Solutions & Products
Blog_2021_08_17_IT-Betrieb in der Cloud_Titelbild

It Operating Models in the Cloud - A Question of Responsibility

Co-management, DevOps and Outsourcing: Which Operating Model Suits My Company?

Cloud Operating Models
17.08.2021
Cloud
Managed Services

Iaas, Paas, SaaS and on Premises - Who Is Responsible?

When companies are considering the use of public cloud services, it is particularly important to understand and implement the underlying responsibility and operating model. The focus here is upon security and compliance issues, as well as upon which tasks are implemented by the company itself or, if applicable, by the public cloud provider.

The responsibilities for the workloads vary depending on whether the workloads are hosted as SaaS (Software-as-a-Service), on PaaS (Platform-as-a-Service), on IaaS (Infrastructure-as-a-Service), or On-Premises in a local data center.


Thus, enterprises that host their workloads in an on-premises data center are responsible for the entire stack themselves. In contrast, when moving to the cloud, part of the responsibility is transferred to the cloud provider. The following diagram illustrates the areas of responsibility of enterprises and public cloud providers according to how applications are deployed.

Blog_2021_08_17_IT-Betrieb in der Cloud_Bild02
Source: Own creation based on Shared Responsibility Modell of Microsoft

The higher the level of cloud usage, the more responsibility is transferred to the cloud provider in the operating model. At the same time, possible operating risks and other activities are also transferred to the public cloud provider, so that one can speak of outsourcing in the broadest sense.

Paradigm Shift: It Operating Models in the Cloud

Even though the terms on the graphic have been used in the the IT world for decades, they are put to a fundamentally different use in the cloud context: For example, entirely different paradigms apply to the cloud operating model, which are depicted below.

Blog_2021_08_17_IT-Betrieb in der Cloud_Bild03

Not only do processes change with the operation of the infrastructure in the cloud, but different know-how is also required from the employees. For example, with Infrastructure-as-a-Code, it is necessary to draw on the skills of a software developer. Whether the changed tasks can be provided from within the team - or whether these services have to be outsourced - is something to consider regarding the future (cloud) operating model. For this reason, it is essential to extend the shared responsibility model shown above to include an IT service provider. While the public cloud provider delivers cloud services that APIs can consume, the IT service provider implements processes that are not mapped technically via APIs but in which people are the relevant drivers. This is where the paradigm shift in the operation of workloads is put into practice on a daily basis.

The Cloud Operating Model in Detail

We define the cloud operating model here to address questions like these and relate it to IT outsourcing with an IT service provider and the collaboration model:


A cloud operating model represents the set of processes and procedures that define how technologies are utilized in the cloud.


When cloud technologies didn't exist, technology teams created operating models to leverage technology's benefits for the business. Enterprise IT operating models were already focused on business strategy, staff structuring, change management, operations management, governance/compliance, and security. However, for most operating models, workload stability was the top priority.

Moving the operating model to the cloud now means that the same people and processes can focus on a different level of operations:

  • When staff no longer concentrate on server uptime, success metrics change.
  • When security no longer depends on the four walls of a data center, the threat profile changes.
  • When procurement is no longer a barrier to innovation, the speed of change management changes.

The cloud operating model is thus clearly less about workload stability and more about ensuring operational consistency and enabling speed and flexibility in operations.

The Cloud Collaboration Model and DevOps in Detail

Speed and flexibility can be positively influenced in particular via the collaboration model with the IT service provider. And as soon as a collaboration model is discussed, the idea of outsourcing is not far away. However, outsourcing in the context of the public cloud is understood differently than in the case of classic on-premises services.

Control & stability vs. speed and results

Blog_2021_08_17_IT-Betrieb in der Cloud_Bild04
Source: Own creation based on Microsofts Shared Responsibility Modell

Cooperation with external parties usually lies between two poles: either each activity is issued to a partner or the company carries out all activities itself. In between, there is the option of defining co-management of IT. Regardless of the choice of collaboration model, the question that needs to be answered is how much control and stability versus speed and results the operating model should allow: Self-management, for example, can achieve high flexibility and speed, as the workloads are entirely in the hands of the customer. At the same time, this can result in a loss of stability and control, which is what a secure and robust operation is all about. It is ultimately a trade-off between Control & Stability vs. Speed & Results.

Co-management with DevOps and Shared Responsibility

Many customers choose to co-manage their IT landscapes in the public cloud when faced with this trade-off.


Blog_2021_08_17_IT-Betrieb in der Cloud_Bild05
Source: Own creation based on Microsofts Shared Responsibility Model

Whereas in the past, risk transitions and strict responsibilities were defined on the basis of classic outsourcing using standards such as ITIL, in the DevOps or shared responsibility model, the company and the service provider grow together to form a single unit, so that the transitions are sometimes difficult to recognize. The idea is quite simple: the company and the service provider work together in a solution-oriented manner on faults, service requests or changes - in other words, the company and the service provider jointly implement the operation.

Co-management in particular can generate many advantages:

  • Focus on core competencies and the core business
  • Know-how transfer between the service provider and the customer
  • Access to new technologies and innovations
  • Cost advantages, especially through increased efficiency
  • Less administrative work
  • Higher capacities
  • Higher quality
  • Higher flexibility

Co-management, DevOps and Outsourcing: Which Operating Model Suits My Company?

Essentially, the question arises as to which activities the company itself, the IT service provider, or even the hyperscaler are responsible for. The question should also consider which business area and corporate functions a company relies on an IT service provider. Specifically, this question must be answered for each application.

The following six steps can help:

  1. Evaluate whether the activity is part of your core competencies.
  2. Evaluate the suitability for outsourcing the activity/s
  3. Evaluate the reasons for issuing the activity/s
  4. Evaluate all relevant quantitative costs
  5. Evaluate all applicable qualitative costs
  6. Check the capabilities of the suppliers


After reviewing these items, a right decision can be made for an appropriate operating model. When outsourcing activities to a partner, many advantages but also disadvantages can be generated. In addition, it should be checked whether the operating model can change over time. Thus, before providing the cloud architecture, it must be checked how the cloud operation is to be designed. The topics of strategic orientation, personnel structure and GRC requirements (governance, risk and compliance) should be defined here in order to be able to implement the future cloud operating model and to save costs with the help of the implemented operating model.

Managed Services

Rely on our managed services, which we offer to match your cloud journey as well as for traditional infrastructures and application environments.

Multi- and Hybrid Cloud Services

Learn more about Arvato Systems' services in the area of Multi- and Hybrid Cloud.

Written by

_DSC2732 (3)
Niklas Petersen
Expert for Public Cloud