Avent has found ways to relinquish some control without sacrificing security. If a cloud solution is easy to use and configure, Avent will turn that over to a business group. Workday, for instance, is a clearly controlled environment, but HR primarily manages it, Phillips says. "We don't need to be in the middle of that, if the tool is intuitive enough and secure enough."
Still, rogue cloud purchases remain a concern. "Shadow IT these days is only a credit card swipe away," Phillips says.
One way Progressive Insurance has helped manage the issue of shadow IT and give its employees access to public cloud resources is through a program called BIG, which stands for the "Business Innovation Garage." It's a software application that acts as a portal for members of the Progressive team to request services.
If the request involves using sensitive customer or mission critical data, then usually those resources will be provided from the company's own data center. If it is a non-sensitive issue, then the software can help users provision resources in a public cloud setting. There are a couple of "mechanics" who help users navigate and provision resources in the Garage, says Progressive Insurance CIO Ray Voelker.
Voelker raises another concern: the "transfer of brand risk." If Progressive were to suffer an outage because of a service provider, then Progressive would bear the brunt of the blame for the outage, even if it were the service provider's fault. Voelker cites the example of a Netflix outage on Christmas Eve in 2012. It was an Amazon Cloud outage, but disgruntled viewers blamed Netflix. "In that scenario, I'm Netflix," Voelker says.
Similarly, SAIC raises the issues of cloud providers' lack of shared liability. "If there's a $4 billion bid, and it's not available at the one moment I need to bid, that's a problem," says Charles Onstott, CTO at the systems integrator and technology services provider. A vendor's $3 credit for downtime won't make up for the loss, Onstott says.
For Campbell Soup, one of the biggest challenges of cloud is limited choice. Customization can detract from the appeal of cloud, since it necessitates developing and maintaining custom code. If you want choice, you're creating complexity that doesn't add value, warns Joe Spagnoletti, CIO at Campbell's.
Related to that issue, some CIOs question the enterprise-readiness of certain cloud offerings.
Nationwide CIO Greg Moran is surprised how immature some first-generation cloud solutions are when they're launched into major enterprises. "We're finding solutions aren't as mature as we're used to," Moran says.
"I'm surprised at how flat-footed traditional large scale IT vendors have been on the topic," Moran adds. Oracle, HP, IBM, Microsoft, "pick your company," he says. There are a lot of solutions from small, innovative companies, but Nationwide isn't keen on working with dozens of smaller players. "It's just not really practical for us to have 50 relationships; we need deep partnerships with quality partners."
Sign up for CIO Asia eNewsletters.