Orig­i­nal source pub­li­ca­tion: Branco Jr., T., I. Bianchi and F. de Sá-Soares (2019). Cloud Com­put­ing Adop­tion in the Gov­ern­ment Sec­tor in Brazil: An Exploratory Study with Rec­om­men­da­tions from IT Man­agers. Pro­ceed­ings of the GPC2019—The 14^th Inter­na­tional Con­fer­ence on Green, Per­va­sive and Cloud Com­put­ing. Uber­lân­dia (Brazil).
The final pub­li­ca­tion is avail­able here.

Cloud Com­put­ing Adop­tion in the Gov­ern­ment Sec­tor in Brazil: An Exploratory Study with Rec­om­men­da­tions from IT Man­agers

Teó­filo T. Branco Júnior,^a Isaías Bianchi^ab and Fil­ipe de Sá-Soares^a

^a Cen­tro ALGO­RITMI, Uni­ver­sity of Minho, Por­tu­gal
^b Fed­eral Uni­ver­sity of Santa Cata­rina, Brazil

1. Introduction

Cloud Com­put­ing (CC) has been a major tech­no­log­i­cal trend in recent years, draw­ing the atten­tion of both IT pro­fes­sion­als and researchers. Although many pub­li­ca­tions con­cen­trate on the tech­ni­cal aspects of CC, the focus on orga­ni­za­tional aspects is increas­ingly fre­quent given the inter­est of orga­ni­za­tions in adopt­ing this tech­nol­ogy [Branco et al. 2017]. The lit­er­a­ture includes works on the process and life cycle that enable the cre­ation of a favor­able set­ting within orga­ni­za­tions to imple­ment CC solu­tions [Branco et al. 2017].

Cloud com­put­ing may be valu­able to pri­vate and pub­lic orga­ni­za­tions [Mall­mann and Maçada 2018]. How­ever, Mall­mann and Maçada [Mall­mann and Maçada 2018] argue that there are rel­a­tively few stud­ies inves­ti­gat­ing CC adop­tion in the con­text of pub­lic sec­tors com­pared to a large num­ber of stud­ies in the pri­vate sec­tor. In par­tic­u­lar, in a devel­op­ing coun­try such as Brazil, in the gov­ern­ment sec­tor, the num­ber of stud­ies is lim­ited.

Most stud­ies attempt to iden­tify tech­no­log­i­cal issues in CC [Senyo et al. 2018]. On the other hand, few stud­ies are inves­ti­gat­ing the orga­ni­za­tional aspects of cloud com­put­ing and con­cerns about rec­om­men­da­tions. Regard­ing the gov­ern­ment sec­tor, usu­ally, the stud­ies did not have the con­cern to dis­cuss the issues related to hav­ing suc­cess­ful imple­men­ta­tion. The review of those works led us to com­pile a list of rec­om­men­da­tions that may prove use­ful to IT man­agers when they con­sider the orga­ni­za­tional require­ments needed to adopt CC in a secure and effi­cient man­ner.

Moti­vated by the con­text above, the pur­pose of this study is to inves­ti­gate the fac­tors and to iden­tify a set of rec­om­men­da­tions for the suc­cess­ful adop­tion of CC in the gov­ern­ment sec­tor in Brazil.

2. Cloud Computing in Public Govern Area (G-Cloud)

G-Cloud (Gov­ern­ment Cloud) in the pub­lic ser­vice domain is a pay-per-use model that allows pub­lic agen­cies and cit­i­zens access to a net­work. This net­work pro­vides con­fig­urable and reli­able com­put­ing resources that are pro­vi­sioned and released with min­i­mal man­age­ment effort for the con­sumer. The gov­ern­ment can use the power of the G-Cloud to pro­vide essen­tial pub­lic ser­vices. In the future, online pub­lic ser­vice providers can use all G-Cloud mod­els to pro­vide ser­vices that are more com­plex. G-Cloud can be con­sid­ered a new par­a­digm shift for online pub­lic ser­vices [Bhisikar 2011].

Nowa­days, cloud com­put­ing in the Gov­ern­ment area can solve prob­lems in e-Gov­ern­ment (e-Gov) and fur­ther opti­mize the capac­ity of gov­er­nance. Addi­tion­ally, in the cloud, it is pos­si­ble to spec­ify met­rics and com­pile sta­tis­tics for cost sav­ings and bet­ter plan­ning, such as dat­a­cen­ter usage, peak loads, power con­sump­tion, and time. Cloud data­bases offer an unprece­dented scale with­out com­pro­mis­ing per­for­mance. This capa­bil­ity should be con­sid­ered if the tar­get sys­tem demands high-level, on-demand scal­a­bil­ity, that is, large scale scal­a­bil­ity[Tri­pathi and Par­i­har 2011].

The adop­tion of cloud com­put­ing in the gov­ern­ment (G-Cloud) pro­motes the improve­ment of pub­lic ser­vices for the cit­i­zens and the trans­parency of gov­ern­ment processes. Cloud archi­tec­tures help the imple­men­ta­tion of e-gov­er­nance by enabling gov­ern­ment poli­cies directed for the cit­i­zens. Sev­eral ser­vices can be offered by enabling gov­ern­ment poli­cies that are directed towards the cit­i­zens, for instance: Gov­ern­ment for Gov­ern­ment (G2G), Gov­ern­ment for Busi­ness (G2E), and Gov­ern­ment for Con­sumer (G2C) [Bhisikar 2011].

2.1 Cloud Computing Deployment

Hybrid clouds involve the com­po­si­tion of two or more types of clouds (pri­vate, com­mu­nity, or pub­lic). In the pri­vate cloud deploy­ment model, the cloud infra­struc­ture only focuses on the inter­nal work­ings of the orga­ni­za­tion [Goyal 2014]. The goal of a pri­vate cloud is to use the ser­vices within the orga­ni­za­tion, tak­ing advan­tage of the cloud´s tech­no­log­i­cal advan­tages. Usu­ally, the pri­vate cloud offers a higher degree of secu­rity than pub­lic clouds, since the data is under the con­trol of the orga­ni­za­tion. The pri­vate cloud has the van­tage over the pub­lic cloud in terms of secu­rity and pri­vacy. A pri­vate cloud also has the poten­tial to give the orga­ni­za­tion greater con­trol over infra­struc­ture and com­put­ing resources [Branco et al. 2017]. For instance, if there is inef­fi­ciency of com­put­ing resources capac­ity in the orga­ni­za­tion’s own data cen­ter, a pri­vate cloud can pro­vide cost sav­ings. These non-uti­lized capa­bil­i­ties can be man­aged through a self-ser­vice inter­face, auto­mated man­age­ment of com­put­ing resources, and can even allow the com­mer­cial­iza­tion of idle capa­bil­i­ties to other part­ner com­pa­nies [Goyal 2014]. The orga­ni­za­tion with a pri­vate cloud can cre­ate a part­ner­ship with a pub­lic cloud provider to form a cloud hybrid. Another ben­e­fit of the hybrid cloud is that the cloud can enable the orga­ni­za­tion to take advan­tage of the scal­a­bil­ity and cost-effec­tive­ness that a pub­lic cloud offers with­out expos­ing appli­ca­tions and data con­sid­ered crit­i­cal to third par­ties [1, 6].

Table 1: Fac­tors to Con­sider with Cloud Com­put­ing Imple­men­ta­tion

Based on the lit­er­a­ture review process, we iden­ti­fied remark­able points to take into account in order to deploy cloud com­put­ing. Table 1 presents a brief descrip­tion of each item.

Sec­tion 3 presents the method used in this research. As our pur­pose is to iden­tify rec­om­men­da­tions for a suc­cess­ful cloud com­put­ing deploy­ment in the gov­ern­ment sec­tor, we car­ried out an exploratory study.

3. Research Methodology

Few stud­ies have attempted to iden­tify a set of rec­om­men­da­tions to adopt cloud com­put­ing in a devel­op­ing coun­try such as Brazil. Our study intends to con­trib­ute to this research objec­tive. The study adopts and induc­tive strat­egy using qual­i­ta­tive data from semi-struc­tured inter­views to col­lect data from dif­fer­ent points of view [Myers 2013], build­ing upon the prac­ti­cal expe­ri­ences from key mem­bers of the gov­ern­ment sec­tor that have adopted cloud com­put­ing [Ben­basat et al. 1987].

3.1 Data Collection and Analysis

In order to learn about these indi­vid­u­als’ rec­om­men­da­tions for cloud com­put­ing adop­tion, we con­ducted inter­views with experts in IT Cloud in the gov­ern­ment sec­tor that suc­cess­fully migrated to the cloud. In order to reduce con­tex­tual bias, we adopted a con­ve­nience sam­pling method to select a vari­ety of orga­ni­za­tions in the gov­ern­ment sec­tor from dif­fer­ent con­texts with a vari­a­tion in insti­tu­tional size, strat­egy, struc­ture, and processes [Dubé and Paré 2017].

Inter­views were con­ducted with the orga­ni­za­tions’ IT deci­sion-mak­ers at the top man­age­ment level and mid­dle man­age­ment lev­els (IT Direc­tor, Man­ager, and IT Coor­di­na­tor) that are usu­ally respon­si­ble for cloud com­put­ing [Bianchi et al. 2017]. The inter­views aimed to learn about the prac­ti­cal expe­ri­ences of IT man­agers in the process of cloud com­put­ing imple­men­ta­tion in the gov­ern­ment sec­tor. Table 2 pro­vides infor­ma­tion about the orga­ni­za­tions.

Table 2: Infor­ma­tion about Orga­ni­za­tions

Table 3 pro­vides infor­ma­tion regard­ing the inter­vie­wees.

Table 3: Pro­file of Inter­vie­wees

The inter­view script struc­tured had three parts: the first part, included gen­eral ques­tions about the orga­ni­za­tion; the sec­ond part included per­sonal ques­tions about the inter­vie­wee, and the last part included ques­tions about their expe­ri­ences with cloud com­put­ing adop­tion. We devel­oped a guide based on the ini­tial items iden­ti­fied in the lit­er­a­ture review (Table 1). By using a guide and pin­point­ing key aspects of cloud com­put­ing, we were able to more eas­ily con­duct inter­view. The fol­low­ing type of ques­tion was asked to each inter­vie­wee: “What are the expec­ta­tions and goals of cloud com­put­ing in your orga­ni­za­tion?” Addi­tion­ally, there were ques­tions con­cern­ing the advan­tages of CC; lim­i­ta­tions in accor­dance with cur­rent leg­is­la­tion; ser­vice migra­tion process to the cloud; impacts on IT, prepa­ra­tion of the inter­nal envi­ron­ment; selec­tion of the imple­men­ta­tion model and ser­vices; prospec­tive sup­pli­ers; level of matu­rity of the orga­ni­za­tion; invest­ment and oper­a­tional costs; cri­te­ria for selec­tion of sup­pli­ers; ser­vice agree­ments; appli­ca­tion devel­op­ment; cloud man­age­ment; con­for­mi­ties and audit­ing; risk man­age­ment and secu­rity.

The final ques­tion was intended to com­ple­ment issues that have not been ade­quately cov­ered in the lit­er­a­ture, in par­tic­u­lar, in the gov­ern­ment sec­tor. This ques­tion aimed to enrich the prac­ti­cal expe­ri­ences of cloud com­put­ing imple­men­ta­tion. Between August and Sep­tem­ber of 2018, we con­ducted face-to-face inter­views. All of the inter­views were recorded. We fol­lowed rec­om­men­da­tions by Myers and New­man [Myers and New­man 2007] to make the inter­view process more effec­tive. We per­formed a ver­ba­tim tran­scrip­tion of all the inter­views and used the appli­ca­tion “Atlas TI” to assist in data analy­sis.

To ana­lyze the inter­views, we adopted the approach pro­posed by Keeney [Keeney 1992]. Based on the assump­tion that the adop­tion of CC can be con­fig­ured as a deci­sion-mak­ing prob­lem, we applied Keeney’s [Keeney 2001] Value-Focused Think­ing (VFT) approach, tak­ing into account the list of impor­tant val­ues to the con­text of deci­sion-mak­ing. The next sec­tion presents the find­ings of this study.

4. Results of the Study

This research aimed to iden­tify rec­om­men­da­tions for the adop­tion of CC in the gov­ern­ment sec­tor, par­tic­u­larly in pub­lic orga­ni­za­tions in Brazil. In three orga­ni­za­tions, twelve expe­ri­enced IT pro­fes­sion­als in cloud com­put­ing were inter­viewed.

Table 4: Rec­om­men­da­tions Pro­posed by Inter­vie­wees

Remark­able insights were col­lected from the inter­views. Twenty-one cat­e­gories resulted from the data analy­sis cod­ing of the inter­views, on issues con­sid­ered impor­tant in the process of imple­ment­ing cloud com­put­ing in pub­lic gov­ern­men­tal orga­ni­za­tions. Table 4 presents a list of rec­om­men­da­tions to the pub­lic gov­ern­ment in order to suc­cess­fully adopt cloud com­put­ing. In addi­tion, a descrip­tion for each cat­e­gory was also devel­oped.

Based on the cat­e­gories and rec­om­men­da­tions pre­sented in Table 4, the next sub­sec­tions detail these rec­om­men­da­tions. It is impor­tant to note that all of these rec­om­men­da­tions came from the prac­ti­tioner´s expe­ri­ence in cloud com­put­ing projects in the gov­ern­ment sec­tor in Brazil.

4.1 Alignment with Customers

In order to have a cloud project aligned with cus­tomers’ expec­ta­tions, it is impor­tant to pro­vide good ser­vices and to have a high cus­tomer reten­tion rate. To ensure this align­ment, the fol­low­ing rec­om­men­da­tions are sug­gested: cre­ate a sur­vey to iden­tify cus­tomer needs and the require­ments; pro­vide per­son­al­ized ser­vice to the clients.

4.2 IT Governance

IT gov­er­nance plays an impor­tant role in cloud com­put­ing, assum­ing that the cloud envi­ron­ment is orga­nized to sup­port IT activ­i­ties and to main­tain the infra­struc­ture required for cloud ser­vices.

In this sense, delib­er­a­tions involv­ing IT with polit­i­cal back­ing in the orga­ni­za­tion are nec­es­sary, so that these are duly respected and ful­filled. The fol­low­ing rec­om­men­da­tions were sug­gested by the respon­dents: reg­u­late IT through an IT board, develop stan­dards for cloud use, and imple­ment its own struc­ture for cloud man­age­ment.

4.3 Costs of Investments

In order to deploy a cloud in the gov­ern­ment sec­tor or in any pub­lic insti­tu­tion, it’s essen­tial to have a well-defined plan with expected costs and a bud­get for invest­ments. A finan­cial sup­port and admin­is­tra­tive func­tion in the insti­tu­tion becomes crit­i­cal to busi­ness suc­cess. In this sense, the fol­low­ing rec­om­men­da­tions were listed by the inter­vie­wees: make an accu­rate esti­ma­tion of imple­men­ta­tion costs; eval­u­ate the human resources costs involved, even if they are being paid by cen­tral admin­is­tra­tion, as is the case in gen­eral pub­lic admin­is­tra­tions; esti­mate costs required for cloud sup­port; raise the costs to be spent with soft­ware licenses; and eval­u­ate the costs to be allo­cated in the process of rent­ing pub­lic clouds to pro­vide sup­port to the pri­vate cloud of orga­ni­za­tion.

4.4 Cloud Sustainability

The cloud com­put­ing envi­ron­ment requires con­stant invest­ment, whether in train­ing, main­te­nance, or upgrad­ing of new equip­ment. It is desir­able that these costs can be sus­tained by the sale of cloud ser­vices. One way to pro­mote self-sus­tain­abil­ity is fol­low­ing some of these rec­om­men­da­tions: draw up an annual bud­get for costs in the cloud; pre­pare a price list of cloud ser­vices; receive IT resources from client units; and develop an annual invest­ment plan for cloud mod­ern­iza­tion.

4.5 Prospective Studies

It is impor­tant to con­duct prospec­tive stud­ies on cloud tech­nolo­gies to define cloud mod­els and pro­mote the expan­sion and exten­sion of the use of their resources. These stud­ies can be car­ried out through the fol­low­ing actions: par­tic­i­pa­tion in events about CC; vis­its to other insti­tu­tions that use the cloud; request­ing proof of con­cept from tech­nol­ogy com­pa­nies that use the cloud; research­ing the lit­er­a­ture on inno­va­tions in the cloud envi­ron­ment; con­sult­ing with sta­tis­ti­cal and trend pub­li­ca­tions such as Gart­ner mag­a­zine; pro­mot­ing pre­sen­ta­tions by spe­cial­ists; and pro­mot­ing meet­ings with clients in order to learn about their expec­ta­tions.

4.6 Consulting

A con­sult­ing ser­vice from a com­pany that spe­cial­izes in non­tech­ni­cal com­put­ing and is sup­ported by the man­u­fac­turer can pro­vide impor­tant sup­port for the devel­op­ment of the cloud envi­ron­ment. For this rea­son, the fol­low­ing rec­om­men­da­tions should be con­sid­ered: hire a con­sult­ing com­pany to imple­ment the cloud; train staff reg­u­larly; and rely on cloud solu­tion ven­dor sup­port.

4.7 Training

Train­ing is impor­tant so that the CC envi­ron­ment works appro­pri­ately. The fol­low­ing rec­om­men­da­tions can pro­mote train­ing: search spe­cial­ized jour­nals and mag­a­zines to acquire exper­tise and knowl­edge about cloud com­puto­ing; imple­ment ISO cer­ti­fi­ca­tion for the cloud; per­form spot audits of the cloud envi­ron­ment; hire spe­cial­ized train­ing; share knowl­edge through wiki knowl­edge plat­forms; pub­lish and dis­sem­i­nate oper­a­tion man­u­als; par­tic­i­pate in spe­cial­ized forums on the sub­ject; develop root-analy­sis dia­grams to detect sources of prob­lems; seek to keep the team cohe­sive and peren­nial; pro­duce reg­u­lar doc­u­men­ta­tion such as news and peri­od­i­cals; and pro­mote work­shops.

4.8 Pilot Project

An effi­cient way to deploy the cloud is through a pilot project. A well-designed and well-man­aged ini­tial project is desir­able for the team to acquire knowl­edge of the tech­nol­ogy, should be flex­i­ble and open to change. To do this, the fol­low­ing rec­om­men­da­tions are impor­tant: ini­tially deploy a pilot cloud project in an evolv­ing way; seek to use free open source soft­ware ini­tially; acquire tech­nol­ogy matu­rity in a prac­ti­cal and evo­lu­tion­ary way; pro­gres­sively expand the pilot project; rely on spe­cial­ized com­pany con­sult­ing from the start; and main­tain the ini­tial cloud envi­ron­ment away from the tra­di­tional enter­prise envi­ron­ment.

4.9 Challenges to Overcome

Respon­dents reported some dif­fi­cul­ties dur­ing the cloud deploy­ment process. The lack of knowl­edge on the client’s behalf was cited as a seri­ous dif­fi­culty, and in some cases led to erro­neous assump­tions and improper oper­a­tions. Another dif­fi­culty is that legacy occur in rela­tion to the use pol­icy’s imple­men­ta­tion, where exces­sive rules may ham­per or greatly restrict user free­dom. Users with a com­pli­cated struc­ture where the inter­nal processes are not well defined hin­der the imple­men­ta­tion of the cloud. Also, another dif­fi­culty is that legacy sys­tems are often not com­pat­i­ble with the new cloud envi­ron­ment, and the sys­tems migra­tion is impaired. Another dif­fi­culty is related to sys­tems that require authen­ti­ca­tion of users, espe­cially in cases of authen­ti­ca­tion with Microsoft Active Direc­tory (AD) func­tion­al­ity. Lastly, accord­ing to the inter­views, there were many cases where the cus­tomer had a strong sense of own­er­ship over the data cen­ter and many cus­tomers were resis­tance to join the cloud envi­ron­ment because they did not trust in it.

4.10 Cloud Management

The inter­vie­wees empha­sized the impor­tance of effi­ciently man­ag­ing cus­tomers’ cloud projects and of imple­ment­ing a sys­tem of timely com­mu­ni­ca­tion of events to cus­tomers, demon­strat­ing trans­parency and part­ner­ship in cloud man­age­ment.

4.11 Cloud Operational Support

Regard­ing oper­a­tional sup­port of the cloud, the inter­vie­wees felt that a level 1 of local sup­port ser­vice should be imple­mented for imme­di­ate cus­tomer ser­vice and an addi­tional two lev­els should be imple­mented in order to han­dle more com­pli­cated occur­rences that can not be resolved at pre­vi­ous lev­els. The cloud man­ager should only be involved at the high­est level of occur­rences del­e­gat­ing lev­els 1 and 2 to local cloud sup­port at the cus­tomer site. How­ever, some steps need to be taken by the cloud man­age­ment body, such as link mon­i­tor­ing, imple­men­ta­tion of event con­trol sys­tems, and the estab­lish­ment of rules for fire­wall release.

4.12 Marketing in the Cloud

The impor­tance of encour­ag­ing the use of cloud through the dis­sem­i­na­tion of ser­vices through mar­ket­ing was reported. Some exam­ples of pos­si­ble mea­sures include the imple­men­ta­tion of a com­mer­cial man­age­ment, the devel­op­ment of events for the dis­sem­i­na­tion of cloud ser­vices, the pro­duc­tion of printed and media cat­a­logs of ser­vices, the pro­mo­tion of the cloud on inter­nal sites and the devel­op­ment of cam­paigns for use of the ser­vices and pro­vide a cloud usage sim­u­la­tor on the cor­po­rate site of the man­ag­ing body for exper­i­men­tal use by the client. Estab­lish met­rics for the sale of cloud ser­vices and make efforts to join the cloud.

4.13 Migration to Cloud

The process of migra­tion to the cloud envi­ron­ment must be done through design and requires a lot of care and atten­tion. The fol­low­ing rec­om­men­da­tions can be use­ful to assist the process of migrat­ing ser­vices to the cloud: set up a sep­a­rate net­work for the legacy sys­tems of the com­pany to be migrated; stim­u­late cus­tomers’ spon­ta­neous adher­ence to the cloud; ini­tially migrate web ser­vices; care­fully eval­u­ate what will be migrated to the cloud; assess the tech­ni­cal fea­si­bil­ity of each migra­tion project; and elab­o­rate a model of migra­tion con­tain­ing require­ments, model of solu­tion and points to con­sider pos­i­tive and neg­a­tive for this deci­sion mak­ing.

4.14 Decentralize Systems

In the cloud envi­ron­ment, sys­tem pro­duc­tion must be stim­u­lated. While man­ag­ing the cloud core, it is impor­tant that the admin­is­tra­tion of sys­tems be decen­tral­ized to the units respon­si­ble for each. The inter­vie­wees made the fol­low­ing rec­om­men­da­tions on this sub­ject: out­source soft­ware fac­tory to pro­duce cloud sys­tems; stim­u­late the pro­duc­tion of cus­tomized sites for cus­tomers; and del­e­gate appli­ca­tion devel­op­ment to client units; against third-party appli­ca­tions.

4.15 Decentralize Datacenters

The dat­a­cen­ter man­age­ment should also be decen­tral­ized, with a suf­fi­cient sup­port struc­ture being set up for the client units. In this sense, it is desir­able to imple­ment the fol­low­ing actions: assign unique URL for each client; deliver cus­tomer por­tals that can be cus­tomized by clients; pro­vide a man­age­ment envi­ron­ment so that each client can man­age it; and allo­cate an IT admin­is­tra­tor on each client unit to pro­vide envi­ron­men­tal man­age­ment and tech­ni­cal sup­port ser­vices.

4.16 Shift to Public Cloud

The abil­ity to extend pro­cess­ing and stor­age resources through pub­lic clouds is of great value. To this end, inter­vie­wees made the fol­low­ing rec­om­men­da­tions: when con­tract­ing pub­lic clouds, request the man­age­ment of the data; estab­lish cri­te­ria for con­tract­ing pub­lic clouds; estab­lish key points for trans­ship­ment in pub­lic clouds; per­form tests with exter­nal providers; eval­u­ate the con­tract­ing of a finan­cial bro­ker to cover imme­di­ate and emer­gency costs with pub­lic clouds; and adopt pre­ven­tive mea­sures against inef­fi­cien­cies and breaches of con­tract of com­pa­nies that pro­vide pub­lic clouds.

4.17 Infrastructure Requirements

The cloud infra­struc­ture must be well planned for in order for the busi­ness envi­ron­ment to have oper­a­tional sup­port. To ensure these infra­struc­ture require­ments, impor­tant rec­om­men­da­tions have been sug­gested: develop the tech­ni­cal spec­i­fi­ca­tion of infra­struc­ture require­ments of the cloud envi­ron­ment; choose to work with the cloud orches­tra­tor who has hyper con­ver­gent infra­struc­ture; choose an orches­tra­tor that has devel­oped free soft­ware; request assis­tance and terms of ref­er­ences from spe­cial­ized com­pa­nies; and hire an inte­grated cloud solu­tion.

4.18 Service Standard

The def­i­n­i­tion of ser­vice stan­dards is impor­tant for pre­serv­ing the secu­rity of the cloud envi­ron­ment. In this sense, observ­ing the fol­low­ing rec­om­men­da­tions may be con­ve­nient: vir­tu­al­ize all cloud projects; imple­ment cen­tral­ized access authen­ti­ca­tion; give cus­tomers agility and auton­omy to man­age resources in a stan­dard­ized way; and fos­ter inno­va­tion and ser­vice devel­op­ment by observ­ing basic rules and stan­dards for secu­rity and sys­tems devel­op­ment.

4.19 Customer Benefits

The iden­ti­fi­ca­tion of cus­tomer ben­e­fits is the most effi­cient way to ensure the suc­cess of cloud deploy­ment in the orga­ni­za­tion, build­ing loy­alty and win­ning allies. In this sense, the advan­tages to cus­tomers can be per­ceived by empha­siz­ing and demon­strat­ing the fol­low­ing resources: sav­ing resources by clients; adopt­ing admin­is­tra­tive trans­parency of the cloud envi­ron­ment; pro­vid­ing oper­a­tional per­for­mance; offer­ing and rein­forc­ing the impor­tance of auto­matic scal­a­bil­ity; giv­ing self-admin­is­tra­tion of the envi­ron­ment to the client; offer­ing an envi­ron­ment-friendly oper­a­tion; pro­vid­ing sta­tis­tics on resource use; demon­strat­ing the sav­ings in elec­tric­ity received by the cus­tomer; demon­strat­ing the sav­ings obtained in soft­ware licens­ing costs; offer­ing attrac­tive price in rela­tion to the mar­ket for cus­tomer’s adhe­sion; pro­vid­ing a reduced cost to the cus­tomer; and allow­ing cus­tomiza­tion of the envi­ron­ment by the cus­tomer.

4.20 Cloud Security

Infor­ma­tion secu­rity in the cloud envi­ron­ment requires great atten­tion from orga­ni­za­tions, as sev­eral crit­i­cal aspects of clouds are related to this topic. There­fore, there were many rec­om­men­da­tions to ful­fill this goal: estab­lish local secu­rity rules; encrypt data com­mu­ni­ca­tions; imple­ment audit­ing and noti­fi­ca­tions to users in case of non-com­pli­ance with secu­rity rules; imple­ment fire­wall man­age­ment; imple­ment man­ual con­nec­tiv­ity con­trol; invest in the train­ing of the secu­rity team; per­form secu­rity tests reg­u­larly; guide users in the use of cloud resources; deploy secu­rity team; and keep inno­va­tion projects con­fi­den­tial.

4.21 Legislation

Com­pli­ance with leg­is­la­tion is one of the impor­tant pre­cepts in pub­lic admin­is­tra­tion. Greater care with cit­i­zens is nec­es­sary for the preser­va­tion of their per­sonal data and com­pli­ance with the var­i­ous laws that gov­ern reg­u­late the pro­tec­tion of per­sonal data. There­fore, the inter­vie­wees pointed out impor­tant rec­om­men­da­tions: pro­tect users’ per­sonal data, guide pub­lic admin­is­tra­tion users and employ­ees about cur­rent leg­is­la­tion; and users from pub­lic clouds.

5. Conclusions

Regard­ing the char­ac­ter­is­tics of this study, all of the clouds adopted by the orga­ni­za­tions are pri­vate and were imple­mented in less than five years. In addi­tion, he clouds imple­mented in these orga­ni­za­tions do not allow for migra­tion to pub­lic clouds. One of the rea­sons for adopt­ing only pri­vate clouds within these orga­ni­za­tions is that the IT is focused only on the inter­nal user and oper­a­tions, with­out a com­mer­cial pur­pose.

The rec­om­men­da­tions recorded were the result of the coop­er­a­tion of the inter­vie­wees, based on their expe­ri­ence and the con­cor­dant points between them. All the users and the man­agers are sat­is­fied with the return on invest­ments in this type of tech­nol­ogy. Addi­tion­ally, var­i­ous improve­ments were per­ceived in terms of IT resources and data pro­cess­ing, among other issues, sug­gest­ing that the deploy­ment of this tech­nol­ogy is fea­si­ble.

To sum­ma­rize, this research found twenty-one rec­om­men­da­tions for the suc­cess­ful adop­tion of CC in the gov­ern­ment sec­tor that are based on a set of inter­views per­formed in three orga­ni­za­tions in Brazil. The aim was to have a list of cloud com­put­ing rec­om­men­da­tions not only from a lit­er­a­ture review per­spec­tive but also from the view of prac­ti­tion­ers. In the case of this research, these rec­om­men­da­tions emerged from the expe­ri­ences of the inter­vie­wees that had suc­cess in the imple­men­ta­tion of cloud com­put­ing in the gov­ern­ment sec­tor. There­fore, the rec­om­men­da­tions from this study can aid man­agers in mak­ing bet­ter deci­sions regard­ing cloud com­put­ing imple­men­ta­tion in the pub­lic sec­tor.

This research has some lim­i­ta­tions. The col­lected data was lim­ited to three pub­lic orga­ni­za­tions in Brazil. Nev­er­the­less, these orga­ni­za­tions are impor­tant and rel­e­vant in the con­text of the coun­try, due to the IT infra­struc­ture and the knowl­edge and exper­tise of the inter­vie­wees on the domain of cloud com­put­ing.
Due to the length of this arti­cle, we did not dis­cuss and com­pare the find­ings with other stud­ies from the lit­er­a­ture review. We intend to con­tinue inves­ti­gat­ing this topic to improve the results of these rec­om­men­da­tions with other stud­ies. For instance, to clas­sify the order of impor­tance of each rec­om­men­da­tion.

The val­i­da­tion of the rec­om­men­da­tions in other con­texts and coun­tries as well as the com­par­i­son of con­cerns between pri­vate and pub­lic orga­ni­za­tions regard­ing imple­men­ta­tion of cloud envi­ron­ments will improve our under­stand­ing of the adop­tion of this tech­nol­ogy. We also intend to iden­tify the impact of each rec­om­men­da­tion in the process of deploy­ing CC, in order to cre­ate a roadmap to assist deci­sion-mak­ers in the process of max­i­miz­ing the ben­e­fits of this tech­nol­ogy.

Acknowledgments

This work has been sup­ported by FCT—Fun­dação para a Ciên­cia e Tec­nolo­gia within the Pro­ject Scope: UID/CEC/00319/2019.

References

• Alshamaila, Y., S. Papa­gian­ni­dis and F. Li (2013). Cloud com­put­ing adop­tion by SMEs in the north east of Eng­land: A multi‐per­spec­tive frame­work. Jour­nal of Enter­prise Infor­ma­tion Man­age­ment 26(3), 250–275.

  Ben­basat, I., D. K. Gold­stein and M. Mead (1987). The Case Research Strat­egy in Stud­ies of Infor­ma­tion Sys­tems. MIS Quar­terly 11(3), 369–386.

  Bhisikar, A. (2011). G-Cloud: New Par­a­digm Shift for Online Pub­lic Ser­vices IaaS PaaS SaaS. Inter­na­tional Jour­nal of Com­puter Appli­ca­tion 22(8), 24–29.

  Bianchi, I. S., R. D. Sousa, R. Pereira and J. von Hil­leg­ers­berg (2017). Base­line Mech­a­nisms for IT Gov­er­nance at uni­ver­si­ties. Pro­ceed­ings 25^th Euro­pean Con­fer­ence on Infor­ma­tion Sys­tems (ECIS), Guimarães, Por­tu­gal, 1551–1567.

  Branco, T., F. de Sá-Soare, and A. L. Rivero (2017). Key Issues for the Suc­cess­ful Adop­tion of Cloud Com­put­ing. Pro­ce­dia Com­puter Sci­ence 121, 115–122.

  CSA (2011). Secu­rity Guid­ance for Crit­i­cal Areas of Focus in Cloud Com­put­ing V3.0. Cloud Secu­rity Alliance.

  Con­way, G. and E. Curry (2010). Man­ag­ing Cloud Com­put­ing: A Life Cycle Approach,. 2^nd Inter­na­tional Con­fer­ence on Cloud Com­put­ing and Ser­vices Sci­ence CLOSER 2012, 198–207.

  Date, H., R. Ramaswamy and H. Gang­war (2015). Under­stand­ing deter­mi­nants of cloud com­put­ing adop­tion using an inte­grated TAM-TOE model. Jour­nal of Enter­prise Infor­ma­tion Man­age­ment 28(1), 107–130.

  Dekker, D. L. (2015). Cloud Secu­rity Guide for SMEs. Greece: ENISA.

  Dempsey, K., N. Chawla, L. John­son, A. Jones, A. Ore­baugh, M. Scholl and K. Stine (2011). Infor­ma­tion Secu­rity Con­tin­u­ous Mon­i­tor­ing (ISCM) for Fed­eral Infor­ma­tion Sys­tems and Orga­ni­za­tions. NIST Spe­cial Pub­li­ca­tion 800-137.

  Dubé, L. and G. Paré (2003). Rigor in infor­ma­tion sys­tems pos­i­tivist case research: cur­rent prac­tices, trends, and rec­om­men­da­tions. MIS Quar­terly 27(4), 597–636.

  Goyal, S. (2014). Pub­lic vs Pri­vate vs Hybrid vs Com­mu­nity—Cloud Com­put­ing: A Crit­i­cal Review. Inter­na­tional Jour­nal of Com­puter Net­work and Infor­ma­tion Secu­rity 6(3), 20–29.

  ISACA (2014). Con­trols and Assur­ance in the Cloud: Using COBIT-5. ISACA.

  Jansen, W. and T. Grance (2011). Guide­lines on Secu­rity and Pri­vacy in Pub­lic Cloud Com­put­ing. NIST Spe­cial Pub­li­ca­tion 800-144 .

  John­son, D. and K. Grayson (2005). Cog­ni­tive and affec­tive trust in ser­vice rela­tion­ships. Jour­nal of Busi­ness Research 58(4), 500–507.

  Keeney, R. L. (1992). Value Focused Think­ing—A Path to Cre­ative Deci­sion­mak­ing. Cam­bridge, Mass­a­chu­setts: Har­vard Uni­ver­sity Press.

  Keeney, R. L. (2001). Mod­el­ing Val­ues for Tele­com­mu­ni­ca­tions Man­age­ment. IEEE Trans­ac­tions on Engi­neer­ing Man­age­ment 48(3), 370–379.

  Low, C., Y. Chen and M. Wu (2011). Under­stand­ing of deter­mi­nants of cloud com­put­ing adop­tion. Indus­trial Man­age­ment & Data Sys­tems 111(7), 1006–1023.

  Lui, F., J. Tong, J. Mao, R. Bohn, J. Messina, L. Bad­ger and D. Leaf (2011). NIST Cloud Com­put­ing Ref­er­ence Archi­tec­ture. NIST Spe­cial Pub­li­ca­tion 500-292.

  Mall­mann, G. L. and A. C. G. Maçada (2018). Adop­tion of Cloud Com­put­ing: A Study with Pub­lic and Pri­vate Hos­pi­tals in a Devel­op­ing Coun­try. Inter­na­tional Jour­nal of Inno­va­tion and Tech­nol­ogy Man­age­ment 15(5), 1850044.

  Mat­toon, S., B. Hensle and J. Baty (2011). Cloud Com­put­ing Matu­rity Model Guid­ing Suc­cess with Cloud Capa­bil­i­ties. Com­put­ing, 13-13.

  Morais, N. D. S. (2015). Pro­posta de Mod­elo de Migração de Sis­temas de Ambi­ente Tradi­cional para Nuvem Pri­vada para o Polo de Tec­nolo­gia da Infor­mação do Exército Brasileiro. Mas­ter Dis­ser­ta­tion. Uni­ver­si­dade de Brasília.

  Myers, M. D. (2013). Qual­i­ta­tive Research in Busi­ness and Man­age­ment, sec­ond edi­tion. Sage Pub­li­ca­tions.

  Myers, M. D. and M. New­man (2007). The qual­i­ta­tive inter­view in IS research: Exam­in­ing the craft. Infor­ma­tion and Orga­ni­za­tion 17(1), 2–26.

  NIST (2010). Guide for Apply­ing the Risk Man­age­ment Frame­work to Fed­eral Infor­ma­tion Sys­tems. NIST Spe­cial Pub­li­ca­tion 800-37.

  Poul­let, Y. (2009). Data pro­tec­tion leg­is­la­tion: What is at stake for our soci­ety and democ­racy. Com­puter Law and Secu­rity Review 25(3), 211–226.

  Qian, R. and P. Palvia (2013). Towards An Under­stand­ing of Cloud Com­put­ing’s Impact on Orga­ni­za­tional IT Strat­egy. Jour­nal of Infor­ma­tion Tech­nol­ogy Case and Appli­ca­tion Research 15(4), 34–54.

  Rep­schlaeger, J., S. Wind, R. Zarnekow and K. Tur­owski (2013). Deci­sion Model for Select­ing a Cloud provider: A Study of Ser­vice Model Seci­sion Pri­or­i­ties. 19^th Amer­i­cas Con­fer­ence on Infor­ma­tion Sys­tems, AMCIS 2013 - Hyper­con­nected World: Any­thing, Any­where, Any­time, 1031–1041.

  Ross, R., J. C. Oren and M. McEvil­ley (2014). Sys­tems Secu­rity Eegi­neer­ing: An Inte­grated Approach to Build­ing Trust­wor­thy Resilient Sys­tems. NIST Spe­cial Pub­li­ca­tion 800-160.

  Senyo, P., E. Addae and R. Boateng (2018). Cloud com­put­ing research: A review of research themes, frame­works, meth­ods and future research direc­tions. Inter­na­tional Jour­nal of Infor­ma­tion Man­age­ment 38(1), 128–139.

  Stankov, I., R. Dat­senka and K. Kurbel (2012). Ser­vice level agree­ment as an instru­ment to enhance trust in cloud com­put­ing—An analy­sis of infra­struc­tureas-a-ser­vice providers. 18^th Amer­i­cas Con­fer­ence on Infor­ma­tion Sys­tems 2012—AMCIS 2012, 3813–3822.

  Tri­pathi, A. and B. Par­i­har (2011). E-Gov­er­nance chal­lenges and cloud ben­e­fits. Pro­ceed­ings 2011 IEEE Inter­na­tional Con­fer­ence on Com­puter Sci­ence and Automa­tion Engi­neer­ing—CSAE 2011, 351–354.

  Trivedi, H. (2013). Cloud Adop­tion Model for Gov­ern­ments and Large Enter­prises. Work­ing Paper. Mass­a­chu­setts Insti­tute of Tech­nol­ogy.

  Velte, A. T., T. J. Velte and R. Elsen­peter (2010). Cloud Com­put­ing: A Prat­i­cal Aproach. New York, USA: McGraw-Hill.

  Wein­hardt, C., A. Anan­da­si­vam, B. Blau, N. Borissov, T. Meinl, W. Michalk and J. Stoesser (2009). Cloud Com­put­ing—A Clas­si­fi­ca­tion, Busi­ness Mod­els, and Research Direc­tions. Busi­ness & Infor­ma­tion Sys­tems Engi­neer­ing 1(5), 391–399.