A cloud layer assessment helps determine where an application should reside. This is largely determined by the level of control IT wishes to retain over the application. For example, an organization that only wants to manage users might choose a SaaS model. If greater control over the application and data is required, the PaaS model would be a better choice. In an IaaS model, the cloud provider only manages the servers, storage, virtualization and networking, leaving the customer in control of the operating system, middleware and runtime environment, as well as the application and data.

As with a more traditional hosting model, it's important to understand workload demands on the infrastructure and where there are potential bottlenecks. Organizations should perform their own testing to evaluate how a cloud environment affects compute, storage and network resources.

Businesses need to determine what they are accountable for versus what they expect from a service provider. Most public cloud vendors do not provide administrative support. Organizations need to have the technical expertise in-house to design the right solution or seek the services of an outside provider. They should define what level of management their applications require and have an identified change management process.

Building cybersecurity into the cloud strategy is critical, particularly with the growing adoption of hybrid cloud models. The hybrid cloud adds another layer of complexity to the IT infrastructure, making it more difficult to secure. Common weaknesses include third-party dependencies that create vulnerabilities hackers can exploit. Organizations need to understand where data resides within the hybrid cloud infrastructure, and develop a holistic approach to security to address these risks.

In the cloud, applications typically link with other cloud-based applications to deliver functionality. Given this interdependence, organizations must understand how the app handles data requests, how data is exchanged and how much data users can access. A profile of an application’s data usage is also important to rightsize the app in the cloud. This typically involves profiling an app for several days or even weeks to collect information about CPU and memory usage, throughput and latency, and network connection frequency.