{"text_format":"1","workbook":"xlsx","n_sheets":9,"sheets":["CoverSheet","Instructions","Framework","Assessment Definitions","Survey","Scoring Detail","Scoring Summary","SlidebarMetrics","Set Parameters"],"not_rendered":{"charts":0,"images":5,"macros":1,"external_links":2,"defined_names":44,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"CoverSheet","index":0,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":false,"merged":[]}

{"sheet":"Instructions","index":1,"n_rows":15,"n_cols":5,"rows_kept":15,"cut":false,"hidden":false,"merged":[[14,1,14,14],[0,4,0,20],[2,1,2,15],[4,1,4,15],[6,1,6,14],[8,1,8,14],[10,1,10,14],[12,1,12,14]]}
[null,null,null,null,"Cloud Questionnaire Maturity Assessment Instructions"]
[]
[null,"The survey you are about to take will be used to measure your organization’s Cloud Maturity readiness against a maturity model and scan potential opportunities to leverage Cloud capabilities.  The survey is organized around multiple dimensions – each includes a set of key attributes which define the practices and competencies in place within your organization today."]
[]
[null,"For each of these attributes, you will also be asked to define where you want your organization to be in the future.  Note that the most important characteristics are highlighted. The survey takes roughly 60 minutes to complete and our consultants are available to review the results with you.  All results are kept anonymous and used only for overall benchmarking purposes. On the Survey Tab for each question, please enter in the digit 1 to 5 that corresponds to your maturity level. "]
[]
[null,"Instructions"]
[]
[null,"We appreciate your time and input in providing data on your organization's Cloud Maturity."]
[]
[null,"If some of the features in this sheet do not work, please ensure that your MACROS ARE ENABLED. "]
[]
[]
[]
[null,"If you do not have the most current version of excel, the sliders/graphics may not work.  If this is the case, you will need to manually enter the data in the spaces provided on the Survey tab."]

{"sheet":"Framework","index":2,"n_rows":1,"n_cols":3,"rows_kept":1,"cut":false,"hidden":false,"merged":[[0,2,0,5]]}
[null,null,"Cloud Questionnaire Maturity Assessment Framework"]

{"sheet":"Assessment Definitions","index":3,"n_rows":24,"n_cols":3,"rows_kept":24,"cut":false,"hidden":false,"merged":[[0,2,0,5]]}
[null,null,"Cloud Questionnaire Maturity Assessment Definitions"]
[]
[null,"Terms","Definitions"]
[null,"Operational","Assessment of operational readiness (both in IT and the business) to support, manage, and operate cloud services"]
[null,"Regulatory","Assessment of regulatory, security, risk, and compliance for cloud services"]
[null,"Business Alignment","Assessment of business alignment to utilize cloud services based on business requirements, usability, and value"]
[null,"Technology","Assessment of the current technology estate (infrastructure, applications, architecture, etc.) for utilizing cloud services"]
[null,"SaaS (Software as a Service)","Business operations over a network (internet based)"]
[null,"Business and Technology Operations","Key primary activities of the organization to deliver the value expected under the strategy."]
[null,"People","Organizational structures, systems, and ways of working that should achieve the best equitable performance possible from its people."]
[null,"Process","This dimension tracks the maturity of processes; alignment to policies, frameworks, definition of roles and competencies, and structures; and integration with other IT and business stakeholders."]
[null,"Technology","This dimension assesses the effectiveness and usage of services, applications, infrastructure, data, and architecture supporting the business."]
[null,"Data","This dimension evaluates the mechanisms that support making intelligent, quantitatively-based decisions.  It assesses report mapping to process and KPI's and physical data architecture."]
[null,"Risk and Controls","This dimension assesses the management of fraud, financial, regulatory, and technical risks and compliance issues by analyzing business control structures, risk hierarchy, and financial statement items."]
[null,"IaaS (Infrastructure as a Service)","Rent storage, processing, network, and other computing resources"]
[null,"PaaS (Platform as a Service)","Deploy customer-created applications to the cloud"]
[null,"CSP (Cloud Service Provider)","PaaS (Amazon Web Services (AWS), Microsoft Azure), SaaS (GoogleDocs, Salesforce), IaaS (Rackspace)"]
[null,"ITIL","Information Technology Infrastructure Library (ITIL) describes Best Practice in IT Service management. It provides a framework for the governance of IT and focuses on the continual measurement and improvement of the quality of IT service delivered, from both a business and a customer perspective. This focus is a major factor in ITIL’s worldwide success and has contributed to its prolific usage and to the key benefits obtained by those organizations deploying the techniques and processes throughout their organizations."]
[null,"COBIT","The Control Objectives for Information and related Technology (COBIT) provides a comprehensive framework that assists enterprises to achieve their objectives for the governance and management of enterprise IT. COBIT 5 integrates the knowledge previously dispersed over the three ISACA frameworks: COBIT, Val IT, and Risk IT. It covers the lifecycle of governance, strategic, and tactical management within the IT domain."]
[null,"TBM (Technology Business Management)","The TBM Framework was formally introduced in 2012 by the TBM Council, a non-profit professional organization, promoting the adoption of the principles of transparency to cost, consumption, quality and performance of IT resources, and to support management decision making around IT investments.  The TBM Framework is focused on both run-the-business (RtB) and grow-the-business (GtB) activities. There are three main areas within TBM that all rely on foundational financial modelling of technology costs and drivers. The three areas consist of IT Funding & Service Charging, IT Financial Analytics, and IT Planning & Budgeting. TBM collectively enables the entire program of running the Business of IT by providing a data-driven framework for measuring, managing and communicating the budget, cost, consumption, and value of IT"]
[null,"TOGAF","The Open Group Architecture Framework (TOGAF) is a framework - a detailed method and a set of supporting tools - for developing an enterprise architecture. It may be used freely by any organization wishing to develop an enterprise architecture for use within that organization. It is typically modeled at four levels: Business, Application, Data, and Technology. It relies heavily on modularization, standardization, and already existing, proven technologies and products."]
[null,"IT Asset Management","IT asset management (ITAM) is the set of business practices that join financial, contractual and inventory functions to support life cycle management and strategic decision making for the IT environment. Assets include all elements of software and hardware that are found in the business environment."]
[null,"CASB (Cloud Access Security Brokers)","Cloud access security brokers (CASBs) are on-premises, or cloud-based security policy enforcement points, placed between cloud service consumers and cloud service providers to combine and interject enterprise security policies as the cloud-based resources are accessed. CASBs consolidate multiple types of security policy enforcement. Example security policies include authentication, single sign-on, authorization, credential mapping, device profiling, encryption, tokenization, logging, alerting, malware detection/prevention and so on."]
[null,"FedRAMP","The Federal Risk and Authorization Management Program (FedRAMP) is a government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services. This process ensures conformity with U.S. Federal government security, certification, accreditation requirements among government information technology systems."]

{"sheet":"Survey","index":4,"n_rows":81,"n_cols":19,"rows_kept":81,"cut":false,"hidden":false,"merged":[[26,1,26,2],[46,1,46,2],[60,1,60,2],[0,1,0,18]]}
[null,"Cloud Maturity Assessment"]
[]
[null,"Maturity Question",null,null,"Level 1",null,"Level 2",null,"Level 3",null,"Level 4",null,"Level 5",null,"Current",null,"Future",null,"Comments"]
[]
[1,"Operational (10)","Category","Framework"]
[]
[null,"A service management organization is implemented across the IT function looking at the IT service components and end-to-end delivery model, reporting capacity, usage metrics and user experience accordingly","IT Service Management","ITIL","The is no service management capability within the IT function",null,"Capability exists, but is inconsistent and distributed across the IT function as part of the job description of managers overseeing particular IT services (e.g. network managers and admins look after the vendor relationships).",null,"A service management organization is implemented across the IT function looking at the component level of an IT service and managing and reporting capacity and usage metrics accordingly.",null,"A service management organization is implemented across the IT function looking at the IT service components and end-to-end delivery model, reporting capacity, usage metrics and user experience accordingly.",null,"The service management organization has implemented processes for monitoring IT services at the component and end-to-end delivery model. Cloud service provider performance is monitored in the context of user experience, adherence to service levels, 'real time' capacity and usage metrics. This is done to inform the vendor management team so that decisions around ongoing 'right-fit' vendors for the business can be made on a rolling basis.",null,1,null,{"$f":"MIN(O7+1,5)","v":2}]
[]
[null,"IT services are charged back to the business based on the cloud principles of 'on demand' and 'pay per use'.  The business units would be billed regularly on a usage basis, which would provide transparency over the value of IT services provided.","IT Financial Management","ITIL / TBM","IT is a single cost center across the business.",null,"Charge back is implemented at a project level for commissioning only and not ongoing usage.",null,"Charge back for IT services is based on a per capital basis: the number of users in the business is directly proportional to the charge.",null,"Charge back to business units for ongoing usage is limited to shared core infrastructure services (e.g. fixed line and mobile telephony).",null,"IT services are charged back to the business based on the cloud principles of 'on demand' and 'pay per use'. The business units would be billed regularly on a usage basis which provides transparency for the value of IT services provided.",null,1,null,{"$f":"MIN(O9+1,5)","v":2}]
[]
[null,"A test management function is in place to provide business and technical assurance on the migration to cloud services. This function has a focus on consistency of performance and service availability.  Also, a testing regime is in place to provide ongoing assurance after the completion of the migration,\ndue to the agile nature of the cloud.","Release Management","ITIL","There is no test management function in place to provide business and technical assurance.",null,"Testing is performed on a per project basis and ad hoc in its organization, resourcing and planning.",null,"A test management function is in place with common practices embedded into new projects.",null,"A test management function is in place with a library of business and technology test scripts to support specific business change programs. This includes the cloud but is limited to implementation and migration of services.",null,"A test management function is in place to provide business and technical assurance over the migration to cloud services with a focus on consistency of performance and service availability. On completion of migration, due to the agile nature of cloud, an ongoing testing regime is in place to provide ongoing assurance.",null,1,null,{"$f":"MIN(O11+1,5)","v":2}]
[]
[null,"A 'real-time' software management system is implemented through an integrated platform between the IT function and CSPs.  The platform supports the implementation of business rules by the IT function as well as usage thresholds and 'real-time' alerting limits to provide timely interventions. Furthermore, it supports constraints for usage across different platforms and geographies by the CSP.","Software Asset Management","COBIT","There is no defined governance model or process in place to manage software compliance.",null,"Software compliance processes are not defined and are typically reactive in response to a vendor audit.",null,"There is a defined governance model or process in place for the management of software compliance. However, this is  constrained to in-house run IT services and does not cover third party vendors.",null,"There is a defined governance model and process in place for the management of software compliance across the IT ecosystem of vendors. Reporting is retrospective of usage.",null,"A 'real-time' software management system is implemented through an integrated platform between the IT function and CSPs. The platform supports the implementation of business rules by the IT function as well as usage thresholds and 'real-time' alerting limits. Furthermore, it supports constraints for usage across different platforms and geographies by the CSP.",null,1,null,{"$f":"MIN(O13+1,5)","v":2}]
[]
[null,"An incident monitoring and alerting process as well as a supporting technology platform are implemented to aggregate incidents across the CSP ecosystem. These incidents are used to provide a management dashboard view of security and operational impacts on the business' IT services. The dashboard also contains insights into root cause analysis for event coordination and management.","Service Operations","ITIL","There is no defined process in place for managing incidents. Response to incidents tends to be reactive.",null,"There is a defined incident management process implemented that focuses on IT component level monitoring, alerting and resolution. It does not take a service orientated view.",null,"There is a defined incident management process implemented that has a service orientated view within the IT function and does not coordinate with third party service providers.",null,"There is a central point that monitors disparate feeds from the IT service supply chain (internal and cloud) on all high priority incidents. This central point is used for coordination, management and resolution.",null,"An incident monitoring and alerting process as well as a supporting technology platform are implemented to aggregate incidents across the CSP ecosystem. These incidents are used to provide a management dashboard view of security and operational impacts on the business' IT services. The dashboard also contains insights into root cause analysis for event coordination and management.",null,1,null,{"$f":"MIN(O15+1,5)","v":2}]
[]
[null,"A service integration layer is deployed that manages user access to disparate cloud solutions. Self-service registration and single sign-on technologies  are leveraged to access the cloud in a consistent manner which will reduce complexity.  Most of the commoditized activities of the helpdesk function have moved to a cloud service, with associated internal efficiencies in terms of headcount and operations.","Service Operations","ITIL","The IT helpdesk is large in  terms of managing service operations.  It manages user enrollment to new services, user lock outs and credential changes across a number of disparate services.  Most of their time is involved in low level incidents.",null,"The IT helpdesk is large in terms of managing service operations. Point solutions have been implemented for user registration and self-service credential changes. Most of their time is involved in low level incidents.",null,"The IT helpdesk is reduced in terms of headcount with basic management tasks automated internally. Disparate solutions still persist for different CSPs. More time is involved in higher level incident management.",null,"The IT helpdesk is reduced in terms of headcount with basic management tasks automated internally. Disparate solutions still persist for different CSPs. However, there is more integration and cooperation between the internal IT Helpdesk and CSP Helpdesk. More time is involved in higher level incident management.",null,"A service integration layer is deployed that manages user access to disparate cloud solutions. Self-service registration and single sign-on technologies are leveraged to access the cloud in a consistent manner which will reduce complexity. Most of the commoditized activities of the helpdesk function have moved to a cloud service, with associated internal efficiencies in terms of headcount and operations.",null,1,null,{"$f":"MIN(O17+1,5)","v":2}]
[]
[null,"The organization has a strong capability to implement change across all areas of the business, including people, processes and tools. A mature Change Management Office is capable to driving change as part of the project process, and strong alignment between the business and IT organization ensures that any change required delivers strong results.","Strategic Direction","COBIT","The organization is very resistant to change, and IT projects often fail due to poor business support for the initiative.",null,"The organization manages change at a department or silo level, and the ability to change varies considerably across the business. Many IT projects fail if they cross internal organizational boundaries.",null,"The organization manages IT change within an IT Change or Program Management Office (PMO). This office schedules IT projects to minimize business impact, but typically has no direct ability to drive business change. IT projects must compete with other business PMOs for resources and business acceptance.",null,"A central business change function manages IT change and ensures access to business resources and prioritization. The organizational culture is resistant to significant business change, and an immature alignment between business and IT outcomes challenges the PMO to consistently deliver major IT projects as expected.",null,"The organization has a strong capability to implement change across all areas of the business, including people, processes and tools. A mature Change Management Office is capable to driving change as part of the project process, and strong alignment between the business and IT organization ensures that any change required delivers strong results.",null,1,null,{"$f":"MIN(O19+1,5)","v":2}]
[]
[null,"The organization views IT as a commodity resource to be integrated into wider business operations. The retained internal IT organization provides oversight and direction for IT suppliers, who provide IT service outcomes to the business as opposed to specific infrastructure or applications.","Strategic Direction","COBIT / TBM","The internal IT function performs all areas of IT delivery, including requirements specification, architecture, design, application build, system build, service management and operational management.",null,"The organization specifies IT technologies, architecture, design and performs service and operational management roles. Actual build and provisioning suppliers are used to provide specific technical skillsets.",null,"IT Business-As-Usual (BAU) management activities including build, support and run are performed by an external group. The organization retains service specification, architectural control, project delivery and performs service management to ensure the linkage between the business and IT.",null,"The organization seeks to minimize performance of IT functions in favor of strategic and business alignment of IT outcomes. Some technical capabilities are retained, including architecture and strategy, but majority of technical functions are performed by suppliers.",null,"The organization views IT as a commodity resource to be integrated into wider business operations. The retained internal IT organization provides oversight and direction for IT suppliers, who provide IT service outcomes to the business as opposed to specific infrastructure or applications.",null,1,null,{"$f":"MIN(O21+1,5)","v":2}]
[]
[null,"Asset and configuration management processes deliver deep knowledge and insight into the use of IT assets by the business. Clear linkages can be made through the application stack from End Users through to physical infrastructure.","Strategic Direction","IT Asset Management","The organization does not have functioning asset or configuration management processes, and has little or no visibility of which IT assets are in the environment. Any internal knowledge is the heads of the IT staff or suppliers.",null,"Asset and configuration management processes exist, but these are immature and provide only incomplete or obsolete information relating to the IT environment.",null,"Mature asset and configuration management processes provide good sources of internal knowledge and data, but these sources are siloed, and not well linked. To gain a holistic knowledge of the environment requires working with disparate data sources.",null,"IP and knowledge relating to the environment are centralized into single repositories allowing the business to connect relationships between assets and asset characteristics. ",null,"Asset and configuration management processes deliver deep knowledge and insight into the use of IT assets by the business. Clear linkages can be made through the application stack from End Users through to physical infrastructure, and reporting toolsets exist to facilitate this.",null,1,null,{"$f":"MIN(O23+1,5)","v":2}]
[]
[null,"The organization is able to support multiple suppliers for all IT services, covering all aspects of process and vendor management. New suppliers can be on boarded into the IT environment with ease due to adoption of open standards, and the architecture for the environment allows compute capacity to be migrated quickly between suppliers.","Strategic Direction","COBIT / TBM","The organization has no ability to support multiple suppliers to provide IT services. The IT architecture is completely reliant on a single internal or external supplier, and would not be able to be accommodate another provider.",null,"The organization uses a single supplier for the majority of IT services, but uses some other suppliers for key tasks, such as application development or legacy system support. The IT architecture is based around a single supplier environment, but other suppliers can be on boarded if they can abstract their networks through address translation. No common standards in place across suppliers.",null,"A primary supplier provides the majority of IT functions, but a range of suppliers also provide services and the IT architecture enables data and services to be shared across suppliers to some extent. The primary supplier determines IT standards to be used by other suppliers.",null,"A number of suppliers provide IT services to the organization, with an integrated architecture allowing various suppliers to provide IT services to the organization with minimal effort. Contractual and technical obstacles however make migration of workload from one supplier to another challenging.",null,"The organization is able to support multiple suppliers for all IT services, covering all aspects of process and vendor management. New suppliers can be on boarded into the IT environment with ease, and the architecture for the environment allows compute capacity to be migrated quickly between suppliers.",null,1,null,{"$f":"MIN(O25+1,5)","v":2}]
[]
[2,"Regulatory (9)"]
[]
[null,"Current policies for information security risks deal with cloud characteristics  e.g. multi-tenanted environments.","Information security risks","CASB / FedRAMP","The policies do not address third parties.",null,"Policies are in place which address third parties but are not fully implemented and under regular review.",null,"Policies recognize use of cloud-type service providers and address risks associated with multi-tenanted environments.",null,"Policies and standards are embedded within the business and reflected in third party contractual agreements.",null,"Third parties are regularly monitored for compliance with these policies.",null,2,null,{"$f":"MIN(O29+1,5)","v":3}]
[]
[null,"The organization needs to know which third parties are handling their data. Also the organization needs to know the relevance of that data either from a business or regulatory point of view.","3rd Party Management","CASB / FedRAMP","There is no inventory of 3rd parties/service providers handling business information.",null,"There is a partial inventory in place which identifies 3rd parties processing information owned by the business.",null,"A full list exists of 3rd parties providing data handling services. However, it is not clear how data is being moved between systems and jurisdictions.",null,"Mechanisms are in place to track and report on data movement between systems and jurisdictions.",null,"Data movements are controlled in line with policies and regulatory frameworks. The data movements are reported on a regular basis and compliance or violations are reported on an incident basis.",null,2,null,{"$f":"MIN(O31+1,5)","v":3}]
[]
[null,"Information security and requirements for safe handling of business information needs to be addressed at a contractual level.","3rd Party Management","CASB / FedRAMP","No information security provisions are included in standard contracts.",null,"Contract with 3rd party requires adherence legal and regulatory frameworks and organization-specific security requirements if applicable.",null,"Contract requires 3rd parties to actively report on adherence to security and regulatory obligations.",null,"Contract contains the right to audit 3rd party systems and controls holding data, where the CSP can support this requirement.",null,"Contract requires the 3rd party to provide continuous reporting on the information security and regulatory obligations and any associated breaches.",null,2,null,{"$f":"MIN(O33+1,5)","v":3}]
[]
[null,"Third parties are reviewed by independent organizations to certify their security and controls to international standards. Furthermore, 3rd parties are subjected to periodic organizational reviews against information security policies pertaining to confidentiality requirements.  This is supported by a 'real-time' compliance dashboard, where breaches are notified in a timely manner.","3rd Party Management","CASB / FedRAMP","There is no formal compliance reporting.",null,"The 3rd party providers provide self-assessment reports on adherence to information security policies and standards.",null,"In addition, the organization performs ad-hoc reviews of 3rd party compliance with information security policies, where a right to audit permits this activity.",null,"CSPs adhere to the appropriate legal and regulatory frameworks and are independently assessed and certified to appropriate control frameworks that may include SSAE 16, under which SOC 1 reporting lies.  Also there is a consideration around SOC 2, SOC 3, ISO27001 and PCI/DSS and others.",null,"CSPs are reviewed by independent organizations to certify their security and controls to international standards. Furthermore, 3rd parties are subjected to periodic organizational reviews against information security policies pertaining to confidentiality requirements. This is supported by a 'real-time' compliance dashboard, where breaches are notified in a timely manner.",null,2,null,{"$f":"MIN(O35+1,5)","v":3}]
[]
[null,"Access controls must be implemented in accordance to regulatory  requirements and across the IT environment. These access controls must be implemented both retained and throughout an ecosystem of CSPs.","Identity and access management","CASB / FedRAMP","There is no record of users accessing data.",null,"There are partial records in place that identify users accessing information owned by the business.",null,"A full record of user access across the business systems in adherence with regulatory and internal security policy requirements is available.",null,"This record includes CSPs. Due to the different access methods, most, but not all user access meets regulatory and internal security policy requirements.",null,"Access controls are implemented in accordance to regulatory requirements and organizational security controls across the IT environment. These access controls are implemented consistently in both retained and throughout an ecosystem of CSPs. ",null,2,null,{"$f":"MIN(O37+1,5)","v":3}]
[]
[null,"The ability to manage user access from a central location or the adoption of federated models are implemented to provide access to data and applications throughout the IT supply chain, including CSPs.  This should be standards based, leveraging open protocols for better integration with CSPs.","Identity and access management","CASB / FedRAMP","User management is performed on a per application basis with multiple identity directories spread throughout the organization.",null,"Partial centralization using a central directory that is leveraged by some applications.",null,"Identity management for key applications is centralized and established.",null,"Protocols for federation across organization with involvement of 3rd parties and the use of single sign on mechanisms are established.",null,"The ability to manage user access from a central location or the adoption of federated models are implemented to provide access to data and applications throughout the IT supply chain, including CSPs. This should be standards based, leveraging open protocols for better integration with CSPs.",null,2,null,{"$f":"MIN(O39+1,5)","v":3}]
[]
[null,"A data classification scheme has been implemented to enable the decision making process for utilizing cloud on a per service basis.","Data Protection","CASB / FedRAMP","There is no data classification approach or policy defined.",null,"An agreed approach for the handling and classification of data is available.",null,"Data has been classified to consider regulatory requirements (e.g. EU data protection).",null,"Data classification includes both regulatory and business confidentiality areas (e.g. secret, restricted, unrestricted or public release).",null,"A data classification scheme has been implemented to enable the decision making process for utilizing cloud on a per service basis.",null,2,null,{"$f":"MIN(O41+1,5)","v":3}]
[]
[null,"Data backups are made available across the retained and cloud ecosystem. The frequency and scope of backups meets regulatory and business requirements.","Data Backups","CASB / FedRAMP","There is no back up policy in place.",null,"An agreed approach for the handling of data backups is in place.",null,"Data backups routines are in place and  incorporate the regulatory requirements (e.g. SOX and FSA regulations).",null,"Data backup routines are in place and include both the regulatory business requirements of IT services.",null,"Data backups are made available across the retained and cloud ecosystem. The frequency and scope of backups meets regulatory and business requirements.",null,2,null,{"$f":"MIN(O43+1,5)","v":3}]
[]
[null,"IT-dependent business processes that span the retained IT and cloud ecosystems can be recovered in the event of a disaster scenario meeting regulatory and business requirements.","Data Backups","CASB / FedRAMP","There is no disaster recovery (DR) policy in place.",null,"An agreed approach for managing IT component recovery in the event of a disaster scenario is in place.",null,"DR is implemented with Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) while maintaining regulatory requirements. The RTOs and RPOs are set by the IT function.",null,"DR is implemented with RTOs and RPOs while maintaining both regulatory and business requirements.",null,"IT-dependent business processes that span the retained IT and cloud ecosystems can be recovered in the event of a disaster scenario meeting regulatory and business requirements.",null,2,null,{"$f":"MIN(O45+1,5)","v":3}]
[]
[3,"Business Alignment (6)"]
[]
[null,"The IT function has a strong visibility of business initiatives and associated projects.  IT can enable the business to make an informed decision on service delivery, whether it be through traditional methods or more appropriate to the cloud characteristics.","Demand Management","ITIL / TBM","There is no mechanism by which engagement with the business occurs.",null,"The business maintains a log of future projects which is sent to IT for their reference.",null,"There is a group responsible for gathering demand information from the business and understanding its the level impact on IT.",null,"Business and IT are represented on a steering committee that is responsible for delivering business change programs.",null,"IT is well informed of current and emerging service delivery platforms through advisor, analyst and vendor relationships. The IT function can influence business change programs early in their lifecycle where technology may enable or enhance the business proposition using cloud technologies.",null,3,null,{"$f":"MIN(O49+1,5)","v":4}]
[]
[null,"Does the organization have a set of strategic objectives to migrate applications to the cloud? (ex. Cost reduction, ROI, flexibility, agility, speed to market, etc.)","Cloud Strategy","ITIL / TBM","No strategic objectives to align with cloud and not utilizing cloud services",null,"No strategic objectives to align with cloud but looking at utilizing  cloud services",null,"No strategic objectives to align with cloud but utilizing  cloud services ",null,"Drafted strategic objectives to align with cloud and utilizing cloud services",null,"Well defined strategic objectives aligned to migrate applications to cloud (SaaS, IaaS, PaaS) and business is well versed in business case to support the model",null,3,null,{"$f":"MIN(O51+1,5)","v":4}]
[]
[null,"Are there tools available to capture and report against achieving the strategic objectives? (ex. Measure cost savings, measure speed to market, accomplish cost reduction, etc.)","Measuring Success","ITIL / TBM","No strategic objectives for cloud and no tools in place to capture strategic objectives",null,"Strategic objects have some elements of IT objectives but no tools in place to capture strategic metrics",null,"Strategic objectives align with Cloud but no tools in place to capture strategic metrics",null,"Strategic objectives align with Cloud and tools are available to capture strategic metrics but not being used",null,"Strategic objectives are well defined and tools are available to capture metrics aligned with the strategic objectives. Business works closely with IT to report and respond to metric results",null,3,null,{"$f":"MIN(O53+1,5)","v":4}]
[]
[null,"The IT function operates effectively across all markets and reflects business structures.  This would mean ability to support business requirements for chosen languages currencies and data protection schemes for all operating jurisdictions.  The focus of IT as seen by the business is a key supplier in the revenue generating supply chains of the business.","Business Alignment","ITIL / TBM","The IT function is siloed and does not reflect the business structure.  The focus is on internal business operations.",null,"The IT function is engaged with the business on a project basis i.e. at the technical design and implementation of the IT aspects on a business change program.  The main focus is on internal business operations.",null,"The IT function is represented within core internal business functions throughout the business change program lifecycle.  The main focus is on internal business operations.",null,"The IT function is actively engaged across the business functions both front office and back office in initiatives that are revenue generating.  It acts as an advisor to the business on IT implementation and sourcing embedded within the business change program.  Its scope is limited in terms of geographic reach and the associated language currency and regulatory requirements of the business.",null,"The IT function operates effectively across all markets and reflects business structures.  This would mean ability to support business requirements for chosen languages currencies and data protection schemes for all operating jurisdictions by managing multiple in-house traditional and cloud platforms that constitute core revenue generating processes.",null,3,null,{"$f":"MIN(O55+1,5)","v":4}]
[]
[null,"The IT function is a key advisor to the procurement process and contract management. They provide  insights in key cloud areas including SLA expectations, usage thresholds, service performance, contract breakpoints, vendor lock in, software, IP ownership and right to audit.  Legal council on complex issues such as  IP is actively sought as well as involvement with the overarching process.","Demand Management","ITIL / TBM","There is no formal procurement and underlying contracting process. Contracts are arranged on an ad hoc basis. Legal counsel may not be sought.",null,"Procurement and underlying contracting processes are in place but IT is not formally involved in the requirements and inputs basis. Legal counsel is required.",null,"Procurement and underlying contracting processes are in place and the IT function is invited to submit requirements on a formal basis for review and input. Legal counsel is required. The procurement  and contracting processes are aligned with timescales associated with traditional outsourcing of services, i.e. years.",null,"Procurement and underlying contracting processes are in place and the IT function takes an active role in the governance and execution of the contracting process for IT related services. Legal counsel is required. The procurement and contracting processes are aligned with traditional outsourcing of services. However, an effective exception process to onboard and offload cloud vendors in a shorter timescale, i.e. weeks to months is in place.",null,"The IT function is a key advisor to the contracting process. They provide insights in key cloud areas including SLA expectations, usage thresholds, service performance, contract breakpoints, vendor lock in, software, IP ownership and right to audit. Legal council on complex issues such as IP is actively sought as well as involvement with the overarching process. The procurement and contracting processes are optimized to enable the onboarding and offloading of CSPs or a regular basis to meet the business demand for better economies and increased functionality.",null,3,null,{"$f":"MIN(O57+1,5)","v":4}]
[]
[null,"A vendor management function is implemented to provide consistency in management practices dealing with third parties.  It actively manages third parties in terms of contracted SLAs and performance metrics.  It demands insight into capacity usage and trending information for cloud platforms.  The function has the agility to manage a number of vendors simultaneously and cycle between them based on demand and cost measures","Demand Management","ITIL / TBM","The is no vendor management capability within the IT function.",null,"Capability exists, but is inconsistent and distributed across the IT function as part of the job description of managers looking after particular IT services, e.g. network managers and admins look after the vendor relationships.",null,"A vendor management function is implemented to provide consistency in management practices dealing with third parties, but is typically a passive function, reactive to problems, not seeking out performance and availability metrics for vendor measurement.",null,"A vendor management function is implemented to provide consistency in management practices dealing with third parties. It actively manages third parties in terms of contracted SLAs and performance metrics. It demands insight into capacity usage and trending information for cloud platforms.",null,"A vendor management function is implemented to provide consistency in management practices dealing with third parties. It actively manages third parties in terms of contracted SLAs and performance metrics. It demands insight into capacity usage and trending information for cloud platforms. The function has the agility to manage a number of vendors simultaneously and cycle between them based on demand and cost measures.",null,3,null,{"$f":"MIN(O59+1,5)","v":4}]
[]
[4,"Technology (10)"]
[]
[null,"An Enterprise Data Architecture (EDA) is fully implemented in the application Software Development Lifecycle (SDLC) and existing systems to support a distributed environment between applications and data sets as befits a cloud-based architecture.  This data architecture should seek to minimize replication and duplication of data sets.","Data Transaction to Cloud","TOGAF / COBIT","There is no explicit enterprise data architecture. Data entities tend to be defined by project or operational requirements.",null,"Applications and data are designed as 'single' systems, typically monolithic system architectures, with no data abstraction layer.",null,"An enterprise data architecture is defined to ensure that data is abstracted from systems. Interfaces are defined and documented.",null,"The enterprise data architecture has been implemented into the SDLC for newer applications, but the existing estate is monolithic in the main. Technologies have been implemented to reduce replication or duplication of data.",null,"An EDA is fully implemented in the application SDLC and existing systems to support a distributed environment between applications and data sets as befits a cloud-based architecture. This data architecture should seek to minimize replication and duplication of data sets.",null,4,null,{"$f":"MIN(O63+1,5)","v":5}]
[]
[null,"The organization's data classification policy is  implemented with business functional data in relation to core processes and applications. This data is stored on a virtualized platform with overarching data management and identification, that enables specified data in the context of applications to be transferred to a CSP.","Data Transaction to Cloud","TOGAF","The majority of server storage is directly attached to individual servers, Direct Attached Storage (DAS).",null,"Some data is stored on a number of shared Network Attached Storage (NAS) devices, but is not application specific and generally unstructured file and print.",null,"Some application-specific data is held on centralized data environments, e.g.  a Storage Area Network (SAN) mixed with  other storage including NAS and DAS. The data management platform does not identify the relationship of data to applications.  Silos of data can be identified and migrated to a CSP but this will be a complex process.",null,"Some application-specific data is held on centralized data environments, e.g. a Storage Area Network (SAN) mixed with other storage including NAS and DAS. The data management platform does not identify the relationship of all data to applications. However, some segregated data can be isolated and migrated to a CSP.",null,"The organization's data classification policy is  implemented with business functional data in relation to core processes and applications. This data is stored on a virtualized platform with overarching data management and identification, that enables specified data in the context of applications to be transferred to a CSP.",null,4,null,{"$f":"MIN(O65+1,5)","v":5}]
[]
[null,"Business Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for critical processes have been defined and mapped to supporting IT applications and infrastructure.  This mapping includes outsourced vendors and CSPs involved in the business processes and all service components have been technologically enabled to meet the business RTOs and RPOs for the entire process.  In terms of the CSP, the service is geo-resilient HA and therefore will meet the most stringent recovery demands and has been tested accordingly.","Business Resilience","CASB / FedRAMP","There is no business process to IT dependency mapping. Disaster Recovery (DR) is not in place.",null,"There is no business process to IT dependency mapping. IT DR has been defined by IT and centers on core applications. There is no interdependency mapping between applications and infrastructure and RTOs and RPOs and not define by the business.",null,"The business has defined critical business processes and associated RTOs and RPOs. Business processes have been mapped to IT services and dependent applications and infrastructure. ITDR has been implemented for many of the critical business processes. Testing is limited to the IT component level, not the business process level.",null,"Business RTOs and RPOs for critical processes have been defined and mapped to supporting IT applications and infrastructure.  IT DR has been implemented for all business critical services.  Testing covers the in-house IT function, but does not include dependencies on outsourced vendors and CSPs.",null,"Business Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for critical processes have been defined and mapped to supporting IT applications and infrastructure.  This mapping includes outsourced vendors and CSPs involved in the business processes and all service components have been technologically enabled to meet the business RTOs and RPOs for the entire process.  In terms of the CSP, the service is geo-resilient HA and therefore will meet the most stringent recovery demands and has been tested accordingly.",null,4,null,{"$f":"MIN(O67+1,5)","v":5}]
[]
[null,"Internet link resilience has been designed and implemented in alignment with the business criticality of services that are on the roadmap for cloud adoption.","Business Resilience","CASB","There is a single link to the Internet with no service levels that meet business requirements for cloud services.",null,"There is a single link to the Internet with service levels for keeping with the business requirements for Business as Usual (BAU) operations.",null,"There is a primary internet link in place supported by a low bandwidth, low cost backup service (e.g. ISDN or xDSL). The latter is a fallback service and does not meet the business requirements for availability and performance. The links are serviced by the same ISP and are not diversely routed.",null,"A resilient internet design has been implemented with a primary link, supported by an enterprise backup solution that meets the business requirements for availability and performance. These links are diversely routed and maintained by different ISPs.",null,"A resilient internet design has been implemented that operates in a load balanced active-active mode. Traffic is dynamically shared to and from the Internet and supplied by diversely routed different ISPs. This will provide uninterrupted service delivery from the cloud and maintain a good user experience. ",null,4,null,{"$f":"MIN(O69+1,5)","v":5}]
[]
[null,"A flexible enterprise integration architecture is defined and managed for all services. The services are loosely coupled and allow for new cloud services to be introduced or decommissioned in standard manner with little disruption to existing services. Furthermore,  the flexible integration layer helps minimize CSP lock in.","Interoperability","TOGAF / COBIT","Integration is project centric and interfaces are specified and implemented to meet project requirements. Little or no standardization is used  and no data or technical reference model exists.",null,"Integration is driven by requirements of major application components (e.g. ERP suites). Interfaces are specified and implemented to meet these requirements. Some standardization or re-use is in place as well as a subset technical reference model.",null,"Wider integration between applications is point-to-point using APIs. This integration layer supports limited flexibility. Some standardization or re-use is in place as well as a subset technical reference model.",null,"Wider integration between applications is point-to-point using APIs. This integration layer supports limited flexibility. Some standardization or re-use is in place as well as a subset technical reference model.",null,"An enterprise integration architecture is defined and managed for all services, which are loosely coupled allowing for new cloud services to be introduced or de-commissioned in standard manner, with little disruption to existing services, minimizing CSP vendor lock in. This platform would use a SoA implementation model and act as the technical reference model for all implementations.",null,4,null,{"$f":"MIN(O71+1,5)","v":5}]
[]
[null,"Internet bandwidth capacity is monitored and managed to keep up with demand.  The implementation facilitates scaling on demand to meet with the elasticity characteristics of the cloud.","Performance","ITIL","The Internet implementation is fixed to its current maximum bandwidth.  To increase performance to accommodate cloud traffic will take a new implementation with possible lead time of several months.",null,"The Internet implementation may technically be upgraded but the commercial terms of the service provision requires lead time of months.",null,"The Internet implementation supports upgrades with an appropriate lead time but there is a lack of capacity monitoring and management to plan changes.",null,"The Internet implementation supports upgrades with an appropriate lead time and capacity monitoring and management are in place to plan changes in keeping with cloud implementations and rollout. However, this does not hold for usage.",null,"Internet bandwidth capacity is monitored and managed to keep up with demand. The implementation facilitates scaling on demand to meet with the elasticity characteristics of the cloud.",null,4,null,{"$f":"MIN(O73+1,5)","v":5}]
[]
[null,"To maintain or enhance user experience for services migrated to the cloud, internal networks have been optimized to reduce latency by using virtualization technologies.  Internal WANs are implemented with acceleration technologies to minimize latency to branched networks.","Performance","ITIL","Internal networks are mostly physically switched and firewalled, impacting performance through latency. There is no monitoring of latency and application performance by protocol on the internal networks. It is therefore not possible to size the impact of cloud and respond accordingly.",null,"Internal networks are mostly physically switched and firewalled, impacting performance through latency.  The network is monitored for network performance by latency and application to allow network administrators to respond accordingly.",null,"Internal networks have been optimized to reduce latency by using virtualization technologies. There is no traffic prioritization on the internal networks and WAN. Network performance is monitored.",null,"Internal networks have been optimized to reduce latency through the use of virtualization technologies. Traffic from the Internet through to the user environments locally and across WANs has been prioritized to deliver a high quality of service. Network performance is monitored.",null,"To maintain or enhance user experience for services migrated to the cloud, internal networks have been optimized to reduce latency by using virtualization technologies.  Internal WANs are implemented with acceleration technologies to minimize latency to branched networks.",null,4,null,{"$f":"MIN(O75+1,5)","v":5}]
[]
[null,"A common security service layer is implemented that integrates common standards for identity management, access control and transport layer encryption for accessing cloud services in a secure and consistent manner. This enhances user experience over the use of multiple different vendor access methods and provides a single point of control for user access configurations.","Security","CASB / FedRAMP","IT security is implemented on a by project basis with point solutions each having their distinct requirements for firewalling, access control and protocol use.",null,"A security architecture is implemented across a group of applications with a common set of controls for firewalling, access control and protocol use. These trust domains are narrowly defined and there is differentiation and replication of security infrastructure across the rest of the enterprise.",null,"A common security architecture implements a common trust model, which is business process centric rather than application centric. Trust domains are broadly defined with role-based controls implemented. They are supported by identity management and standardized protocols. ",null,"A common security service layer is implemented that integrates common standards for identity management, access control and transport layer encryption across the enterprise and 3rd party services. This service layer is implemented both on premise and traditionally outsourced levels.",null,"A common security service layer is implemented which integrates cloud standards for identity management, access control and transport layer encryption for accessing cloud services in a secure and consistent manner (e.g. OAUTH and SAML).",null,4,null,{"$f":"MIN(O77+1,5)","v":5}]
[]
[null,"Systems, i.e. applications, middleware and databases, are designed and implemented to a standard reference architecture. This architecture is based on the cloud principles of distributed application and data models with Service-oriented Architecture (SoA) integration characteristics. Consideration is given to non-relational databases as compared with the more traditional relational databases. Systems are deployed on a fully virtualized core infrastructure with associated characteristics.","Legacy Impacts","TOGAF","Systems are defined by the requirements of individual projects.",null,"System standardization is driven by common system components, i.e. application, middleware and database, which represent a significant proportion of systems capability.",null,"Systems, including applications, middleware and database environments are designed and implemented to a standard reference architecture.",null,"Systems, including applications, middleware and database environments are designed and implemented to a standard reference architecture. This architecture is based on the cloud principles of distributed application and data models with SoA integration characteristics. Consideration is given to non-relational databases as compared with the more traditional relational database.",null,"Systems, i.e. applications, middleware and databases, are designed and implemented to a standard reference architecture. This architecture is based on the cloud principles of distributed application and data models with Service-oriented Architecture (SoA) integration characteristics. Consideration is given to non-relational databases as compared with the more traditional relational databases. Systems are deployed on a fully virtualized core infrastructure with associated characteristics.",null,4,null,{"$f":"MIN(O79+1,5)","v":5}]
[]
[null,"Core infrastructure is virtualized through the server, network and storage to provide a pooled resource environment. This environment is supported by tools for provisioning, work load management and decommissioning.","Legacy Impacts","IT Asset Management","Infrastructures are defined by the requirements of individual system projects and there is little shared or common infrastructure or middleware between major systems. The infrastructure estate is physical, rather than virtualized.",null,"The infrastructure estate has components of virtualization such as server virtualization but not an overall virtualized layer.  Server virtualized is implemented on a project basis and inconsistent across the environment in terms of product selection and configuration.",null,"Server virtualization is designed and implemented to a standard reference architecture. ",null,"Server virtualization is designed and implemented to a standard reference architecture. Storage virtualization is designed and implemented to a standard reference architecture with an abstracted data management layer.",null,"Core infrastructure is virtualized through the server, network and storage to provide a pooled resource environment. This environment is supported by tools for provisioning, work load management and decommissioning.",null,4,null,{"$f":"MIN(O81+1,5)","v":5}]

{"sheet":"Scoring Detail","index":5,"n_rows":39,"n_cols":11,"rows_kept":39,"cut":false,"hidden":false,"merged":[[2,1,3,1],[2,2,3,2],[0,4,0,17],[2,7,2,10]]}
[]
[]
[null,"Capability","Maturity Question",null,"Assessed","Target",null,"Dimension"]
[null,null,null,null,null,null,null,"People","Process","Technology","Data"]
[1,{"$f":"Survey!B5","v":"Operational (10)"},1,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C5,0)","v":"A service management organization is implemented across the IT function looking at the IT service components and end-to-end delivery model, reporting capacity, usage metrics and user experience accordingly"},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C5,14)","v":1},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C5,16)","v":2},null,{"$f":"MATCH(B5,Survey!$B$5:$B$200,0)+2*C5","v":3}]
[null,null,{"$f":"C5+1","v":2},{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C6,0)","v":"IT services are charged back to the business based on the cloud principles of 'on demand' and 'pay per use'.  The business units would be billed regularly on a usage basis, which would provide transparency over the value of IT services provided."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C6,14)","v":1},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C6,16)","v":2}]
[null,null,{"$f":"C6+1","v":3},{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C7,0)","v":"A test management function is in place to provide business and technical assurance on the migration to cloud services. This function has a focus on consistency of performance and service availability.  Also, a testing regime is in place to provide ongoing assurance after the completion of the migration,\ndue to the agile nature of the cloud."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C7,14)","v":1},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C7,16)","v":2}]
[null,null,4,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C8,0)","v":"A 'real-time' software management system is implemented through an integrated platform between the IT function and CSPs.  The platform supports the implementation of business rules by the IT function as well as usage thresholds and 'real-time' alerting limits to provide timely interventions. Furthermore, it supports constraints for usage across different platforms and geographies by the CSP."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C8,14)","v":1},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C8,16)","v":2}]
[null,null,5,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C9,0)","v":"An incident monitoring and alerting process as well as a supporting technology platform are implemented to aggregate incidents across the CSP ecosystem. These incidents are used to provide a management dashboard view of security and operational impacts on the business' IT services. The dashboard also contains insights into root cause analysis for event coordination and management."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C9,14)","v":1},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C9,16)","v":2}]
[null,null,6,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C10,0)","v":"A service integration layer is deployed that manages user access to disparate cloud solutions. Self-service registration and single sign-on technologies  are leveraged to access the cloud in a consistent manner which will reduce complexity.  Most of the commoditized activities of the helpdesk function have moved to a cloud service, with associated internal efficiencies in terms of headcount and operations."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C10,14)","v":1},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C10,16)","v":2}]
[null,null,7,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C11,0)","v":"The organization has a strong capability to implement change across all areas of the business, including people, processes and tools. A mature Change Management Office is capable to driving change as part of the project process, and strong alignment between the business and IT organization ensures that any change required delivers strong results."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C11,14)","v":1},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C11,16)","v":2}]
[null,null,8,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C12,0)","v":"The organization views IT as a commodity resource to be integrated into wider business operations. The retained internal IT organization provides oversight and direction for IT suppliers, who provide IT service outcomes to the business as opposed to specific infrastructure or applications."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C12,14)","v":1},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C12,16)","v":2}]
[null,null,9,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C13,0)","v":"Asset and configuration management processes deliver deep knowledge and insight into the use of IT assets by the business. Clear linkages can be made through the application stack from End Users through to physical infrastructure."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C13,14)","v":1},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C13,16)","v":2}]
[null,null,10,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C14,0)","v":"The organization is able to support multiple suppliers for all IT services, covering all aspects of process and vendor management. New suppliers can be on boarded into the IT environment with ease due to adoption of open standards, and the architecture for the environment allows compute capacity to be migrated quickly between suppliers."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C14,14)","v":1},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$5,Survey!$B$5:$B$200,0)+2*C14,16)","v":2}]
[2,{"$f":"Survey!B27","v":"Regulatory (9)"},1,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C5,0)","v":"Current policies for information security risks deal with cloud characteristics  e.g. multi-tenanted environments."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C15,14)","v":2},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C15,16)","v":3}]
[null,null,{"$f":"C15+1","v":2},{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C6,0)","v":"The organization needs to know which third parties are handling their data. Also the organization needs to know the relevance of that data either from a business or regulatory point of view."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C16,14)","v":2},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C16,16)","v":3}]
[null,null,3,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C7,0)","v":"Information security and requirements for safe handling of business information needs to be addressed at a contractual level."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C17,14)","v":2},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C17,16)","v":3}]
[null,null,4,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C8,0)","v":"Third parties are reviewed by independent organizations to certify their security and controls to international standards. Furthermore, 3rd parties are subjected to periodic organizational reviews against information security policies pertaining to confidentiality requirements.  This is supported by a 'real-time' compliance dashboard, where breaches are notified in a timely manner."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C18,14)","v":2},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C18,16)","v":3}]
[null,null,5,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C9,0)","v":"Access controls must be implemented in accordance to regulatory  requirements and across the IT environment. These access controls must be implemented both retained and throughout an ecosystem of CSPs."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C19,14)","v":2},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C19,16)","v":3}]
[null,null,6,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C10,0)","v":"The ability to manage user access from a central location or the adoption of federated models are implemented to provide access to data and applications throughout the IT supply chain, including CSPs.  This should be standards based, leveraging open protocols for better integration with CSPs."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C20,14)","v":2},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C20,16)","v":3}]
[null,null,7,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C11,0)","v":"A data classification scheme has been implemented to enable the decision making process for utilizing cloud on a per service basis."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C21,14)","v":2},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C21,16)","v":3}]
[null,null,8,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C12,0)","v":"Data backups are made available across the retained and cloud ecosystem. The frequency and scope of backups meets regulatory and business requirements."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C22,14)","v":2},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C22,16)","v":3}]
[null,null,9,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C13,0)","v":"IT-dependent business processes that span the retained IT and cloud ecosystems can be recovered in the event of a disaster scenario meeting regulatory and business requirements."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C23,14)","v":2},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$15,Survey!$B$5:$B$200,0)+2*C23,16)","v":3}]
[3,{"$f":"Survey!B47","v":"Business Alignment (6)"},1,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C5,0)","v":"The IT function has a strong visibility of business initiatives and associated projects.  IT can enable the business to make an informed decision on service delivery, whether it be through traditional methods or more appropriate to the cloud characteristics."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C24,14)","v":3},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C24,16)","v":4}]
[null,null,2,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C6,0)","v":"Does the organization have a set of strategic objectives to migrate applications to the cloud? (ex. Cost reduction, ROI, flexibility, agility, speed to market, etc.)"},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C25,14)","v":3},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C25,16)","v":4}]
[null,null,3,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C7,0)","v":"Are there tools available to capture and report against achieving the strategic objectives? (ex. Measure cost savings, measure speed to market, accomplish cost reduction, etc.)"},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C26,14)","v":3},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C26,16)","v":4}]
[null,null,4,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C8,0)","v":"The IT function operates effectively across all markets and reflects business structures.  This would mean ability to support business requirements for chosen languages currencies and data protection schemes for all operating jurisdictions.  The focus of IT as seen by the business is a key supplier in the revenue generating supply chains of the business."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C27,14)","v":3},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C27,16)","v":4}]
[null,null,5,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C9,0)","v":"The IT function is a key advisor to the procurement process and contract management. They provide  insights in key cloud areas including SLA expectations, usage thresholds, service performance, contract breakpoints, vendor lock in, software, IP ownership and right to audit.  Legal council on complex issues such as  IP is actively sought as well as involvement with the overarching process."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C28,14)","v":3},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C28,16)","v":4}]
[null,null,6,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C10,0)","v":"A vendor management function is implemented to provide consistency in management practices dealing with third parties.  It actively manages third parties in terms of contracted SLAs and performance metrics.  It demands insight into capacity usage and trending information for cloud platforms.  The function has the agility to manage a number of vendors simultaneously and cycle between them based on demand and cost measures"},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C29,14)","v":3},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$24,Survey!$B$5:$B$200,0)+2*C29,16)","v":4}]
[4,{"$f":"Survey!B61","v":"Technology (10)"},1,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C5,0)","v":"An Enterprise Data Architecture (EDA) is fully implemented in the application Software Development Lifecycle (SDLC) and existing systems to support a distributed environment between applications and data sets as befits a cloud-based architecture.  This data architecture should seek to minimize replication and duplication of data sets."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C30,14)","v":4},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C30,16)","v":5}]
[null,null,2,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C6,0)","v":"The organization's data classification policy is  implemented with business functional data in relation to core processes and applications. This data is stored on a virtualized platform with overarching data management and identification, that enables specified data in the context of applications to be transferred to a CSP."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C31,14)","v":4},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C31,16)","v":5}]
[null,null,3,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C7,0)","v":"Business Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs) for critical processes have been defined and mapped to supporting IT applications and infrastructure.  This mapping includes outsourced vendors and CSPs involved in the business processes and all service components have been technologically enabled to meet the business RTOs and RPOs for the entire process.  In terms of the CSP, the service is geo-resilient HA and therefore will meet the most stringent recovery demands and has been tested accordingly."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C32,14)","v":4},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C32,16)","v":5}]
[null,null,4,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C8,0)","v":"Internet link resilience has been designed and implemented in alignment with the business criticality of services that are on the roadmap for cloud adoption."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C33,14)","v":4},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C33,16)","v":5}]
[null,null,5,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C9,0)","v":"A flexible enterprise integration architecture is defined and managed for all services. The services are loosely coupled and allow for new cloud services to be introduced or decommissioned in standard manner with little disruption to existing services. Furthermore,  the flexible integration layer helps minimize CSP lock in."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C34,14)","v":4},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C34,16)","v":5}]
[null,null,6,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C10,0)","v":"Internet bandwidth capacity is monitored and managed to keep up with demand.  The implementation facilitates scaling on demand to meet with the elasticity characteristics of the cloud."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C35,14)","v":4},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C35,16)","v":5}]
[null,null,7,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C11,0)","v":"To maintain or enhance user experience for services migrated to the cloud, internal networks have been optimized to reduce latency by using virtualization technologies.  Internal WANs are implemented with acceleration technologies to minimize latency to branched networks."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C36,14)","v":4},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C36,16)","v":5}]
[null,null,8,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C12,0)","v":"A common security service layer is implemented that integrates common standards for identity management, access control and transport layer encryption for accessing cloud services in a secure and consistent manner. This enhances user experience over the use of multiple different vendor access methods and provides a single point of control for user access configurations."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C37,14)","v":4},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C37,16)","v":5}]
[null,null,9,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C13,0)","v":"Systems, i.e. applications, middleware and databases, are designed and implemented to a standard reference architecture. This architecture is based on the cloud principles of distributed application and data models with Service-oriented Architecture (SoA) integration characteristics. Consideration is given to non-relational databases as compared with the more traditional relational databases. Systems are deployed on a fully virtualized core infrastructure with associated characteristics."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C38,14)","v":4},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C38,16)","v":5}]
[null,null,10,{"$f":"INDEX(Survey!$B$5:$B$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C14,0)","v":"Core infrastructure is virtualized through the server, network and storage to provide a pooled resource environment. This environment is supported by tools for provisioning, work load management and decommissioning."},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C39,14)","v":4},{"$f":"INDEX(Survey!$B$5:$R$200,MATCH(B$30,Survey!$B$5:$B$200,0)+2*C39,16)","v":5}]

{"sheet":"Scoring Summary","index":6,"n_rows":7,"n_cols":9,"rows_kept":7,"cut":false,"hidden":false,"merged":[[0,1,0,4]]}
[null,"Cloud Maturity Assessment Survey Scorecard"]
[]
[null,"Capability Category","Assess","Target"]
[1,{"$f":"TRIM(LEFT(I4,LEN(I4)-4))","v":"Operational"},{"$f":"getScoreAssess(A4)","v":1},{"$f":"getTargetAssess(A4)","v":2},null,null,null,null,{"$f":"VLOOKUP(A4,'Scoring Detail'!$A$1:$B$49,2,FALSE)","v":"Operational (10)"}]
[2,{"$f":"TRIM(LEFT(I5,LEN(I5)-4))","v":"Regulatory"},{"$f":"getScoreAssess(A5)","v":2},{"$f":"getTargetAssess(A5)","v":3},null,null,null,null,{"$f":"VLOOKUP(A5,'Scoring Detail'!$A$1:$B$49,2,FALSE)","v":"Regulatory (9)"}]
[3,"Business Alignment",3,4,null,null,null,null,{"$f":"VLOOKUP(A6,'Scoring Detail'!$A$1:$B$49,2,FALSE)","v":"Business Alignment (6)"}]
[4,"Technology",4,5,null,null,null,null,{"$f":"VLOOKUP(A7,'Scoring Detail'!$A$1:$B$49,2,FALSE)","v":"Technology (10)"}]

{"sheet":"SlidebarMetrics","index":7,"n_rows":7,"n_cols":6,"rows_kept":7,"cut":false,"hidden":false,"merged":[]}
[null,null,null,null,null,"Average Overall  Score"]
[null,{"$f":"ROUND(SUMPRODUCT(B4:B7,D4:D7)/SUM(D3:D7),1)","v":2.5},{"$f":"ROUND(SUMPRODUCT(C4:C7,D4:D7)/SUM(D3:D7),1)","v":3.5}]
["graphNum","rawAssScore","rawTrgScore","weight","Capability Category","Category Score"]
[1,{"$f":"'Scoring Summary'!C4","v":1},{"$f":"'Scoring Summary'!D4","v":2},1,{"$f":"'Scoring Summary'!B4","v":"Operational"}]
[{"$f":"A4+1","v":2},{"$f":"'Scoring Summary'!C5","v":2},{"$f":"'Scoring Summary'!D5","v":3},1,{"$f":"'Scoring Summary'!B5","v":"Regulatory"}]
[{"$f":"A5+1","v":3},{"$f":"'Scoring Summary'!C6","v":3},{"$f":"'Scoring Summary'!D6","v":4},1,{"$f":"'Scoring Summary'!B6","v":"Business Alignment"}]
[4,{"$f":"'Scoring Summary'!C7","v":4},{"$f":"'Scoring Summary'!D7","v":5},1,{"$f":"'Scoring Summary'!B7","v":"Technology"}]

{"sheet":"Set Parameters","index":8,"n_rows":13,"n_cols":5,"rows_kept":13,"cut":false,"hidden":false,"merged":[]}
["Set Parameters"]
[]
["SourceGraph"]
[]
[]
[null,null,null,"Low","High"]
["TargetSheet","SlidebarMetrics",null,{"$f":"ROUND(E7-0.8,1)","v":1},{"$f":"D8-0.001","v":1.7990000000000002}]
["NumberSlideGraphs",4,null,{"$f":"ROUND(E8-0.8,1)","v":1.8},{"$f":"D9-0.001","v":2.5990000000000002}]
[null,null,null,2.6,3.399]
["StartGraph","F4",null,3.4,4.1989999999999998]
["TotalScoreLocation","F2",null,{"$f":"E11-0.8","v":4.2},5]
[]
["DebugCell","H2"]