scale projects that can suffer capacity modifications in future.
d)
Elimination of duplicities and redundancies Having a common platform on which to house information used by various public authorities involves sharing resources and information that is accessible by any public body with access to the platform. Cloud computing avoids the use of multiple repositories that give rise to information duplicities and lead to an increase in technology investment and, therefore, expenditure.
e)
Service availability At present, providers have Data Processing Centres and a technological infrastructure superior to that of any public authority. In most cases, increasing service availability can represent an excessive investment. Public authorities can leverage the technological infrastructure offered by providers and cloud computing to adjust the availability requirements associated with their systems.
f)
Main benefits are citizen-oriented The ultimate purpose of the migrations carried out by the public authorities to the cloud computing environment is, inter alia, to offer services to citizens and promote eGovernment, thereby benefiting society as a whole. Cloud computing represents a key element in the modernisation of the Spanish public authority.
Page 112 of 178
g)
Accessibility and mobility Cloud computing offers the possibility of accessing a service remotely, provided there is a portable device and network connection. Current network capabilities and ease of access to devices that support the Internet enables both users and citizens to perform important transactions from any location.
h)
Large number of possible providers Cloud computing is currently undergoing a period of expansion, evidenced by the broad range of services offered by the providers. There is a large variety of solutions that make it possible to hire cloud computing services within adequate economic and technical margins. This factor allows public authorities to make customised searches for a solution that best suits their needs.
11.2 WEAKNESSES a) Lack of specific procedures for the hiring of cloud computing services The Public Sector Procurement Law (TRLCSP) currently establishes hiring procedures for public authorities, but provides no models that envisage the peculiarities of cloud computing or budget scenarios aimed at favouring public and private partnership to boost cloud technology. b) Governance issues arising in the process of transformation towards shared services In most cases, only those groups belonging to the Central Government have sufficient experience to standardise and organise common services. This situation causes decentralization, giving rise to problems in the coordination and management of shared services oriented towards the cloud computing model by authorities with smaller jurisdictions. Means, budgets and skills differ between central government authorities and autonomous community or local government authorities. Occasionally, bodies with smaller territorial jurisdictions do not have the same capacity or means as their central government-level counterparts to embark on cloud-based projects. In this regard, the experts have pointed out that local government authorities suffer a certain degree of isolation. For this reason, one of the goals of cloud computing will be achieved by sharing means and resources.
Page 113 of 178
c)
Delocalisation of the information and loss of control One of the main factors to be taken into account when outsourcing a cloud computing service is based on the loss of control and traceability of the procedure followed when using the service and actual location of the data. Most public authorities use private citizen information, which makes them reluctant to relinquish their dominion over the physical and logical administration of information systems.
d)
Dependence on the provider on termination of the service Installing a cloud computing service based on the SaaS model may entail transferring all the data, application and management to the provider. This is why public authorities are reluctant to migrate certain critical services to the cloud environment. The main problems that can arise from a change in provider are associated with the lack of interoperability with other environments, preventing correct migration.
e)
Lack of flexibility for HR reorganisation Outsourcing a system may entail reorganising in-house personnel who were directly involved in service maintenance and management tasks. In this regard, public authorities offer little flexibility for large reorganisations.
f)
Failure to depreciate IT resources Several elements associated with the information systems of public authorities (servers, agreements with operators, consulting projects, etc.) are currently being depreciated, thereby undermining the feasibility of adopting new systems based on cloud computing.
g)
Lack of bandwidth at certain geographic locations Local government bodies found in geographical locations with less
telecommunications service coverage cannot access Internet-based services with the same guarantee of quality as other authorities. Telecommunications operators do not currently guarantee sufficient bandwidth throughout Spain, preventing small municipal councils from accessing basic services.
Page 114 of 178
h)
Inadequate analysis of preliminary considerations prior to hiring and during the provision of the service The percentage of public authorities that carry out risk analyses prior to implementing a cloud service is still relatively low. The number of authorities that demand certain security standards, certifications or establish mechanisms to control the tasks carried out by the provider to ensure good performance throughout the duration of the service is particularly low. Technology service management excellence is achieved through compliance with standards and certification of services. The first step to learn what types of risks can apply would be to carry out the related analysis. Similarly, the manner in which service quality levels can be guaranteed is to establish mechanisms to supervise the provider.
11.3 OPPORTUNITIES Most opportunities focus on the organisational and interoperability improvements that can be achieved by backing the technological infrastructure of Spanish public authorities using the cloud computing model. One of the greatest opportunities arising from an ordered, standardised adoption of cloud computing by all public bodies is the possibility of centralising the shared services required by each: technology platforms, custom solutions, hiring of service centres, etc. Sharing resources and common standards are the key to optimisation and savings in general. The implementation of a reliable, value-added tool developed expressly for public authorities in a cloud environment may entail, in turn, the provision of services and resources to other organisations, thus offering the possibility of passing on certain costs for its maintenance or other types of financing. Likewise, larger authorities would be able to offer part of their services to other bodies with fewer means, thereby fostering interoperability between environments and systems. As a result of the established hiring procedures, cloud computing is being implemented in the public sector less quickly than in the private sector. The public sector is just one step behind but must leverage the lessons learned from the private sector in order to achieve a more effective implementation with adequate optimisation of services and balanced risk management. Lastly, mention should be made of the opportunity for developing the Spanish cloud computing industry. The benefits would be twofold: firstly, public authorities will not have to consider possible international transfers of personal data and, secondly, it is a great opportunity for Spanish public authorities to drive the national economy.
Page 115 of 178
11.4 THREATS The main threats identified include the lack of regulatory compliance at international level and an excessive concentration of cloud computing services offered by providers. Those public authorities that opt to outsource a service must be fully aware of the location of the providers computer equipment and if any part of the communications network through which information travels is located abroad. Given the absence of an international legal framework to regulate the cloud computing model, the possibility of international data transfer must be defined in order to adopt the necessary measures. The economic advantages offered by the cloud model can significantly increase the migration of services to provider facilities. An erroneous forecast can lead to oversizing of the providers capabilities, undermining service quality. Therefore, public authorities must endeavor to obtain guarantees of provider capabilities and assurance of service quality.
Page 116 of 178
12
GOOD PRACTICES AND RECOMMENDATIONS
The development and implementation of cloud computing in Spanish public authorities must be based on a comprehensive analysis, reflection and decision-making process. The following sections summarise the recommendations made throughout the report. 12.1 STRATEGIC RECOMMENDATIONS Each body must define its own trusted cloud computing model that lays the bases for a strategy based on four objectives: o To provide a good service level, whilst protecting the confidentiality and integration of the information. To ensure the systems capability to accept a service in accordance with the requirements established by the organisation. To define the criteria for measuring the systems disaster recovery capability. To ensure compliance with specific legislation.
Whenever possible, promote interoperability through a shared-services infrastructure, deployed through private cloud technology, which will enable integration and concentration of services common to all the public authorities through shared infrastructures and service centres. To this end, it would be convenient to define a master plan for ICT in public sector entities aimed at consolidating and centralising shared services.
Evaluate decisions to migrate to cloud computing within the framework of the strategic and directive resolutions of the public authorities. Public oversight bodies must become involved in the decision-making process in order to guarantee the organisations cohesion in the transition towards these models. Analyse and identify service areas adequate for migration and the group of users that would best leverage the opportunities offered by cloud computing.
Evaluate and promote cloud computing within bodies as a potential cost saving and technology optimisation instrument to combat the budgetary adjustment situation and spending and deficit reduction requirements. At European level, the EU must compete with the positioning of North American providers through the implementation of a cloud strategy and a European cloud market.
Page 117 of 178
Therefore, European public authorities must also act as oversight bodies and drivers of the European cloud market, both by adopting said model with a view to their internal improvement and optimisation and by designing regulatory and executive tools for sector development. 12.2 TECHNOLOGICAL RECOMMENDATIONS Carry out an in-depth analysis of the market to identify existing solutions and possibilities and evaluate providers real capability to fulfill the requirements of the public authorities. Select a component of the applications and systems map which, although not critical, is representative in terms of volume and complexity, in order to develop a pilot experience. Initiate the cloud computing strategy by adopting private clouds and infrastructure (IaaS) and platform services (PaaS), i.e. models which to a large extent will allow bodies to retain overall control. Initially, in the SaaS scenario it is advisable to implement non-critical systems and very mature solutions (for example, e-mail or virtual desktop) and consider other, more critical alternatives, later. Plan the migration thoroughly. The computer hardware that will be transferred must be identified beforehand, as should the implications and cascade effects of migrating data and processes to the cloud. The migration process can be considered sequentially for each solution migrated: o In a first stage, it is advisable to migrate the heaviest applications to the cloud prior to migrating more sensitive data or processes. Once the functionality has been transferred to the cloud during the previous stage, the new working environment should be validated and full migration to the cloud will be completed using support mechanisms supplied by the provider. It is advisable to keep a full backup copy of the system in the traditional model for a prudential period of time. Cloud computing should also become positioned as a technology-pull model for other emerging technological trends or trends currently undergoing expansion, such as energy sustainability in the field of IT or open-source solutions.
Page 118 of 178
At European level, the focus should be on developing the cloud computing support solutions market: efficient deployment and configuration systems, service control and monitoring tools, security tools, power consumption control systems, etc.
12.3 MANAGEMENT RECOMMENDATIONS Manage process evaluation systems in order to measure the profitability of the effort required and define ROI indicators, as well as expectations for improvement. Manage the impact on the organisation and change management, as this generates additional costs that must be considered when planning a migration to cloud computing. Similarly, public authorities represent a rigid organisational and functional scenario; therefore, this aspect is particularly relevant. Develop new hiring models and practices that adapt to the cloud computing context within the framework of the Public Sector Procurement Law. The experience accumulated by the groups in charge of standardisation and organisation of shared services in the Central Government highlights a governance and coordination problem in the transformation process towards shared services and cloud. As a result, an oversight body should be assigned for each service to be migrated in order to manage the related area of competence, while disabling the decentralised management of the same service in other bodies. Identify and analyse, from the outset, the risks incurred by the organisation. It is important for risks to be identified in advance in order to monitor and mitigate them as soon as possible. For example, a good migration plan will enable elimination of the risks associated with transferring certain critical functionalities of the organisation. 12.4 REGULATION RECOMMENDATIONS Involve legal, technological and operations areas in the cloud computing strategy in order to prepare contractual instruments that adapt to the needs of this technology. Develop public/private partnership programs and consolidate the common and open technological standards that will govern the expansion of this technology in all public authorities and bodies.
Page 119 of 178
At European level, the public and private sectors should establish alliances and cooperation projects that facilitate the promotion of pan-European initiatives aimed at technological standardisation, interoperability and convergence towards a European cloud ecosystem.
The security measures applied, terms and conditions for accessing information, contingency measures, casuistry of service subcontracting, terms and conditions for contract termination and return of hired assets and services must be clearly stipulated in the contracts. Providers should guarantee, through contract or service-level agreements, compliance with security policies based on auditable standards and subject themselves to third-party controls and reviews that provide evidence of compliance with said policies. Providers should provide evidence of the cancellation and deletion of data belonging to public authorities upon termination of a contract therewith by means of a Certificate of Destruction/Deletion.
The contract should be subject to penalty clauses in the event of non-compliance with the service level agreements established. The inclusion of the providers obligation to take out a third-party liability insurance policy is highly recommended when the criticality of the service or the information transferred requires it.
Page 120 of 178
13
SUCCESS STORIES
13.1 INTERNATIONAL EXPERIENCES Internationally, there is great diversity of experience in the sphere of cloud computing applied to public authorities. Undoubtedly, the most noteworthy is the commitment made by the various government agencies in the United States, where cloud computing is already an implemented and consolidated reality. This section summarises some international success stories and benchmark experiences. 13.1.1 United States - USA.gov Portal
Project description USA.gov is the main information and online services channel for North American citizens, with more than 100 million hits per day.
Figure 4: USA.gov Portal
Source: www.usa.gov
Project justification Certain social events, such as mass querying, caused significant variations in portal traffic, which led to performance problems and even service outage. The Federal Government was unable to manage the demand and the service level using its own infrastructure, which resulted in the need to hire an external service to manage the processing and infrastructure needs in a more flexible manner adapted to actual demand.
In this context, the Government decided to migrate the platform to a laaS external service environment managed by a private company. Benefits The following benefits were obtained on migration of a part of the portal infrastructure to an external provider: 90% saving in operating costs and infrastructure, obtaining advantages in terms of flexibility, service availability and enhanced security. Shorter migration period (10 days). Service dimensioned according to fluctuations in traffic and demand, regulating the capacity to ensure high platform availability. External service hired to facilitate the inclusion of new security services for system access, communications and platform performance monitoring.
Adoption phase USA.gov has been operating in laaS mode since 2009. The Federal Government is evaluating the possibility of migrating the main government openData platform (www.data.gov) to a similar cloud model. Further information http://www.terremark.com http://www.usa.gov 13.1.2 United States - Apps.gov Platform
Project description The Apps.gov platform offers cloud solutions (infrastructure, information, applications, etc.) for government agencies in pay-per-use or free, open-source software mode. Through this platform various providers can integrate and showcase their product and service offering. The main solutions offered by the platform include, inter alia, the following: Business applications: financial management systems, dashboard, CRM, security, network, e-Commerce, etc. Productivity applications: management, etc. BPM, document management, collaborative
Page 122 of 178
IT-cloud services: storage, virtualised environments and web hosting. Social Media applications: Google Analytics, bing, My.ComMetrics, social text, etc.
Figure 5: Apps.gov Platform
Source: www.apps.gov
Project justification The project aims to make these applications available to small public bodies with budgetary constraints that prevent them from undertaking the technological investments required for management thereof, offering them a good alternative in terms of cost and services. Benefits All North American agencies may access this platform to acquire cloud services and applications of all kinds without incurring infrastructure implementation or maintenance costs of any kind. It is based exclusively on a pay-per-use model. Adoption phase Apps.gov has been available since 2009 and continues to include new third-generation cloud services and applications in its offering, which are at government agencies disposal. Further information http://www.apps.gov
Page 123 of 178
13.1.3
United Kingdom - G-Cloud
Project description The British Government opted for the creation of a private government cloud (G-Cloud), developed in-house, under restrictive security premises and standards that safeguard the confidential and critical nature of the public data managed.
Figure 6: G-Cloud
Source: Government Cloud Strategy: A sub-strategy of the Government ICT Strategy (2011)
Project justification The British Central Government is one of the most advanced at international level in terms of ICT adoption and of technological innovation in general. However, the cost assumed in the maintenance and evolution of the entire IT infrastructure and its personnel is an unrealistic burden in the current economic climate. Therefore, the initiative is justified within the cost savings and containment policy established in its new ICT plan. Expected benefits With this initiative the British Government aims to save more than GBP 3,000 million annually in IT costs and power on its total annual ICT budget of GBP 16,000 million. The development of a private government cloud for public bodies enables cost savings based
Page 124 of 178
on economies of scale, reductions in IT costs and operations (currently decentralised) and favours the reuse of services and components among different organisations. Additionally, the private and restricted nature of the network guarantees the required confidentiality and security of the information managed. Through this government cloud, all British public bodies will be able to house and outsource their infrastructures, services and applications in a secure, shared environment. Adoption phase The initiative is currently in the design and implementation phase. The British Government is clearly committed to this model and all the bodies are carrying out a planning and virtualisation process to migrate IT resources to the G-Cloud over the next few years. The objective is for 50% of the Governments infrastructures to be migrated to the GCloud in 2015. Further information http://webarchive.nationalarchives.gov.uk/+/http://www.cabinetoffice.gov.uk/media/317444 /ict_strategy4.pdf http://www.cabinetoffice.gov.uk/sites/default/files/resources/government-cloudstrategy_0.pdf 13.1.4 France - Andromeda Project
Project description The French Government has promoted the development of its own cloud computing system called the Andromeda Project. Andromeda arose from a public/private partnership agreement as a competitive French alternative to the leading international cloud service providers in the sector. Project justification The aim of the project is to provide cloud services located in France to French public entities and bodies, guaranteeing proprietary processing environments and storage of sensitive data within France. Leading French companies hire foreign cloud technology service providers, mostly in the US. This gives rise to certain risks in relation to the sovereignty and control of the information of these companies (and public bodies), as well as creating a competitiveness and business-loss problem in the local ICT industry.
Expected benefits Andromeda will offer a range of benefits to French public entities and bodies: The technological and cost benefits common to a cloud model provided by the local ICT sector for public entities and bodies. Guarantee that the service providers are located in France and strictly limited by the French regulatory framework in terms of data security and protection. This factor is particularly critical to the decision of public bodies to migrate to the cloud. Drive economic development and employment in a high added-value sector such as ICT. The promotion of the cloud through the Andromeda initiative will have a positive economic impact in the years following its adoption, as a result of the investment made using public and private capital, the generation or maintenance of employment in the sector and the potential for exporting the services to other countries, thereby positioning France as a competitive market compared to the North American market. Adoption phase The initiative was announced by the French Government in 2011. The companies selected in the operation included the telecommunications operator Orange, the technology company Thales and the French Government itself, which will contribute onethird of the investment, estimated at EUR 285 million in its initial phase. Further information At the time of publishing this report, only press releases and opinions on the initiative were available. 13.1.5 Colombia - Proexport-CRM (Cloud-Based) Project for SMEs
Project description Proexport-CRM is an application for SMEs implemented by the Colombian Ministry of Trade, Industry and Tourism to support SMEs in the management of international export processes, providing an IT system that offers them commercial and customer relationship management features. The project includes a CRM system (Sales Force on demand) which allows SMEs to manage their own marketing processes, leverage customer information, manage commercial contacts and the mass promotion of their products and services through Google more efficiently. All these benefits are accessible through SaaS services in pay-
Page 126 of 178
per-use mode, which allows SMEs to assume the cost and administration of the application. The characteristics of the application are as follows: Administration of opportunities, monitoring and updating of sales opportunities, including competitors, collaborators, customers, etc. Centralised administration of contacts and customers: access to historical customer and contact information integrated with marketing, product and service data. Segmentation of customer profiles: date of birth, socio-demographic and employment details, hobbies, consumer preferences, income level, etc. Sales monitoring and forecasts: consolidation of information and monitoring of sales force performance. Management of internal and customer-related activities: custom workflow for the sales process, task allocation, events and meeting coordination. Reporting and analysis: automation of sales process indicators and metrics using dashboard features.
Project justification As is the case in most countries, Colombian SMEs do not have the financial capacity, human resources, infrastructure and IT skills to implement the necessary information systems to improve their management, competitiveness and operating procedures in terms of sales. Proexport was developed with the objective of compensating for these shortcomings. Benefits The project involved automating the sales force of more than 200 Colombian SMEs, thus allowing them to implement the sales process with the backing of a technology adaptable to the needs of each company. Adoption phase The system has been available since 2009. Further information http://www.proexport.com.co
Page 127 of 178
13.1.6
Japan - Red cloud Kasumigaseki (Hatoyama ICT Plan)
Project description The Japanese Ministry of Internal Affairs and Communications promoted the Hatoyama Plan with the objective of developing the ICT sector and employment, and optimising technological management in public bodies. One of the initiatives envisaged in the Plan is the implementation of the Kasumigaseki cloud network, which will integrate services, platforms and infrastructures for most ministries in a centralised data processing environment, comprising shared services and online applications. It is expected to be available in 2015. Project justification The development of the local ICT sector is a priority of the Japanese Government in the creation of employment, economic development, fulfilment of the local demand for technology services and the sectors competitiveness in international markets. The creation of the Kasumigaseki cloud network achieves these objectives through the configuration of a more innovative and efficient public technological environment that will facilitate the improvement of online public services, interoperability and the reduction in the administrative costs of Japanese companies. Expected benefits The network is oriented towards the integration of the technology services and infrastructures of Japans government ministries. This integration will give rise to improved technological standardisation, sharing of services and interoperability of public bodies, which will have a positive impact on the quality and accessibility of the digital services provided to citizens and companies. Some of the most noteworthy services of the future Japanese cloud include the National Digital Archive, future repository of documents, case files and other official digital documentary assets of the Japanese Government, which will be made available to citizens in accessible formats in order to fulfil the principles of transparency and open data. Adoption phase The Hatoyama Plan was published in 2009 and the Kasumigaseki network is expected to be operational and available by 2015. Further information http://www.soumu.go.jp
13.1.7
Luxembourg - Integrated Biobank of Luxemburg (IBBL)
Project description IBBL is a platform that facilitates network cooperation and research for professionals in the research and medicine sector. The system allows access to updated information for the development of clinical trials and cooperation, providing additional and complementary information. In 2011 the EuroCloud Association awarded a prize to the project implemented by the Luxembourg company, EBRC, to provide healthcare professionals with access to the Biobanks resources through highly securitised procedures and transactions, despite the criticality and confidentiality of the information assets managed. Project justification The IBBLs management was seeking a data storage and management system, which complied with security requirements, in a shared access environment on an affordable, scalable, dynamic and flexible technology platform. Benefits The IBBL works as an intermediary body, facilitating cooperation between the different European research centres and bodies. Its main mission is to provide updated and confidential scientific information. Without hiring a specialised cloud provider and a custom technology platform, the IBBL would not have been able to assume the investment and the necessary operating resources to set up and administrate the shared scientific information system currently accessed by most European research institutions to consult or publish research data. The IBBLs current platform is housed in a private cloud subject to exhaustive processes to monitor and control service provider security and availability. In the event of having to resize the infrastructure, sufficient resources are available at various processing centres to balance the processing load and guarantee transaction performance. Adoption phase The initiative was implemented in and has been operational since 2011. In the same year it was awarded the EuroCloud Associations prize for the most innovative cloud project in the public authorities category. Further information http://trustedcloudeurope.com/Case-studies
Page 129 of 178
13.1.8
United States - NASA Nebula Project
Project description Nebula is a private cloud designed to support the missions, training, communication and storage of the North American Space Agency (NASA), providing a large variety of opensource services. The platform provides infrastructure and platform services for NASA, responding to the demand and flexible processing capacity required by the Agency during peak times. The Agency analysed the possibility of implementing Nebula in a public cloud environment, but the cloud computing sectors non-compliance with NASAs security standards and requirements led to the implementation of a project in a totally private environment. Nebula currently offers laaS mass processing and storage services that will evolve in forthcoming months towards an integrated PaaS solution. Project justification The Nebula project was initially founded by NASA to improve the performance, flexibility, security and availability of the Agencys web platforms in a more efficient and inexpensive environment. Benefits The system processing virtualisation achieved by implementing a cloud alternative has enabled greater flexibility, use and cost savings than would have been achieved using a traditional DPC model. Infrastructure operating and maintenance costs were also significantly optimised, with considerable reductions in component start-up time, significant power savings and benefits in terms of environmental sustainability. Adoption phase The project was implemented in 2009. Since 2010 its services have been used in complex analysis and weather simulation systems. Further information http://nebula.nasa.gov
Page 130 of 178
13.2 PROJECTS IN SPAIN The Spanish public authorities are being more conservative in the development of technological cloud computing initiatives. The projects implemented to date include nonbusiness critical infrastructures or services and pilot projects which enable evaluation of the benefits and value of the cloud in larger-scale projects. This section describes some of the most relevant cloud projects implemented in Spain in recent years. 13.2.1 Calpe Municipal Council - Virtual Desktop
Project description The Calpe Municipal Council provided its employees with a virtual desktop solution to optimise its workstations, which involved substituting its traditional PCs with light Sun Ray terminals running on the Solaris operating system. Similarly, a VDI (Virtual Desktop Infrastructure) system was implemented to ensure the centralized and secure administration of the desktops, thus reducing IT Department operating costs. Project justification The objectives pursued by the Councils IT managers were to optimise power consumption, and IT costs and operating times, and to comply with data protection legislation. Benefits It is estimated that the costs relating to maintenance, upgrading, microcomputing and user terminals have been cut by half. A virtual network environment facilitates better security management and compliance with the LOPD, since all user terminal information is stored in a centralised manner in the Councils servers and connections are made by means of a secure, duly encrypted protocol. The municipal councils DPC servers have also been virtualised, enabling maximum leverage of resources and power savings by concentrating several concurrent servers in a smaller number of physical machines. Adoption phase The Calpe Municipal Council embarked on this initiative in 2009.
Page 131 of 178
Further information The initiative was announced in press releases and specialist magazines. 13.2.2 Provincial Government of Salamanca - Web presence of the Municipal Council of Salamanca Project description The Provincial Government of Salamanca, through the public entities REGTSA and CIPSA, provides small municipal councils with a service for configuring and deploying municipal web sites. The web platform chosen was LocalWeb, developed by the Secretary of State for Telecommunications and the Information Society. The Provincial Government of Salamanca has centralised deployed of this platform and offers municipal councils, within the framework of collaboration agreements, an effective SaaS service for configuring municipal web sites. The portal environment provided includes various features and basic components, such as the services catalogue, a headline news area, the organic structure of the council, complaints and suggestions mailbox, integration with the electronic headquarters, etc. The municipal councils ascribed to the project only have to update and maintain the information that is published. Project justification The project is aimed at providing small municipal councils in the province of Salamanca with the resources required to comply with the provisions of the Law of Electronic Access of Citizens to Public Services, through a centralised portalisation and content management service that allows each municipal council to develop and deploy its own website without incurring development, infrastructure or maintenance costs. Benefits The main benefit of LocalWeb is the reduction in costs. Thanks to a portalisation and content management platform which allows the municipal councils ascribed to customise the image and administrate the contents of their web sites, municipal councils do not have to invest in licences, infrastructure or IT operating costs. Adoption phase The project was initiated in 2009 with a pilot project in six municipal councils. The second phase was initiated in 2010, with the inclusion of 100 additional councils.
Page 132 of 178
Further information http://www.regtsa.es 13.2.3 Sociedad de Gestin Pblica de Extremadura (GPEX) - Electronic tendering platform Project description GPEXs management has implemented an electronic tendering platform based on the cloud solution provided by the vortalGOV system. The vortalGOV platform provides any type of public body with access to an electronic tendering portal without incurring development, licence, infrastructure or maintenance costs. The service adopted by GPEX includes all the necessary functionalities for developing a fully electronic tendering process: from the approval and calls for tenders to the submission of electronic proposals, evaluation, and provisional and definitive award, all in a protected, secure and automated environment. Project justification The economic situation and advances in IT technologies justify GPEXs ongoing commitment to the implementation of an electronic tendering platform as a model for optimising the purchasing and awarding process, ensuring transparency, efficiency and concurrence of the procedure. Benefits This solution has enabled the entity to optimise its bidding processes for public works, services and normal supplies and has obtained significant savings and improved efficiency in the administrative management of awards and purchasing. The implementation of a proprietary electronic tendering platform would have involved a very high investment for the entity (in terms of licences and hardware) and high development and subsequent maintenance costs. The tendering companies are also direct beneficiaries of the system, thanks to the improvement in accessibility to information on tenders, the agility and transparency of the process and administrative cost savings in the procedure.
Page 133 of 178
Adoption phase The project commenced and was implemented in 2011, with the tender of two electronic procedures. Further information http://spain.vortal.biz 13.2.4 Correos - SISNOT electronic notification platform
Project description The Spanish Ministry of Finance and Public Administration, in cooperation with Correos y Telgrafos (Spanish Postal Service), has developed an electronic notification platform which enables the creation of secure notification mailboxes for citizens and the management of notification processes to public authorities subscribed to the service under the terms of the agreement. The platform managed by Correos includes two services provided by the entity: The Electronic Notification System (ENS) offers a certified, secure mailbox where citizens can receive official notifications certified, which guarantees an acknowledgement of receipt, safeguarding of documentation and time-stamping of the notification operations carried out. The Notification System (SISNOT) offers a service that manages the lifecycle of electronic notifications and all the security and encryption requirements to the public authorities and bodies subscribed to the service under the terms of the agreement. The system facilitates integration with the providers platforms through the use of standard web service protocols.
Project justification The enactment of Law 11/2007, on the Electronic Access of Citizens to Public Services, establishes the right of all citizens to be notified by the public authorities, with regard to public administration matters, via electronic means. This right implies that all Spanish public bodies, the Central Government, autonomous communities and local government bodies are obliged to develop and implement the necessary instruments to provide electronic notifications. In order to promote the reuse of public resources, optimise costs and empower public bodies with less capacity, the Ministry and the public entity, Correos y Telgrafos, jointly
Page 134 of 178
developed the electronic notifications solution which is accessible, under the terms of the agreement, to Spanish public bodies. Benefits According to Correos y Telgrafos, the main benefits of the SISNOT system are as follows: 30% reduction in the cost of sending notifications, considering only the Central Government, as a result of transforming postal notifications into electronic notifications. Introduction and promotion of the use of electronic notifications for communicating with large companies.
Adoption phase The platform was launched in 2003. At present, more than 40 entities are subscribed to the platform, with more than 230,000 e-mail addresses and more than 3.5 million notifications made. Further information http://administracionelectronica.gob.es 13.3 THE CLOUD STRATEGY OF THE US FEDERAL GOVERNMENT: THE VIVEK KUNDRA MODEL When analysing the most outstanding cloud precursors at international level, mention should be made of the role played by Vivek Kundra, who has transformed the cloud computing concept in recent years, as the leader of the US Central Governments IT strategy. In 2009, the President of the United States, Barack Obama, appointed a Federal Chief Information Officer, with the responsibility of directing and planning the policies and strategies of all the investments made in federal IT systems, being responsible for the expense incurred and the return on investment obtained, while respecting principles such as interoperability between systems, accessibility to information and adequate maintenance of levels of privacy. In recent years, Vivek Kundra has been the precursor of the development of multiple cloud computing-based projects for the US Central Government, with highly relevant credentials such as the usa.gov or apps.gov portals, or the migration to Google of the various environments used by government agencies.
Page 135 of 178
However, the main references and perspectives established by Kundra for deployment of cloud computing in government agencies are included in the recently published report Federal Cloud Computing Strategy 44 , which has already become a benchmark document for the sector at international level. In the aforementioned report, Kundra underlines his commitment to the progressive implementation of cloud solutions at the various Federal Government agencies as a solution to optimise an underused technology resource and service environment, subject to a fragmented and variable processing demand, with very high operating costs and inefficient deployment of infrastructures and services in order to guarantee the quality of public services to US citizens. Under these premises, Kundra designed the Federal Governments new cloud strategy with the following objectives: To clarify and disseminate the benefits and potential of the cloud among US public bodies. To identify the services, activities and information systems of US public bodies most susceptible for migration to cloud environments. To provide public bodies with a tool to analyse and plan their process of migration to cloud, following an efficient assessment and implementation strategy: o Selection of IT services susceptible for migration to the cloud in terms of cost/benefit and opportunity. Implementation of the process to migrate the service to cloud, ensuring improved capability, system integration, fulfilment of initial requirements, guaranteed security and reuse of freed resources. o Managing cloud computing implies transforming the IT function to a service monitoring function through SLAs (instead of monitoring systems), developing new skills and knowledge in IT personnel and controlling fulfilment of agreements established with the provider and the security conditions implemented by means of periodic audits.
44
Vivek Kundra (2011): Federal Cloud Computing Strategy.
Page 136 of 178
APPENDIX I: BIBLIOGRAPHY
Avanade (2011). Research & Insights: Global Survey: Has Cloud Computing Matured? Third Annual Report June 2011. Cloud Computing Journal (2011). Denial of Service Attacks and the Cloud. Available at: http://cloudcomputing.sys-con.com/node/1747821 Deloitte (2009). Cloud Computing. Forecasting Change. Available at: https://www.deloitte.com/assets/DcomGlobal/Local%20Assets/Documents/TMT/cloud__market_overview_and_perspective.pdf ENISA (2011). Security & Resilience in Governmental Clouds.
Available at: http://www.enisa.europa.eu/act/rm/emerging-and-futurerisk/deliverables/security-and-resilience-in-governmental-clouds Expert Group Report (2010). The Future of Cloud Computing. Opportunities for European Cloud Computing beyond 2010. Forbes (2011). Cloud Computing hidden Green Benefits.
Available at: http://www.forbes.com/sites/joemckendrick/2011/10/03/cloudcomputings-hidden-green-benefits/ Forbes (2011). The Economic Benefits of Cloud Computing. Available at: http://www.forbes.com/sites/kevinjackson/2011/09/17/the-economicbenefit-of-cloud-computing/ Forrester Research (2011). The ROI of Cloud Apps.
Available at (requires http://www.forrester.com/rb/Research/roi_of_cloud_apps/q/id/59277/t/2
registration):
Fundacin Bankinter (2010). Cloud Computing: La tercera ola de las Tecnologas de la Informacin (Cloud Computing: The third wave of information technologies).
Fundacin Ideas (2011). Cloud Computing: Retos y Oportunidades (Cloud Computing: Challenges and Opportunities). Available at: http://www.fundacionideas.es/sites/default/files/pdf/DTCloud_Computing-Ec.pdf
Gartner (2011). Forecast: Public Cloud Services, Worldwide and Regions, Industry Sectors, 2010-2015.
IDC (2010). Worldwide and Regional Public IT Cloud Services 2010-2014 Forecast.
Page 137 of 178
IDC Espaa (2011). Cuando las empresas se rinden al Cloud (When companies embrace the Cloud). Sponsored by Microsoft Espaa EMC and Acens.
NIST (2011). The NIST Definition of Cloud Computing. Available at: http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf Serrera Cobos, Pedro (2010). Cloud computing y proteccin de datos (Cloud Computing and Data Protection). Published in Dintel, No. 9, pages 182-184, June 2010.
University of California at Berkeley (2009). Above the Clouds: A Berkeley View of Cloud Computing. Available at: http://www.eecs.berkeley.edu/Pubs/TechRpts/2009/EECS-2009-28.pdf
Page 138 of 178
APPENDIX II: LIST OF EXPERTS

This study was prepared with the participation of experts of the various public authorities responsible for developing technology policies in their respective territorial jurisdictions. Each expert contributed his/her knowledge and experience in the field of information technologies and communication, the use of information systems in public authorities and his/her understanding of the new paradigm represented by cloud computing. Also noteworthy is the high degree of cooperation involved in the preparation of this study by the bodies and professionals who participated in the interviews. Following is a list of the experts interviewed.
Table 8. List of experts interviewed
Central Government Spanish Institute for Foreign Trade (ICEX). Ministry of Industry, Energy and Tourism. 45 Ministry of Employment and Social Security. 46 Ministry of Finance and Public Administration. 47 Ministry of Finance and Public Administration. 49 Autonomous Communities Tracasa (Navarre). Autonomous Community Government of Andalusia. Autonomous Community Government of Catalonia.
Expert and position Carlos Gonzlez. IT Division Manager. Carlos Maza. Deputy General Manager of IT Technologies and Communications. Eladio Quintanilla. Social Security IT Manager. Fernando de Pablo. Former General Manager for the Promotion of the eGovernment. 48 Raquel Poncela. Assistant Deputy General Manager of Information Technologies. Expert and position Javier Amzqueta. IT Manager. Jos Antonio Cobea. General Manager of Technologies for Finance and eGovernment. Tomas Roy Catal. Director of the CESICAT. Responsible for Quality, Security and Supplier Relations.
45 46 47 48 49
Former Ministry of Industry, Tourism and Trade. Former Ministry of Employment and Social Affairs. Former Ministry of Territorial Policy and Public Administration. Position associated with the former Ministry of Territorial Policy and Public Administration. Former Ministry of Economy and Finance.
Page 139 of 178
Local Government entities Asturian Consortium of Technological Services (CAST). Madrid Municipal Council.
Expert and position Mara Jos Villanueva. General Manager. Jos Antonio Martn Prez. Deputy General Manager of Corporate IT Systems.
Source: INTECO
Page 140 of 178
APPENDIX III: SOLUTIONS WITH GREATEST PRESENCE AT NATIONAL AND INTERNATIONAL LEVEL
In order to obtain a more detailed overview of the state of the art in relation to the cloud computing solution offering, this section lists and describes the solutions which are having the greatest success and impact on the market. To this end, the following table provides a description of information from market analysts such Forrester, Gartner and IDC 50 , distributed by type of solution: IaaS, PaaS and SaaS.
Table 9. Main solutions
laaS Solutions Computing services Storage services Backup services PaaS Solutions Integrated application server Data integration Database management system (DBMS) Managed file transfer (MFT) Application security Application and B2B integration App marketplaces User experience platform (UXP Portals) Business Process Management technology (BPM) App life cycle management (ALM) Messaging middleware Extreme transaction processing (eXtreme TP)
Forrester Research (2011). The ROI of Cloud Apps. http://www.forrester.com/rb/Research/roi_of_cloud_apps/q/id/59277/t/2
50
Available
at
(requires
registration):
Gartner (2011). Forecast: Public Cloud Services, Worldwide and Regions, Industry Sectors, 2010-2015. IDC (2010). Worldwide and Regional Public IT Cloud Services 2010-2014 Forecast.
Page 141 of 178
SaaS Solutions Content, Communication and Collaboration (CCC) Enterprise Content Management (ECM) e-Discovery e-mail Search Team collaboration Web conferencing Customer Relationship Management (CRM) Sales Marketing Customer service and support Digital Content Creation (DCC) Enterprise Resource Planning (ERP) Human Capital Management (HCM) Financial Management System (FMS) Manufacturing and operations Office Suites Project and Portfolio Management (PPM) Supply Chain Management (SCM) Sourcing/procurement Supply chain planning (SCP) Warehouse management system (WMS) Transportation management system (TMS) Global trade compliance Service parts planning (SPP) Other Expense management Compliance management system (CMS) e-Learning Enterprise instant messaging Storage Retail management system (RMS)
Source: prepared in-house based on Forrester and Gartner
IAAS SOLUTIONS
A classification of the most successful laaS solutions offered by suppliers by the different types of cloud service infrastructure solutions, gives rise to the following service distribution 51 :
51
Gartner (2010): Magic Quadrant for Cloud Infrastructure as a Service and Web Hosting.
Page 142 of 178
1)
Computing services Cloud computing services offer customers the possibility of increasing their computing capabilities, without having to incur capital expenses that would entail the acquisition of the physical hardware required to maximise said capability.
2)
Storage services The storage solutions included in infrastructures such as the cloud service follow a business model whereby a provider hires space in its own storage infrastructure for use by an organisation or individual. The main advantage of hiring a cloud storage service in a company is the cost savings, including cost related to staff, hardware and physical storage space. The use of this type of service is generally widespread among institutions that lack the capital or technical personnel to implement and maintain their own storage infrastructure on their own premises. The use of this type of cloud solution as a means of mitigating the risks associated with disaster recovery is also becoming widespread, since it provides long-term data retention, as well as improved availability and business continuity.
3)
Backup services The backup service, whether it is remote, online or administrated, is a service that provides users with a system for periodically copying and storing computer files in the providers infrastructure. These files can subsequently be recovered in the case of a failure. the replacement of equipment, temporary data loss or the need for data recovery after a disaster.
II
PAAS SOLUTIONS
Following is a detail of the most widely implemented types of PaaS service solutions, together with a description thereof 52 : 1) Integrated Application Server An application server is a modern middleware platform, i.e. software located between the operating system, external resources (such as a DBMS, communications services and the Internet) and user applications. The role of the application server is to act as a warehouse (or repository) for business user models, while facilitating access to and execution of the applications installed therein.
52
Gartner (2011): PaaS Road Map: A Continent Emerging.
Page 143 of 178
2)
Data integration These solutions allow developers and system integrators to create, share and reuse customised data integrations and data quality mapping, and execute them in the cloud. These solutions allow developers to cooperate actively with IT teams to create integrations of reusable data and quality data mapping in the cloud or on their own premises. Also, business users can configure their own data integration rules or execute mappings created by the IT departments using PaaS data integration services.
3)
Database management systems (DBMS) DBMS is a product used to control the organisation, storage, recovery, security and integrity of the data contained in a database. The characteristic functionalities of this type of PaaS solution are as follows: It is capable of accepting requests sent by the applications, informing the operating system of which data is adequate for transfer. It can be operated using traditional programming languages or include its own programming language for application development. It allows information systems to be changed with greater ease in line with changes in the organisations needs. Data security: the DBMS prevents unauthorised users from seeing or updating information in the database. Data integrity: the DBMS guarantees that two or more users cannot update the same record simultaneously.
4)
Managed file transfer (MFT) MFTs are solutions that facilitate secure data transfer from one computer to another via a network (e.g. via the Internet). They are characterised, inter alia, by the following functionalities: Accept different exchange protocols (FTP/S, SFTP, SCP, HTTP/S, etc.). Secure file transfer via public and private networks. Secure file storage.
Page 144 of 178
5)
Generation of detailed reports on users and their activities.
Application security The providers that offer this type of PaaS service offer a scalable and flexible security solution that protects customer applications from external threats, reduces the risk of data loss and ensures effective compliance with the applicable legislation.
6)
Application and B2B integration These refer to platforms that integrate corporate applications, establishing the commercial relationship by means of telematic networks, between two institutions.
7)
App Marketplaces App Marketplaces are platforms placed at the customers disposal by the provider, where the user can find a large variety of the tools or applications available on the market for use for, inter alia, business, management or training purposes.
8)
User Experience Platforms (UXP Portals) An UXP is an integrated group of platforms aimed at providing a comprehensive user interface and interaction capabilities. Their main characteristics and functionalities include web portals, mashups (web pages or applications that combine data or functionalities from two or more sources), content management, collaboration, mobile telephones, analyses, searches, e-Commerce, an application platform, a global design framework and management services.
9)
Business Process Management (BPM) technology BPM refers to a type of business management which integrates the companys processes, people and technology systems for the purpose of facilitating the development of the companys business strategy.
10)
App life cycle management (ALM) The ALM platform encompasses the entire life cycle of a computer application (from the moment of its definition to its deployment and subsequent maintenance), through the governability, development and maintenance thereof.
11)
Messaging middleware This platform provides an application interface, allowing asynchronous two-way data transfer. The data sent by an application can be temporarily stored in another
Page 145 of 178
application and be sent to other programs that require them when they are available to carry out the data exchange process. 12) Extreme Transaction Processing (eXtreme TP) This type of tool is used to support the design, development, management and maintenance of distributed transaction processing (TP), transactions characterised by high performance demand, scalability, availability, security, management capacity and reliability requirements. III SAAS SOLUTIONS
Following is a detail of the SaaS solutions most commonly offered by providers 53 , classified by type: 1) Content, Communications and Collaboration (CCC) a) Enterprise Content Management (ECM). This represents both a strategy for addressing all kinds of unstructured content and a suite of software products for managing the entire corporate content life cycle. It includes document, record and web content management, document image capture on paper, social content, unstructured data (documents, images, video), mainly for human use, etc. Electronic identification (e-Discovery). This software allows identification, preservation, extraction, preparation, review and processing of information stored electronically, in relation to legal and governmental procedures. Content and record management, search and access to information, and preservation and storage of e-mails, are the basic functionalities associated with electronic identification or e-Discovery. c) E-mail. A cloud solution consisting of software which enables the electronic transmission of messages (including text and attached files) from one computer, or other computer hardware, to another located on or off the organisations premises. Search. Software that offers the user the option of implementing, on their own website, a tool the main functionality of which is to search for information and documentation available on the network. Team collaboration. Tools that offer resources for establishing communication and cooperation between the different members of a team. Its functionalities
b)
d)
e)
53
Gartner (2011): Forecast: Software as a Service, Worldwide, 2010-2015, 1H11 Update.
Page 146 of 178
include, inter alia, online communities, social networks, discussion forums, blogs and instant messaging. f) Web conferencing. Tools that enable conferences in real time over the network. The functionalities offered by these tools range from content delivery (shared use of applications, text chat, electronic document markup, etc.) to integrated audio services or remote control of equipment.
2)
Customer Relationship Management (CRM) a) Sales. Tools which enable management of sales-related customer information (from storing and organising information to integrating, processing and analysing it). Marketing. Software which enables management of information gathered from an entitys existing and potential customers. It is mainly a corporate marketing tool which, in the same way as other CRM-type cloud solutions, enables the storage, organisation, integration, processing and analysis of all the information on the aforementioned existing and potential customers. Customer service and support. This tool enables the provision of information and technical support services to users by storing, processing and analysing the information received in order to provide the best possible solution in the shortest possible time.
b)
c)
3)
Digital Content Creation (DCC) This software is designed to develop digital material of journalistic, educational and ludic interest (animations, graphics, images, video, etc.) for distribution over the Internet or by other electronic means.
4)
Enterprise Resource Planning (ERP) a) Human Capital Management (HCM). This refers to a set of practices related to the management of the entitys human capital. These practices are centred on the organisations need to provide specific competences and are implemented under three categories: personnel recruitment, personnel management and personnel optimisation. The tools which enable management of the entitys human capital include, inter alia, the functionalities required to cover payroll-related processes, personnel planning, training, and recruitment and hiring; performance, competence, time and cost management; and administration of employee benefits and personnel.
Page 147 of 178
b)
Financial Management System (FMS). These applications enhance the visibility of a companys financial position by automating and supporting the processes of any activity that has a financial impact on the entity. They also generate financial data reports, as required by local and international regulations. This type of application includes those relating, inter alia, to financial consolidation, cash and cash management, accounting, tax management and dashboards. Manufacturing and operations. These tools are designed for the manufacturing industry, and the related functionalities are based on the organisation, control, monitoring and differentiation of the manufacturing process, with a view to optimising this process, reducing costs and increasing associated profit margins.
c)
5)
Office suites A set of programs prepared for use by an entitys employees on a daily basis. The components of the suite are generally distributed in groups, have a similar user interface and, in general, can interact with each other. Examples of software packages or office suites include software packages that include word processors, spreadsheets, presentation editors, database managers, etc.
6)
Project and Portfolio Management (PPM) PPM is a term used by project managers and project management offices (PMO) to describe the analysis and collective management methods used for a group of projects that are underway, planned or proposed. The key functionalities on which PPM tools are based include: establishment of milestones and project planning; follow-up of progress and project deadlines; management of project programs; assignment of profiles and permits; and analysis and prioritisation of the project portfolio.
7)
Supply Chain Management (SCM) a) Sourcing/Procurement. This type of application is used to help companies to understand and improve trading terms and conditions, and to understand the source of the expenses incurred by the company. These applications also help to select suppliers, to analyse their performance and to establish the terms of trade to balance costs, quality and risk. The modules included in this type of application include, inter alia, electronic acquisition, strategic procurement, management of contractors, tactical procurement and cost analysis.
Page 148 of 178
b)
Supply Chain Planning (SCP). Supply Chain Planning is the process for coordinating all the assets in order to optimise the delivery of goods, services and information from the supplier to the customer, thereby balancing the supply and demand. Supply Chain Planning software is the keystone of a transaction system, providing the planning required for real-time demand commitments, leveraging its capacity to analyse scenarios and taking possible supply limitations into account.
c)
Warehouse Management System (WMS). A warehouse management system is a key part of the supply chain and is primarily concerned with controlling the movement and storage of material in a warehouse and processing the associated transactions, including shipment, receipt, putting away and picking out/selecting. These systems also direct and optimise the putting away of stock on the basis of real-time information on batch use status. Transportation management system (TMS). TMSs are used to plan the movement of goods, evaluate cargo and purchase orders for all modes of transportation, select the most adequate routes and carriers, and manage any associated billings and payments. Global trade compliance. This application is in charge of standardising the cargo electronic information requirements on inbound, outbound and in-transit shipments. This is essential in order to guarantee the secure movement of goods worldwide. Service Parts Planning (SPP). SPP cloud solutions include planning the supply and distribution of maintenance parts (spare parts and accessories) within an integrated logistics network.
d)
e)
f)
8)
Other a) Expense management. Expense management applications are systems installed by a company to process, pay and audit the expenses incurred by its employees. Expense management also includes the policies and procedures that govern this expense, as well as the technologies and services used to process and analyse the associated data. Compliance management system (CMS). This type of software is in charge of carrying out the entire process for gathering and evaluating information on both customer and investor funds, including self-monitoring and verification reports, in order to prove that the fund transactions comply with the requirements of the
b)
Page 149 of 178
Securities and Exchange Commission in the US or the Financial Services Authority in the UK. e-Learning. Electronic learning or e-Learning is the use of the Internet for nonclassroom training. Cloud e-Learning products are cloud-based software solutions which enable automation and administration of content, as well as Internet-based training and learning. These products integrate Learning Management Systems (LMSs), virtual classrooms, virtual courses Learning Content Management Systems (LCMSs). Enterprise instant messaging. Enterprise instant messaging applications are a form of real-time communication based on the insertion of a text directly in a chat between two or more employees using their PCs or other devices which have the application installed and network access. The information and documentation exchanged by the users of the application is transmitted via a network, e.g. the Internet. The most advanced instant messaging programs also enable improvement of communication methods, incorporating functionalities such as live voice, videocall, the inclusion of links to the media or sharing and visualisation of a range of devices and resources. c) Storage. This type of software is comprised of applications for implementing virtualised storage, which consists of merging multiple network storage devices into what appears to be a single storage unit from the users point of view. The use of storage virtualisation is widespread in local Storage Area Networks (SANs), high-speed sub-networks of the shared storage devices, where the application allows filling, backup and data recovery tasks to be performed faster and more easily. d) Retail management system (RMS). These are systems that offer SME retailers a complete point of sale. They enable the automation not only of the processes associated with the different points of sale, but also of warehouse operations, enabling retailers with multiple stores to centralise control of all their resources.
Page 150 of 178
APPENDIX IV: LIST OF BODIES PARTICIPATING IN THE SURVEY

AENA Aeropuertos, S.A. (AENA Agrupaciones de Municipios. of Spanish Airports and Air Navigation, S.A.) Agncia Catalana de la Joventut (Catalan Youth Agency). Agencia de Acreditacin -FGUPMUPC- de Proyectos en Investigacin, Desarrollo e Innovacin Tecnolgica, S.L. (Accreditation Agency -FGUPM-UPCfor Research, Development and Technological Innovation, S.L.) Agencia de Medio Ambiente y Agua de Andaluca, formerly EGMASA (Environment and Water Agency of Andalusia). Agencia Espaola de Proteccin de Datos (Spanish Data Protection Agency). Agencia Espaola de Seguridad Alimentaria y Nutricin (Spanish Agency for Food Safety and Nutrition). Agencia Estatal Antidopaje (Spanish State Anti-Doping Agency). Agencia Estatal de Meteorologa (Spanish National Meteorology). Institute of. Albarracn (Groupings Municipalities. Albarracn).
Aguas de la Cuenca del Ebro, S.A. (Ebro Basin Waters, S.A.) Aguas de Las Cuencas
Mediterrneas, S.A. (Mediterranean Basin Waters, S.A.) Araba Logstica, Logstics, S.A.) S.A. (Araba
Asociacin Centro de Desarrollo Rural Serrana de Ronda - CEDER (Serrana de Ronda Rural Development Centre - CEDER).
Asociacin de Desenvolvemento Comarcal Terra Cha (Terra Cha Association Development). for Regional
Asociacin Desarrollo Rural Comarca Bajo Guadalquivir Adelquivir (Adelquivir Association for the Rural Development of the Bajo Guadalquivir Region). Asociacin Desarrollo Rural
Comarca de Sierra Magina. (Association for the Rural Development of the Sierra Magina Region). Asociacin Desarrollo Rural Integral Serrana Suroeste Sevillana (Association for the Integral Rural
Agencia Estatal de Seguridad Area (Spanish State Air Security Agency).
Page 151 of 178
Development of the Serrana Suroeste Sevillana Region). Asociacin Desarrollo Sierra Sur (Association for the Development of Sierra Sur). Asociacin Desarrollo SocioEconmico la Loma y las Villas (Association for the Social and Economic Development of La Loma and Las Villas). Asociacin Desarrollo Sostenible del Poniente Granadino (Association for the Sustainable Development of the Poniente Granadino Region). Asociacin Promocin Econmica de la Vega - Sierra Elvira (Association for the Economic Promotion of Vega-Sierra Elvira). Asociacin Promocin Turstica de la Axarquia (Association for the Tourist Promotion of Axarquia). Autoridad Portuaria de Almera
Autoridad Portuaria de Ferrol - San Cibrao (Ferrol-San Authority). Cibrao Port
Autoridad Portuaria de Gijn (Gijn Port Authority). Autoridad Portuaria de A Corua (A Corua Port Authority).
Autoridad Portuaria de (Mlaga Port Authority).
Mlaga
Autoridad Portuaria de Marn y Ra de Pontevedra (Marn and Ra de Pontevedra Port Authority).
Autoridad Portuaria de (Melilla Port Authority).
Melilla
Autoridad Portuaria de Motril (Motril Port Authority).
Autoridad Portuaria de (Pasajes Port Authority).
Pasajes
Axencia Galega de Emerxencias (Emergency Management Agency of Galicia).
(Almeria Port Authority). Autoridad Portuaria de Baha de Cdiz (Bay of Cdiz Port Authority). Autoridad Portuaria de Baleares
Banc de Sang i de Teixits (Blood and Tissue Bank of Catalonia). Boletn Oficial de la Comunidad de Madrid (Official Gazette of the Autonomous Community of Madrid).
(Balearic Islands Port Authority). Autoridad Portuaria (Bilbao Port Authority). de Bilbao
Autoridad Portuaria de Cartagena (Cartagena Port Authority).
Canal de Experiencias Hidrodinmicas de El Pardo (El Pardo Hydrodynamics Experience Channel).
Autoridad Portuaria de Ceuta (Ceuta Port Authority).

Page 152 of 178
Cartagena
Puerto
de
Culturas,
Centro
de
Innovacin
S.A.U. (Cartagena Port of Cultures, S.A.U.) Cartogrfica de Canarias, S.A. (Canary Islands Cartography, S.A.) Cartuja 93, S.A. (Cartuja 93, S.A.) Casa Consorcio del Traductor. Centros Europeos de Empresas e Innovacin de Castilla y Len, S.A. (European Business and Innovation Centres of Castilla y Len, S.A.) Centre de la Propietat Forestal (Catalonian Centre for Forest Property). Centre de Medicina Regenerativa de Barcelona, Fundaci Privada (Centre of Regenerative Medicine in Barcelona, Private Foundation). Centre de Recursos per a la Protecci de la Salut i el Medi Ambient (Health and the Environment Resource Centre). Centre Tecnologic Forestal de
Transferencia de Tecnologas de Andaluca, S.A.U. (Technology Innovation and Exchange Centre of Andalusia, S.A.U.). Centro de Investigaciones Sociolgicas (Centre for Sociological Research). Centro de Promocin de la
Artesana "Mezquita de Torneras" (Mezquita de Torneras Centre for the Promotion of Craftwork). Centro de Supercomputacin de Galicia (Galicia Supercomputing Centre). Centro de Transportes de
Mercancas de Sevilla, S.A. (Goods Transportation Centre of Seville, S.A.). Centro Intermodal de Logstica, S.A. (Internode Logistics Centre, S.A.). Centro para El Desarrollo Tecnolgico Industrial (Centre for the Development of Industrial Technology). Centro Regional de Diseo de
Catalunya (Forest Centre of Catalonia).
Technology
Centro de Estudios Jurdicos (Centre for Legal Studies). Centro de Estudios Polticos y
Castilla-La Mancha Design Centre of Mancha).
(Regional Castilla-La
Constitucionales (Centre for Political and Constitutional Studies). Centro de Innovacin Turstica de Andaluca (CINNTA) (Tourism Innovation Centre of Andalusia).
Centro Superior de Idiomas de la Universidad de Alicante, S.A. (Alicante University Advanced Language Centre, S.A.).
Page 153 of 178
Centro
Universitario
Centro
Confederacin
Hidrogrfica
del
Asociado de la UNED en Ponferrada (Associated Centre of the Spanish National University of Distance Learning). Centro Universitario de la Defensa: Academia General del Aire de San Javier (University Centre of Defence: San Javier General Air Force Academy). Centro Universitario de la Defensa: Escuela Naval Militar de Marn (University Centre of Defence: Marn Naval Military School). CIBER del rea de Bioingeniera, Biomateriales y Nanomedicina (CIBER - Area of Bioengineering, Biomaterials and Nanomedicine. CIBER del rea de Enfermedades Raras (CIBER - Area of Rare Diseases). Ciudad de la Luz, S.A. (City of Light, S.A.). Comarca de El Bierzo (El Bierzo Region). Comarca de la Ribagorza
Cantbrico (Hydrographic Confederation of Cantabria). Confederacin Hidrogrfica del Duero (Hydrographic Confederation of the Duero River Basin). Confederacin Hidrogrfica del Ebro (Hydrographic Confederation of the Ebro River Basin). Confederacin Hidrogrfica del Guadiana (Hydrographic Confederation of the Guadiana River Basin). Confederacin Hidrogrfica del
Mio-Sil (Hydrographic Confederation of the Mio-Sil River Basin). Confederacin Hidrogrfica del Segura (Hydrographic Confederation of the Segura River Basin). Consejo de la Juventud (Youth Council). Consejo de la Juventud de Espaa (Spanish Youth Council). Consejo de la Juventud La Rioja (La Rioja Youth Council). Consejo Econmico Social (Economic and Social Council). Consell Catal de la Producci Agraria Ecolgica (Catalan Organic Farming Council). Consorci Alt Urgell XXI (Alt Urgell XXI Consortium).
Page 154 of 178
(Ribagorza Region). Comarca de Tarazona y El Moncayo (Tarazona and El Moncayo Region). Compaa Espaola de
Reafianzamiento, S.A. (Spanish Rebonding Company, S.A.). Comunidad de Villa y Tierra de Portillo.
Consorci
Auditori
i and
Consorci per a la Defensa de la Conca del Riu Bess (Consortium for the Protection of the Bess River Basin).
L'Orquestra(Auditorium Orquestra Consortium).
Consorci de Biblioteques de Barcelona (Consortium of Barcelona Libraries). Consorci de Fira de Terrasa
(Terrassa Trade Fair Consortium). Consorci de Formaci i Iniciatives del Bages (Bages Training and Initiatives Consortium). Consorci de Les Drassanes Reials i Museu Maritm de Barcelona (Consortium of Royal Shipyards and Maritime Museum of Barcelona). Consorci de Medi Ambient i Salut Pblica de la Garrotxa (La Garrotxa Environmental and Public Health Consortium). Consorci de Turisme del Valls Oriental (Valls Oriental Tourism Consortium). Consorci del Museu Comarcal del Montsi (Montsi Regional Museum Consortium). Consorci El Far Centre del Treballs del Mar (El Far Sea Front Project Consortium). Consorci Localret Consortium). (Localret
Consorci per a la Gesti de la Televisi Digital Terrestre del Camp de Tarragona (Camp de Tarragona Terrestrial Digital Television Management Consortium). Consorci per a la Gesti de Residus Urbans de la Segarra (Segarra Urban Waste Management Consortium). Consorci per a la Gesti de Residus Urbans d'Osona (DOsona Urban Waste Management Consortium). Consorci per a la Promoci Turstica de la Vall de Sau-Collsacabra (Vall de Sau-Collacabra Tourism Promotion Consortium). Consorci Pla de Cala Millor (Cala Millor Plan Consortium). Consorci Pla D-Marratxi (D-Marratxi Plan Consortium). Consorci Pla D-Santanyi Santanyi Plan Consortium). (D-
Consorci Pla D-Soller (D-Soller Plan Consortium). Consorci Port Matar (Matar Port Consortium). Consorcio Ciudad de Toledo (City of Toledo Consortium).
Consorci Patrimoni Mundial de la Vall de Boi (Vall de Boi World Heritage Consortium).
Page 155 of 178
Consorcio
de
Compensacin
de
Seguros (Insurance Compensation Consortium). Consorcio de Estados de Duque (Estados de Duque Consortium). Consorcio de Infraestructuras
Biosphere Consortium). Consorcio
Reserve
Island
Museo
Etnogrfico
Extremeo Gonzlez Santana (Gonzlez Santana Ethnographic Museum of Extremadura Consortium). Consorcio para la Gestin, Conservacin y Explotacin del Tnel de Bielsa-Aragnouet (Consortium for the Management, Preservation and Operation of the Bielsa-Aragnouet Tunnel). Consorcio Tratamiento de Residuos Slidos de Ciudad Real (Ciudad Real Solid Waste Treatment Consortium). Consorcio Valencia 2007 (Valencia 2007 Consortium). Consorcio Zona Norte de vila (Northern vila Consortium). Corporacin Sanitaria y Universitaria del Parc Tauli (Parc Tauli Health and University Corporation). CTI Tecnologa y Gestin, S.A. (CTI Technology and Management, S.A.). Empredinser, S.L.U. Empresa Nacional de Residuos Radiactivos, S.A. (Spanish National Radioactive Waste Company, S.A.). Empresa Pblica Sociedad de
Deportivas de Cantabria (Sports Infrastructure Consortium of Cantabria). Consorcio de la Ciudad de Santiago de Compostela (Consortium of the City of Santiago de Compostela). Consorcio de la Zona Franca de Cdiz (Consortium of the Customs Free Zone of Cdiz). Consorcio de la Zona Franca de Vigo (Consortium of the Customs Free Zone of Vigo). Consorcio de Prevencin, Extincin de Incendios y Salvamento de la Isla de Tenerife (Tenerife Fire Prevention and Extinction and Rescue Services Consortium). Consorcio de Seguridad, Emergencia, Salvamento, Prevencin y Extincin de Incendios de Lanzarote (Lanzarote Safety, Emergency, Rescue, Fire Prevention and Extinction Services Consortium). Consorcio de Servicios Sociales de Albacete (Albacete Social Services Consortium). Consorcio Insular de la Reserva de la Biosfera de la Palma (La Palma
Servicios del Principado de Asturias, S.A. (Spanish Public Services Entity of the Principality of Asturias, S.A.).
Page 156 of 178
Ens Public de Radiotelevisi de Les Illes Baleares (Public Radio and Television Company of the Balearic Islands).
Equipos
Termometlicos,
S.A.
(Thermometal Equipment, S.A.). Escuela Superior de Hostelera de Aragn, S.A.U. (Higher School of Catering and Tourism of Aragn, S.A.U.). Estacin de Invierno de Manzaneda, S.A. (Manzaneda Winter Resort, S.A.). Euskal Museoa Bilbao Museum of Bilbao). (Basque
Ente Regional de la Energa Castilla y Leon (Regional Energy Body of Castilla y Len). Entidad Publica 112 Asturias (Public Entity 112 Asturias).
Entidad Publica del Transporte de la Regin de Murcia (Public Transport Local Authority of the Region of Murcia). Entidad Pblica Empresarial Red.es (Public Entity Red.es).
Express Truck, S.A. (Express Truck, S.A.).
Ferrocarriles de Va Estrecha (Narrow-Gauge Railways). Fondo Espaol de Garanta Agraria (Spanish Fund). Agricultural Guarantee
Entidad Regional de Saneamiento y Depuracin de Aguas Residuales de la Regin de Murcia (Regional Body for Wastewater Purification and Treatment of the Region of Murcia). Entidad Valenciana para la Accin en Salud Corporation Action). Pblica (Valencian for Public Health
Forestal Catalana, S.A. (Catalan Forest Agency, S.A.). Fundaci Balear Contra la Violncia de Gnere (Balearic Foundation Against Gender-based Violence).
Enusa Industrias Avanzadas S.A. (Enusa Advanced Industries, S.A.). Enusa-Enwesa Aie. Enusegur, S.A. Equipamiento y Explotacin del
Fundaci Banc de Sang i Teixits de Les Illes Balears (Blood and Tissue Bank Foundation of the Balearic Islands). Fundaci Centre de Documentaci Poltica (Political Documentation Centre Foundation).
Laboratorio Subterrneo Canfranc (Equipment and Operation of the Canfranc Underground Laboratory).
Fundaci Es Baluard Museu D'Art Modern i Contemporani de Palma (TheEs Baluard Museum of Modern
Page 157 of 178
and Contemporary Art Foundation of Palma). Fundaci Privada Apel Les Fenosa (Apel Les Foundation). Fenosa Private
(Foundation for the Murcia Regional Energy Management Agency). Fundacin Audiovisual de Andaluca (Andalusian Foundation). Audiovisual
Fundaci Privada Institut de Bioenginyera de Catalua (IBEC) (Catalan Institute for Bioengineering of Catalonia Foundation). Fundaci Privada Institut de Recerca Biomdica (IRB) (Institute for Research in Biomedicine Private Foundation).
Fundacin Biodiversidad (Biodiversity Foundation). Fundacin Bosch i Gimpera (Bosch i Gimpera Foundation).
Fundacin Canaria Orotava de la Historia de la Ciencia (Orotava Canary Foundation for the History of Science). Fundacin Centro de Estudios
Fundaci Privada pel Foment de la Societat del Coneixement (Private Foundation for the Promotion of the Information Society).
Fundaci Promediterranea per a la Conservacio i Estudi i la Difusio del Patrimoni Maritim (ProMediterranean Foundation for the Conservation, Research and Dissemination of Maritime Heritage). Fundaci Universitaria Balmes
Ambientales del (Foundation for Studies Centre Mediterranean).
Mediterrneo Environmental of the
Fundacin Centro de Estudios de la Luz de la Comunidad Valenciana (Foundation for Light Studies Centre of the Autonomous Community of Valencia).
(Balmes University Foundation). Fundaci Universitat de Girona: Innovaci i Formaci (University of Girona Foundation: Innovation and Education). Fundacin Foundation). Fundacin Agenda Regional de Gestin de la Energa de Murcia Adeuropa (Adeuropa
Fundacin Centro de Supercomputacin de Castilla y Len (Foundation for Supercomputing Centreof Castilla y Len). Fundacin Centro Nacional de
Investigaciones Oncolgicas Carlos III (Carlos III Spanish Foundation for Oncology Research Centre).
Page 158 of 178
Fundacin Centro Tecnolxico Do Mar (Foundation Technologyl Centre). for Marine
Foundation of the University Burgos). Fundacin General de
of
la
Fundacin Coleccin Thyssen Bornemisza (Thyssen Bornemisza Collection Foundation). Fundacin Comarcal de Noia (Noia Regional Foundation).
Universidad de la Rioja (General Foundation of the University of La Rioja). Fundacin General de Universidad de Len y de Empresa (General Foundation of University of Len and Enterprise). la la the the
Fundacin Computacin Tecnologas Avanzadas Extremadura (Foundation Advanced Computing Technologies of Extremadura). Fundacin Cultural
y de for and
Hispano-
Brasilea (Spanish-Brazilian Cultural Foundation). Fundacin de Investigacin del Cncer (Cancer Research Foundation). Fundacin del Patrimonio Natural de Castilla y Len (Foundation for the Natural Heritage of Castilla y Len). Fundacin Empresa-Universidad de Murcia (FEUM) (EnterpriseUniversity Foundation of Murcia). Fundacin Espaola para la Ciencia y la Tecnologa (Spanish Science and Technology Foundation). Fundacin Fondo Cantabria Coopera (Cantabria Coopera Fund Foundation). Fundacin General de la Universidad de Burgos (General
Fundacin General de la Universidad Nacional de Educacin a Distancia (General Foundation of the Spanish National Distance Learning University). Fundacin Gran Canaria Convention Bureau (Gran Canaria Convention Bureau Foundation). Fundacin Iberoamericana para el Fomento de la Cultura y Ciencias del Mar (Ibero-American Foundation for the Promotion of Culture and Marine Science). Fundacin Ibit (Ibit Foundation). Fundacin Instituto de Cultura Gitana (Institute of Gypsy Culture Foundation). Fundacin Instituto de Hidrulica Ambiental de Cantabria (Foundation for the Institute of Environmental Hydraulics of Cantabria). Fundacin Instituto Portuario de Estudios y Cooperacin Comunidad
Page 159 of 178
Valenciana (Foundation for the Port Institute for Studies and Cooperation of the Autonomous Community of Valencia). Fundacin Foundation). Fundacin Internacional y para Iberoamrica de Administracin y Polticas Pblicas (International and Ibero-American Foundation for Public Administration and Policy). Fundacin Interuniversitaria Fernando Gonzalez Bernldez para Espacios Naturales (Fernando Gonzlez Bernldez Inter-University Foundation for Natural Spaces). Fundacin Jorge Guilln (Jorge Integra (Integra
Fundacin Museo de las Ferias (Foundation Museum). for the Trade Fair
Fundacin Navarra para la Calidad (Foundation for the Quality of Navarre). Fundacin Observatorio Ambiental del Puerto de Granadilla (Granadilla Port Environmental Observatory Foundation).
Fundacin Observatorio Espaol de Acuicultura (Spanish Aquaculture Observatory Foundation). Fundacin Orquesta de of
Extremadura (Orchestra Extremedura Foundation).
Guilln Foundation). Fundacin Leonardo Torres Quevedo (Leonardo Torres Quevedo Foundation).
Fundacin Orquesta Filarmnica Gran Canaria (Philarmonic Orchestra of Gran Canaria Foundation). Fundacin para el Desarrollo de la Investigacin en Genmica y Protnica (Foundation for the Development of Research in Genomics and Proteomics).
Fundacin Madrid por la Excelencia (Madrid Foundation for Excellence). Fundacin Marqus de Valdecilla (Marqus de Valdecilla Foundation). Fundacin Miguel Fisac (Miguel
Fundacin para el Fomento en Asturias de la Investigacin Cientfica Aplicada y la Tecnologa (Foundation for the Promotion of Applied Scientific Research and Technology in Asturias).
Fisac Foundation). Fundacin Mstoles 1808-2008 (Mstoles 1808-2008 Foundation). Fundacin Museo Ciencia de the
Valladolid (Foundation for Science Museum of Valladolid).
Fundacin para la Enseanza de las Artes en Castilla y Len (Foundation for the Teaching of Arts in Castilla y Len).
Page 160 of 178
Fundacin para la Formacin e Investigacin Sanitaria (Health Training and Research Foundation).
Fundacin Rof Codina (Rof Codina Foundation).
Fundacin para la Investigacin del Hospital Universitario la Fe, de la Comunidad Valenciana (La Fe University Hospital Research Foundation of the Autonomous Community of Valencia). Fundacin para las Relaciones
Fundacin San Milln de la Cogolla (San Milln de la Cogolla Foundation). Fundacin Santa Brbara (Santa Brbara Foundation).
Fundacin SEPI (SEPI Foundation). Fundacin Servicio Valenciano de Empleo (Valencian Employment Service Foundation).
Laborales de Cantabria (Foundation for Labour Relations in Cantabria). Fundacin Parque Cientfico y Tecnolgico de Extremadura (Science and Technology Park Foundation of Extremadura). Fundacin Patio Herreriano de Arte Contemporneo Espaol de Valladolid (Patio Herreriano Foundation for Spanish Contemporary Art of Valladolid). Fundacin Privada Joan Capella (Joan Capella Private Foundation). Fundacin Pblica Andaluza Centro de Estudios Andaluces (Andalusian Public Foundation, Andalusian Centre of Studies). Fundacin Residencia de
Fundacin Transporte y Formacin (Transport and Training Foundation). Fundacin Universidad-Sociedad (University-Society Foundation). Galaria Empresa Pblica de Servicios Sanitarios, S.A. (Galaria Public Health Services Entity, S.A.). Gerencia de Equipamientos Infraestructuras y de Cultura
(Department of Cultural Infrastructures and Equipment). Gerencia del Sector de la Construccin Naval (Administrative Agency for the Naval Construction Sector). Gesti i Prestaci de Serveis de Salut (Management and Provision of Healthcare Services). Gestin Infraestructuras Sanitarias del Principado de Asturias, S.A. (Health Infrastructure Management of the Principality of Asturias, S.A.).
Page 161 of 178
Estudiantes (Student Foundation).
Residence
Fundacin Riojana para la Innovacin (Riojan Foundation for Innovation).
Grupo de Accin y Desarrollo Rural de la Comarca de Antequera (Action and Rural Development Group of the Region of Antequera).
Instituto Geolgico y Minero de Espaa (Spanish Geological and Mining Institute).
Inspeccin Tcnica de Vehculos de Asturias, S.A. (Motor Vehicle Inspection of Asturias, S.A.). Instituci Catalana de Recerca i Estudis Avanats, Fundaci Privada (Catalan Institute for Research and Advanced Studies, Private Foundation).
Instituto Nacional de (Spanish National Institute).
Estadstica Statistics
Instituto Nacional de Investigacin y Tecnologa Agraria y Alimentaria (National Institute for Agriculture and Food Research and Technology).
Institut Catal de la Vinya i El Vi (Catalan Institute of Viniculture). Institut Catal de Les Dones
Instituto Nacional de la Seguridad Social (Spanish National Social Security Institute). Instituto Nacional de las Artes
(Catalan Women's Institute). Institut Geologic de Catalua (Catalan Geological Institute). Instituto Andaluz de Administracin Pblica (Andalusian Institute Public Administration). for
Escnicas y de la Msica (Spanish National Institute for the Performing Arts and Music). Instituto Nacional de Tcnica Aeroespacial "Esteban Terradas" (Esteban Terradas Spanish National Institute for Aerospace Technology). Instituto para la Evaluacin de Sanitarias, S.A. Acreditacin y las Prcticas
Instituto Aragons de Gestin Ambiental (Aragonese Institute for Environmental Management). Instituto Institute). Cervantes (Cervantes
Instituto para la Diversificacin y Ahorro de la Energia (Institute for Energy Diversification and Saving).
Instituto de Biologa Animal de Balears, S.A. (Animal Biology Institute of the Balearic Islands, S.A.). Instituto Estadstica Andaluca (Andalusian Statistics Institute).
Instituto para la Reestructuracin de la Minera del Carbn y Desarrollo Alternativo de las Comarcas Mineras (Institute for the Restructuring of Coal Mining and Alternative Development of Mining Regions).
Page 162 of 178
Instituto Riojano de la Juventud (Riojan Youth Institute).
Local Authority Association of Alto Deba-Deba Garai Udal-Elkartea.
Instituto Tecnolgico Agrario Castilla y Len (Institute of Agricultural Technology of Castilla y Len). Instituto Tecnolxico para Control Do Medio Mario de Galicia (Galician Technological Institute for Marine Monitoring).
Local Authority Association of Alto Jarama-Atazar. Local Arratia. Authority Association of
Local Authority Association of Bajo Andarax. Local Authority Association Canales de Taibilla. Local Authority Association Carballio Region. of
Instituto Valenciano de Estadstica (Valencian Statistics Institute). Instituto Valenciano del Audiovisual y la Cinematografa Ricardo Muoz Suay (Ricardo Muoz Suary Valencian Audiovisual and Film Institute).
of
Local Authority Association of Costa del Sol Occidental. Local Authority Association of Sierra de Cdiz.
Island Council of Gran Canaria. Island Council of La Palma. Island Council of Lanzarote. La Cuchillera de Taramundi, S.A. (Taramundi Knife Maker, S.A.).
Local Authority Association of SubBetic Area of Cordoba. Local Authority Association Terrazas de Deza.
Local Authority Development of Huelva. Local Authority
Association for the County of
Local Authority Association of Trujillo Region. Local Authority Association of Valle de Lecrn.
Association for
Social Assistance of NavalafuenteValdemanco. Local Authority Association for Social Assistance of Marina Alta. Local Authority Association of Aldevi.
Local Authority Association of Valle del Guadiato. Local Authority of Ainet de Besan. Local Authority of Atauri. Local Authority of Azabal.
Page 163 of 178
Local Authority of Betolaza. Local Authority of Canalda. Local Authority of El Bercial.
Municipal Council of Alcubierre. Municipal Dulantzi. Council of Alegria
Local Authority of El Torviscal. Local Authority Ametlla. of Fontllonga i
Municipal Council of Aljaraque. Municipal Council of Almansa. Municipal Council of Almeida. Municipal Council of Almera. Municipal Council of Almochuel. Municipal Council of Almodvar del Ro.
Local Authority of Gamonal. Local Authority of Isil i Alos. Local Authority of Muntells. Local Authority of Olabezar.
Local Authority of Salinillas Buradon. Local Authority of Torrefresneda. Mancomunidad de Municipios Pueblos del Interior (Association of Municipalities for Inland Villages). Mercados Centrales de
Municipal Council of Almonacid de la Cuba. Municipal Council of Almunia de Doa Godina. Municipal Council of Alosno. Municipal Council of Alpera. Municipal Council of Arafo. Municipal Council of Arandiga. Municipal Council of Arcenillas. Municipal Council of Ares. Municipal Council of Aretxabaleta. Municipal Council of Atarfe. Municipal Council of Ayna. Municipal Council of Barbate. Municipal Council of Barrax.
Abastecimiento de Algeciras, S.A. (Central Supply Markets of Algeciras, S.A.). Ministry of Public Works. Minor Local Authorities of Tahivilla. Municipal Council of A Corua. Municipal Council of Abengibre. Municipal Council of Alajar. Municipal Council of Albuol. Municipal Council of Alcala del Valle.
Page 164 of 178
Municipal Council of Barrundia. Municipal Council of Beas. Municipal Council of Belmonte de Miranda. Municipal Council of Benaocaz. Municipal Council of Benavente. Municipal Council of Bezas. Municipal Council of Bimenes. Municipal Council of Binefar. Municipal Council of Bisaurri. Municipal Torres. Council of Blecua y
de
Municipal Council of Cariena. Municipal Council of Casas-Ibaez. Municipal Council of Castrilln. Municipal Council of Castro Urdiales. Municipal Council of Cee. Municipal Council of Cijuela. Municipal Council of Comillas. Municipal Council of Corcubin. Municipal Council of Cubo del Vino. Municipal Council of Cuenca. Municipal Council of Darro. Municipal Council of Dodro. Municipal Council of El Bonillo. Municipal Council of El Grado. Municipal Council of El Tanque. Municipal Council of Erla. Municipal Council of Espera. Municipal Council of Fariza. Municipal Council of Ferez. Municipal Council of Ferreras de Abajo. Municipal Council of Ferrol. Municipal Council of Fresno de la Ribera.
Municipal Council of Boiro. Municipal Council of Bollullos del Condado. Municipal Council of Bonares. Municipal Aragon. Council of Brea
Municipal Council of Brime de Urz. Municipal Council of Brion. Municipal Council of Buste. Municipal Council of Cabana de Bergantios.
Municipal Council of Camargo. Municipal Council of Canfrac. Municipal Council of Carballo.
Page 165 of 178
Municipal Council of Garachico. Municipal Council of Gevjar. Municipal Council of Gua de Isora.
Municipal Council of Montanchez. Municipal Council of Moraleja del Vino. Municipal Council of Morales de Rey. Municipal Council of Morales de Toro. Municipal Council of Morales de Valverde. Municipal Council of Moros. Municipal Council of Navaconcejo. Municipal Council of Navs. Municipal Council of Negreira. Municipal Council of Nuomoral. Municipal Council of Oleiros. Municipal Council of Olrdola. Municipal Council of Olvera. Municipal Council of Ortigueira. Municipal Council of Outes. Municipal Council of Palau-Solit y Plegamans. Municipal Council of Panticosa. Municipal Council of Piedras Albas. Municipal Council of Pineda de Mar. Municipal Council of Plasenzuela. Municipal Council of Plenas.
Page 166 of 178
Municipal Council of Hermigua. Municipal Council of Huneja. Municipal Council of Ingenio. Municipal Council of Irixoa. Municipal Council of la Joyosa. Municipal Council of las Gabias. Municipal Council of Losar de la Vera. Municipal Council of Malpartida de Cceres.
Municipal Council of Manzanal de Arriba. Municipal Council of Marina de Cudeyo.
Municipal Council of Mazaricos. Municipal Council of Melide. Municipal Council of Miajadas. Municipal Council of Mio.
Municipal Council of Moeche. Municipal Council of Mogn. Municipal Council of Mondragn. Municipal Council of Monfarracinos.
Municipal Council of Polinya. Municipal Council of Puerto de Santa Cruz. Municipal Council of Quinto. Municipal Council of Rabanales. Municipal Council of Reocn. Municipal Council of Ribeira. Municipal Council of Romangordo. Municipal Council of Ruesga. Municipal Council of Sabaanigo. Municipal Council of Sahun.
Municipal Council of Talayuela. Municipal Council Casariego. of Tapia de
Municipal Council of Tijola. Municipal Council of Torla. Municipal Council of Torreorgaz. Municipal Council of Trujillo. Municipal Council of Urnieta. Municipal Council of Utrera. Municipal Council of Valencia de Alcntara. Municipal Council of Vallehermoso. Municipal Council of Vallesa. Municipal Council of Valverde de la Vera. Municipal Council of Viacamp y Litera.
Municipal Council of Sallent. Municipal Council of San Miguel del Valle. Municipal Council of San Roque. Municipal Council of Santa Cruz de la Palma. Municipal Council of Santa Mara de Gua de Gran Canaria.
Municipal Council of Villalcampo. Municipal Council of Villalonso. Municipal Council of Villalpando. Municipal Council of Villamartn. Municipal Council of Villarquemada. Municipal Council of Villel. Municipal Council of Zarautz. Municipal Council Granadilla. of Zarza de
Municipal Council of Santa Sicilia. Municipal Council of Santa rsula. Municipal Council of Santiago de Alcntara.
Municipal Council of Serrejon. Municipal Council of Sestrica. Municipal Council of Talavan.
Page 167 of 178
Museo Nacional Centro de Arte Reina Sofa (Reina Sofa National Art Museum).
Provincial Council of Cdiz. Provincial Council of Guadalajara. Provincial Council of Salamanca. Provincial Council of Tarragona. Provincial Council of Valladolid. Provincial Council of Zamora. Provincial Council of Zaragoza. Redalsa, S.A. S.A. de Electrnica Submarina.
Museo Nacional del Prado (Prado National Museum). Mutua Gallega (Mutual Insurance Company of Galicia).
Mutua Navarra (Mutual Insurance Company of Navarre). Mutualidad General Judicial
(General Judicial Mutual Insurance Company). Organizacin Nacional de Trasplantes (Spanish National Transplant Organisation). Paradores de Turismo de Espaa, S.A. (Spanish Hotels, S.A.). State-Run Tourist
(Submarine Electronics, S.A.). S.E.P.E.S. Entidad Pblica Empresarial de Suelo (Public Land Management Company). Servicio Regional de Empleo y Formacin (Regional Employment and Training Service). Servicios y Estudios para la Navegacin Area y la Seguridad Aeronutica, S.A. (Services and Studies for Air Navigation Aviation Safety, S.A.). Sevilla Seed Capital. Sierra Morena Cordobesa S.A. Sociedad Estatal de Estiba y and
Parc Audiovisual de Catalunya, S.L. (Audiovisual Parc of Catalonia, S.L.). Parque Mvil del Estado (State Vehicle Fleet).
Parque Tecnolgico de Galicia, S.A. (Technology Park of Galicia, S.A.). Patronato Alhambra y Generalife (Board of Trustees of the Alhambra and Generalife).
Prames, S.A. (Prames, S.A.). Productora de Programas del
Desestiba del Puerto de Cartagena, S.A. (Port of Cartagena Public Stevedoring Entity, S.A.). Sociedad Estatal de Estiba y
Principado de Asturias, S.A. (Program Producer of the Principality of Asturias, S.A.).

Desestiba del Puerto de Marin, S.A.
Page 168 of 178
(Port of Marin Public Stevedoring Entity, S.A.). Sociedad Estatal de Infraestructuras Agrarias, S.A. (Public Entity for Agricultural Infrastructures, S.A.). Sociedad Estatal Espaola P4R, S.A. (P4R Spanish Public Entity, S.A.). Sociedad Estatal para la Promocin y Atraccin de Inversiones Exteriores, S.A. (Public Entity for the Promotion and Attraction of Foreign Investment, S.A.). Sociedad Mixta Ciudad Asturiana del Transporte, S.A. (Asturian City of Transportation Joint Enterprise, S.A.).
Sociedad Regional de Cultura y Deporte, S.L.U. (Regional Culture and Sports Company, S.L.U.).
Sodiga Galicia, Sociedad de Capital de Riesgo (Sodiga Galicia, Venture Capital Company). Solimat. Suma Intermutual, Entidad Mancomunada de Matepss (Suma Intermutual, Matepss Local Authority Association). Taller Digital de Establecimiento de Textos Literarios y Cientficos S.A. (Digital Wokshop for the Establishment of Literaray and Scientific Texts, S.A.).
Sociedad Mixta de Gestin y Promocin del Suelo, S.A. (Land Mangement and Development Joint Enterprise, S.A.). Sociedad para el Desarrollo
Toledo Ciudad de Congresos (Toledo Conference Centre). Umivale. Unin de Mutuas (Mutual Insurance Company Union). Unin Ganadero de Tineo (Livestock Union of Tineo).
Energtico de Andaluca, S.A. (Andalusian Energy Development Company, S.A.). Sociedad para El Desarrollo Regional de Cantabria, S.A. (Cantabrian Regional Development Company, S.A.). Sociedad para El Impulso del
Universidad Internacional Menndez Pelayo (Menndez Pelayo International University). Universidad Nacional de Educacin A Distancia (Spanish National Distance Learning University).
Talento, Talentia, S.L.U. (Talentia Promotion of Talent Company, S.L.U.).
Universitat Jaume i de Castell (Jaume i de Castell University).
Page 169 of 178
Urbanizadora
Municipal,
S.A.
Xarxa D'Universitats Institut Joan Llus Vives (Joan Llus Institute University Network). Vives
(Municipal Urban Agency, S.A.)
Development
Valenciana Aprovechamiento Energtico de Residuos, S.A. (Valenciana Corporation for the Management of Waste, S.A.). Vila Universitaria, S.A. (University Apartments, S.A.).
Xesgalicia Management Company for Capital Risk Entities, S.A. (Xesgalicia Sociedad Gestora de Entidades de Capital y Riesgo, S.A.). Xestur Ourense, S.A. (Xestur
de the
Orense, S.A.). Viviendas del Principado Asturias, S.A. (Housing of Principality of Asturias, S.A.).
Page 170 of 178
INDEX OF CHARTS
Chart 1: Knowledge of cloud computing technology (%) ................................................... 54 Chart 2: Knowledge of cloud computing technology, by territorial jurisdiction of the public entity (%)............................................................................................................................ 55 Chart 3: Information channels used to discover cloud computing (%)............................... 56 Chart 4: Information channels used to discover cloud computing, by territorial jurisdiction of the public entity (%) ....................................................................................................... 57 Chart 5: Types of cloud computing technologies known (%) ............................................. 58 Chart 6: Types of cloud computing technologies known, by territorial jurisdiction of the public entity (%) ................................................................................................................. 58 Chart 7: Use of cloud computing solutions (%).................................................................. 59 Chart 8: Use of cloud computing solutions, by territorial jurisdiction of the public entity (%) ........................................................................................................................................... 60 Chart 9: Period of cloud computing usage (%) .................................................................. 60 Chart 10: Period of cloud computing usage, by territorial jurisdiction of the public entity (%) ........................................................................................................................................... 61 Chart 11: Areas involved in cloud computing implementation (%) .................................... 62 Chart 12: Areas involved in cloud computing implementation, by territorial jurisdiction of the public entity (%) ........................................................................................................... 63 Chart 13: Type of cloud computing deployment (%).......................................................... 64 Chart 14: Type of cloud computing deployment, by territorial jurisdiction of the public entity (%) ..................................................................................................................................... 64 Chart 15: Use of software solutions, cloud computing or otherwise (%) ........................... 66 Chart 16: Use of software solutions (not necessarily under cloud computing), by territorial jurisdiction of the public entity (%) ..................................................................................... 67 Chart 17: Use of software solutions in cloud computing mode or otherwise (%) ............... 68 Chart 18: Use of paid or free cloud computing software solutions (%) .............................. 68
Chart 19: Cloud computing providers (%).......................................................................... 69 Chart 20: Cloud computing providers, by territorial jurisdiction of the public entity (%) ..... 70 Chart 21: Knowledge of budget allocated to cloud computing in 2011 (%) ....................... 71 Chart 22: Knowledge of budget allocated to cloud computing in 2011, by territorial jurisdiction of the public entity (%) ..................................................................................... 72 Chart 23: Reasons that influenced the decision to hire a cloud computing service (%) .... 74 Chart 24: Reasons that influenced the decision to hire a cloud computing service, by territorial jurisdiction of the public entity (%) ...................................................................... 75 Chart 25: Performance of risk analyses prior to implementing cloud computing (%) ........ 76 Chart 26: Performance of risk analyses prior to implementing cloud computing, by territorial jurisdiction of the public entity (%) ...................................................................... 76 Chart 27: Type of risk analysis performed (%) .................................................................. 77 Chart 28: Consideration of the applicable legislation prior to implementing cloud computing (%).................................................................................................................... 78 Chart 29: Consideration of the applicable legislation prior to implementing cloud computing, by territorial jurisdiction of the public entity (%) ............................................... 78 Chart 30: Type of legislation considered (%) ..................................................................... 79 Chart 31: Type of legislation considered, by territorial jurisdiction of the public entity (%) 80 Chart 32: Implementation of mechanisms for controlling and supervising cloud computing services (%) ....................................................................................................................... 81 Chart 33: Implementation of mechanisms for controlling and supervising cloud computing services, by territorial jurisdiction of the public entity (%) .................................................. 82 Chart 34: Control and supervisory mechanisms implemented (%) .................................... 83 Chart 35: Mandatory security standards for cloud computing providers (%) ..................... 84 Chart 36: Mandatory security standards for cloud computing providers, by territorial jurisdiction of the public entity (%) ..................................................................................... 85 Chart 37: Mandatory security standards for providers (%) ................................................ 85
Chart 38: Reasons which have, greatly or substantially, influenced the decision not to adopt cloud computing (%) ................................................................................................ 87 Chart 39: Degree to which the effects of adopting cloud computing have been beneficial to the public entity (%) ........................................................................................................... 89 Chart 40: Consideration of cloud computing as a technological advantage for Spanish public authorities (%) ......................................................................................................... 90 Chart 41: Consideration of cloud computing as a technological advantage for Spanish public authorities, by territorial jurisdiction of the public entity (%) .................................... 91 Chart 42: Consideration of cloud computing as an operational advantage for Spanish public authorities (%) ......................................................................................................... 91 Chart 43: Consideration of cloud computing as an operational advantage for Spanish public authorities, by territorial jurisdiction of the public entity (%) .................................... 92 Chart 44: Factors which have, greatly or substantially, hindered the adoption of cloud computing (%).................................................................................................................... 94 Chart 45: Economic factors which have, greatly or substantially, hindered the adoption of cloud computing, by jurisdiction of the public entity (%) .................................................... 95 Chart 46: Technical factors which have, greatly or substantially, hindered the adoption of cloud computing, by public entity (%) ................................................................................ 96 Chart 47: Security factors which have, greatly or substantially, hindered the adoption of cloud computing, by territorial jurisdiction of the public entity (%) ..................................... 97 Chart 48: Legal and institutional factors which have, greatly or substantially, hindered the adoption of cloud computing, by territorial jurisdiction of the public entity (%) .................. 98 Chart 49: Satisfaction with the cloud computing service provider (%) ............................... 99 Chart 50: Public authorities that are satisfied and quite satisfied with their cloud computing service provider, by type of provider (%) ......................................................................... 100 Chart 51: Fulfilment of initial expectations of cloud computing (%) ................................. 100 Chart 52: Fulfilment of the initial expectations about cloud computing, by territorial jurisdiction of the public entity (%) ................................................................................... 101 Chart 53: Stated intention to maintain the currently adopted cloud computing solutions in the future (%) ................................................................................................................... 102
Chart 54: Stated intention to maintain currently adopted cloud computing solutions in the future, by territorial jurisdiction of the public entity (%) .................................................... 103 Chart 55: Expected future incorporation of solutions not yet implemented at public entities using cloud computing (%) .............................................................................................. 104 Chart 56: Intention to recommend the use of cloud computing to other public entities (%) ......................................................................................................................................... 105 Chart 57: Intention of recommending the use of cloud computing to other public authorities, by territorial jurisdiction of the public entity (%) ............................................. 105 Chart 58: Expectations for obtaining further benefits in the future, in addition to those already obtained, as a result of adopting cloud computing (%) ....................................... 106 Chart 59: Expectations for obtaining further benefits in the future, in addition to those already obtained, as a result of adopting cloud computing by territorial jurisdiction of the public entity (%) ............................................................................................................... 107 Chart 60: Projected future incorporation of as yet unincorporated solutions at public entities not using cloud computing (%) ............................................................................ 108 Chart 61: Type of cloud computing (free or pay-per-use) that public entities intend to incorporate (%) ................................................................................................................ 108 Chart 62: Stated intention to engage external advisors to adopt cloud computing (%) ... 109
INDEX OF TABLES
Table 1: Survey population ................................................................................................ 21 Table 2: Sampling distribution ........................................................................................... 21 Table 3: Sampling error ..................................................................................................... 23 Table 4: Description of reasons for not adopting cloud computing .................................... 86 Table 5: Reasons which, to a larger and lesser degree, have influenced the decision not to adopt cloud computing, by territorial jurisdiction of the public entity (%) ....................... 88 Table 6: Description of the difficulties encountered on implementing cloud computing solutions............................................................................................................................. 93 Table 7: SWOT Analysis.................................................................................................. 111 Table 8. List of experts interviewed ................................................................................. 139 Table 9. Main solutions .................................................................................................... 141
INDEX OF FIGURES
Figure 1: Weighting factor.................................................................................................. 22 Figure 2: Classification of cloud computing solutions ........................................................ 27 Figure 3: Type of cloud computing by deployment model ................................................. 29 Figure 4: USA.gov Portal ................................................................................................. 121 Figure 5: Apps.gov Platform ............................................................................................ 123 Figure 6: G-Cloud ............................................................................................................ 124
Follow us on:
Web
Please forward your queries and comments to:

observatorio@inteco.es
Instituto Nacional de Tecnologas de la Comunicacin
www.inteco.es

(English Version) Study On Cloud Computing in The Spanish Public Sector

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

(English Version) Study On Cloud Computing in The Spanish Public Sector

Uploaded by

Copyright:

Available Formats

Study on cloud computing in the Spanish public sector

NATIONAL INSTITUTE OF COMMUNICATION TECHNOLOGIES

Edition: July 2012

Classification of cloud computing solutions .......................................................... 26

Knowledge of cloud computing ............................................................................ 54

OUTCOME OF CLOUD COMPUTING IMPLEMENTATION

INTENDED FUTURE USE

INTODUCTION AND AIMS

Table 1: Survey population

470 2.19% 2,388 11.12% 18,608 86.69% 21,466 100.00%

Sample size and sampling distribution

Sample 107 136 257 500

% 21.4% 27.2% 51.4% 100.0%

Table 3: Sampling error

Sample 107 136 257 500

Sampling error 8.3 8.1 6.0 4.3

INTRODUCTION TO CLOUD COMPUTING

Figure 2: Classification of cloud computing solutions

Source: prepared in-house

Deloitte (2009): Cloud Computing. Forecasting Change. Available at: https://www.deloitte.com/assets/DcomGlobal/Local%20Assets/Documents/TMT/cloud_-_market_overview_and_perspective.pdf

SPANISH AND INTERNATIONAL CLOUD COMPUTING

Further information at: http://www.enisa.europa.eu/

REGULATORY FRAMEWORK FOR THE PROTECTION OF PERSONAL DATA

Further information at: https://www.agpd.es/

Procedure envisaged in Title IX, Chapter V, Section One of the RLOPD.

Special cases in terms of access to administrative information by citizens

RISK ASSOCIATED WITH CLOUD COMPUTING

KNOWLEDGE AND USE OF CLOUD COMPUTING IN THE SPANISH PUBLIC SECTOR

Yes, familiar and has in-depth knowledge

Yes, familiar but has superficial knowledge

Unaware of cloud computing

Basis: total number of public entities contacted (n=889)

Information channels about cloud computing

Basis: Total public entities (n=500)

Cloud computing technologies known

Chart 5: Types of cloud computing technologies known (%)

Basis: Total public entities (n=500)

Housing of services on third-party servers

ADOPTION OF CLOUD COMPUTING

Basis: Total public entities (n=500)

Less than 12 months

More than 3 years

Basis: public entities using cloud computing (n=152)

More than 3 years

Characterisation of services and platforms

Chart 11: Areas involved in cloud computing implementation (%)

Basis: public entities using cloud computing (n=152)

60% 50% 40% 30% 20% 10% 0%

Chart 13: Type of cloud computing deployment (%)

Basis: public entities using cloud computing (n=152)

Autonomous community Hybrid Community

Central government N/A

Chart 15: Use of software solutions, cloud computing or otherwise (%) 42

Basis: public authorities using cloud computing (n=152)

Autonomous Com. MFT CRM ERP ALM Other (PPM,SCM, etc.)

Use outside cloud

Basis: public entities using each solution (see basis in brackets)

31.0% 28.4% 37.5%

Basis: public entities using each solution (see basis in brackets)

Basis: public entities using cloud computing (n=152)

28.0% 8.0% 30.8% 28.2% 51.3%

Autonomous community 2.6% Local government 1.1%

54.5% 35.2% 45.5%