CLOUD SERVICE CAPABILITY MATURITY MODEL (CS-CMM): A PRELIMINARY STUDY ON ITS CONCEPTUAL DESIGN

Transcription

1 190 International Journal of Electronic Business Management, Vol. 12, No. 3, pp (2014) CLOUD SERVICE CAPABILITY MATURITY MODEL (CS-CMM): A PRELIMINARY STUDY ON ITS CONCEPTUAL DESIGN Chung-Yang Chen *, Chun-Shuo Chen and Xiang-Ting Wang Department of Information Management National Central University Taoyuan (320), Taiwan ABSTRACT As information technologies evolve and demands of enterprises on larger data and integrated info services keep growing, the market of cloud services (CS) attracts many more players nowadays. However, the quality of the services may vary due to different service capabilities and a service often requires integration with other services, CS providers need a standard way in implementing and improving the quality of their services. With the focus on process, this paper applies the concepts of CMMI (Capability Maturity Model Integration) and presents a CS quality implementation and improvement guidance model, called CS-CMM (Cloud Service Capability Maturity Model). Due to its novelty and preliminary status, this paper focuses on introducing the concepts and structural design of the model. This includes the concepts of CS process areas as the building blocks of the model, CS maturity and capability levels as the roadmap towards superior service quality, and the institutionalization design for sustaining the implementation results. Keywords: Cloud Services Management, Process Focus, CMMI, Continual Improvement 1 1. INTRODUCTION As information technologies (IT) advances and enterprises demand more on larger and distributed data, cloud services have become one of the IT services that are heavily relied on nowadays. Cloud services in this paper focus on providing the desired data or information functions from multiple and distributed sources. To serve the needs, more and more implementers participate and collaborate in providing better services [3]. To implement better cloud services, providers must concern about how to intensify and comprehend their services to customers, as well as to keep services stable under the impacts of different service qualities due to various capabilities of the providers. It is known that sustainable IT implementations rely on the processes that build and manage the implementation. Hence, to ensure a better quality, providers may implement and improve their services by focusing on process [19]. On the other hand, cloud services are often a combination of ad-hoc service components that may be from different providers. To develop integrated and chained services, suppliers may implement their services based on a consistent * Corresponding author: cychen@mgt.ncu.edu.tw development platform. Therefore, the motivations of this study are outlined as follows: A process-focus reference model is needed as a roadmap for providers in implementing superior cloud services, as well as a platform for suppliers to consistently build the services upon. The need for guiding service providers to be able to sustain the service implementations. To serve these needs, this paper introduces a Capability Maturity Model for Cloud Services, abbreviated as CS-CMM. The CS-CMM adopts the CMM/CMMI [16], which is process focused and emphasizes on organizational process improvements in software development. Inside the framework, the contents of the model is a collection of process areas (i.e. what to do [16] in implementing ad-hoc cloud services) that are identified based on related literature. With the formation of process areas, CS-CMM constitutes five service maturity levels and six capability levels. The model also includes an institutionalization design that applies from CMM/CMMI, for CS providers to be able to sustain the service implementation. Due to its novelty and interdisciplinary nature, in this paper we focus on reviewing the applied materials and introducing the concepts and structural

2 C.Y. Chen et al.: Cloud Service Capability Maturity Model (CS-CMM): A Preliminary Study 191 design of the model. Therefore, in the following contents, the theoretical basis of the model is surveyed first. Then the structural design of the model is presented. Since this paper is a conceptual and introductory review study, the implementation issues, both theoretically and practically, of the model design, are discussed. Finally, several directions for the future development of the model are summarized. 2. LITERATURE REVIEW 2.1 Cloud Services Cloud service is associated with a new paradigm for the provision of data and information computing infrastructure. This paradigm shifts from a localized computing scheme to network and the Internet to reduce the costs associated with the management of hardware and software resources [19]. Most people in the industry agree on the cloud s two primary benefits: increasing agility and reducing costs. To increase developer agility and reduce costs, a cloud platform should provide a rich set of services, such as storage, queuing, and identity services that simplify and accelerate the programmer s job, free the programmer from dealing with mundane, low-level issues [5]. Moreover, cloud computing services, or called cloud services in this paper, are a way for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction [9, 7]. According to NIST [9], cloud computing is composed of three service types: Software as a Service, SaaS: It refers to service provider s applications running on a cloud infrastructure. The applications are accessible from various client devices through a thin client interface, such as a web browser. The web-based is an example of SaaS. Platform as a Service, PaaS: The users of a PaaS service are able to develop applications using programming languages, libraries, and tools that are supported by the service provider. Infrastructure as a Service, IaaS: It provides data processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run their software, including operating systems. In the development of CS-CMM, the design of the model should cover the three different service types. Specifically, the model should be able to be adopted by the providers of the three service types in improving their service capability or maturity. 2.2 Application Review: CMM/CMMI Overview In software industry, there is a process reference model, called Capability Maturity Model (Integration), abbreviated CMM/CMMI, for guiding companies to achieve superior software development. CMM/CMMI is the collective term for two models: CMM, and CMMI. CMM is a formal model that contains only the software engineering discipline. As successful software development should include not only software engineering, systems engineering, but also people (including suppliers) and process management. Therefore, all of the required disciplines are comprehensively integrated into one model, that is, CMMI, in which I stands for integration. The process focused CMM/CMMI suggests that sustainable software development relying on processes that define and manage software development. In this regard, the CMM/CMMI identifies sets of recommended practices in a number of key process areas that comprehensively cover the lifecycle of technical software development and both the organization and project level of managing the development [12]. Since CS-CMM applies CMM/CMMI, in the following this paper reviews the concepts and contents of CMM/CMMI in details Process Areas in CMM/CMMI Specifically, in CMM/CMMI, process area (PA) is a cluster of functionally related practices. Each process area has Specific Goals (SGs) which must be satisfied, and each SG contains several Specific Practices (SPs) for achieving the SG. For example, the following list demonstrates the SGs and related SPs for the Project Planning process area [16]: SG 1 Establish Estimates SP 1.1 Estimate the Scope of the Project SP 1.2 Establish Estimates of Work Product and Task Attributes SP 1.3 Define Project Lifecycle Phases SP 1.4 Estimate Effort and Cost SG 2 Develop a Project Plan SP 2.1 Establish the Budget and Schedule SP 2.2 Identify Project Risks SP 2.3 Plan Data Management SP 2.4 Plan the Project s Resources SP 2.5 Plan Needed Knowledge and Skills SP 2.6 Plan Stakeholder Involvement SP 2.7 Establish the Project Plan SG 3 Obtain Commitment to the Plan SP 3.1 Review Plans That Affect the Project SP 3.2 Reconcile Work and Resource Levels SP 3.3 Obtain Plan Commitment

3 192 International Journal of Electronic Business Management, Vol. 12, No. 3 (2014) Institutionalization Design The aforementioned process areas and their process ingredients tell software organizations what to do in implementing quality software development. In order to help organizations to sustain their process implementation continually, CMMI/CMMI has established a concept that is called Level of Institutionalization. In the models of CMM/CMMI, institutionalization of process implementation has different levels, each level must be satisfied by achieve their Generic Goal (GG) and Generic Practices (GP). The following list demonstrates the GGs and the associated GPs in CMM/CMMI s institution design: GG1: Achieve Specific Goals GP1.1 Perform specific practices GG2: Institutionalize a Managed Process GP2.1 Establish org. policy. GP2.2 Plan the process. GP2.3 Provide resources. GP2.4 Assign responsibility. GP2.5 Train people. GP2.6 Manage configurations. GP2.7 Identify & involve relevant stakeholders. GP2.8 Monitor and control the process. GP2.9 Objectively verify adherence. GP2.10 Review status with mgmt. GG3: Institutionalize a Defined Process GP3.1 Establish a defined process. GP3.2 Collect improvement information. GG4: Institutionalize a Quantitatively Managed Process. GP4.1 Establish quantitative objectives for the process. GP4.2 Stabilize sub-process performance. GG5: Institutionalize an Optimizing Process. GP5.1 Ensure continuous process improvement. GP5.2 Correct root causes of problems Capability and Maturity Levels The usage of CMM/CMMI has two representations, continuous and staged [16]. If an organization would like to concentrate on a particular process area, they may choose the continuous representation of CMM/CMMI. In this case, the continuous representation uses capability levels to characterize the state of the organization s processes relative to individual process areas, and provides a recommended order for approaching process improvement within each specified process area. If organizations would like to receive a collective result, they may choose the staged representation of CMM/CMMI. The staged representation focuses on overall maturity as measured by maturity levels, and uses maturity levels to characterize the overall state of the organizational performance relative to a set of related process areas as a whole [16]. As Table 1 shows, CMM/CMMI defines five levels of maturity and six levels of capability levels. The following list states the definition of the capability and maturity levels in CMM/CMMI. In determining the level of maturity or capability, the generic goals play a dominant role. For example, GG-2 is used to determine ML-2 of the seven process areas, or CL-2 of a particular process area. 2.3 Related Works about Capability and Maturity Models of CS The research of CMM-based cloud service reference model has recently been an important topic in academia. Many studies have developed ad-hoc process model for the cloud computing domain by referring CMM/CMMI. The following are the existing related works. Mattoon, Hensle and Baty [8] developed a maturity model for cloud computing. Their work suggests several maturity levels based on collective experience and best practices. Shi, Zhe and Huib [17] constructed a capability maturity model, which primarily formed a more complete cloud computing capability evaluation system. Palson, Kennedy and Gopal [11] established a maturity model. The model argues that organizations contracting with cloud providers may be attracted to a low price offered yet have no idea of the risks and potential security lapses that could result due to the providers unwillingness to invest in adequate Web-based security. For those security and risk issues, this paper constructed a maturity model to assist organizations in assessing their relative levels of risk. Creese, Hopkins, Pearson and Shen [2] focused on the process of designing data protection controls into clouds from the outset so as to avoid the costs associated with bolting on security as an afterthought. They suggested a capability maturity model which explores privacy controls within an enterprise cloud deployment, and explores where there may be opportunities to design in data protection controls as exploitation of the cloud matures. The aforementioned works provided a very useful basis to the research of CS-CMM. However, these works are inadequate in terms of comprehensiveness. Firstly, these works are not constructed by focusing on process, they mostly only describe levels of maturity in cloud computing. Secondly, these works do not elaborate the content inside the models. Process areas for implementing and improving cloud services are not addressed in these works. Thirdly, current development of these works does not address either how to sustain the implemented maturity or capability of cloud services.

4 C.Y. Chen et al.: Cloud Service Capability Maturity Model (CS-CMM): A Preliminary Study 193 Table 1: Maturity and capability levels in CMM/CMMI Maturity Level (ML) ML-1 Initial. In ML-1, success depends on the competence and heroics of the people and cannot be repeated unless the same competent individuals are assigned to the next similar project. No process areas are specified in ML-1. ML-2 Managed. ML-2 ensures that existing practices are retained even during times of stress. When these practices are used on efforts similar to the current effort, similar results can be expected. Seven project-management related process areas are in ML-2. ML-3 Defined. At ML-3, processes are well characterized and understood, and are described in standards, procedures, tools, and methods. Eleven process areas are in ML-3, and they are engineering and process management related. ML-4 Quantitatively Managed. In ML-4, product quality and process performance measures are incorporated into organization s measurement repository to support fact-based decision-making. Two process areas of quantitative project and process management are in this level. ML-5 Optimizing. ML-5 focuses on continually improving process performance through both incremental and innovative technological improvements. Two process areas for continual innovation are in ML-5. Capability Level (CL) CL-0 Incomplete. A process area is not performed completely. CL-1 CL-2 CL-3 CL-4 CL-5 Performed. A process area is performed according to its SGs and SPs. Managed. A process area is controlled by established policy, planned process and resources and stakeholders, etc. Defined. A process area is characterized and is able to be tailored. Quantitatively Managed. A process area is managed quantitatively based on its quantitative objective. Optimizing. A process area is improved continually towards innovation. 3. The CS-CMM In this chapter, the Cloud Service-CMM (CS-CMM) is introduced. The introduction of CS-CMM includes the concepts of process areas and the structural design of the model. The establishment of CS-CMM is based on the process-centric CMM/CMMI. Since the concepts of process area, capability and maturity level, and sustainability design are from CMM/CMMI, the introduction will associate with the rationale of the application and modification from the CMM/CMMI Cloud Service Process Areas (CSPA) In the operation of providing quality cloud services, processes that are related to the operation should be identified for the purpose of establishing, managing and sustaining the services. In this regard, CS-CMM adopts the functional process area concept. To identify CSPA, CS-CMM suggests four structural categories: service management, service development, process management and support. The following reviews the rationale of these categories. The identification of process areas should concern existing related works such as the suggestions in Liu [7] and Behrendt [1]. Service management: This category collects fundamental and advanced process areas for managing the services [7], which is reasonable. Example of process areas are, the planning of a cloud service before delivering it to the customer; monitoring the performance of the service in the deployment of the service, configuration control for content management of the service provided [16], etc. Service development: This category was designed based on infrastructure architecture of cloud services. Apart from the CMMI-DEV engineering process areas, two factors ought to be considered. Firstly, process areas of data protection, security, and privacy, since cloud services would have company and personal information stored outside the enterprises [20]. Secondly, process areas of service integration and service migration, which make service integration and migration easier when combining other service components from other providers or external sources. Process management: It is true that organizations need a set of processes to manage ad-hoc business processes. In this category, many of the process management process areas in CMM/CMMI may be adopted. For example, the Organizational Process Focus process area, which is to establish process improvement infrastructure; the Organizational Process Definition process area, which is to establish process assets and 3.1 Structural Model Concepts

5 194 International Journal of Electronic Business Management, Vol. 12, No. 3 (2014) measurement repositories for performance management of ad-hoc service processes [16], etc. Support: This category collects processes that are needed for supporting the management of cloud services and processes that management ad-hoc business processes. Example process areas in this category are, the Configuration Control for content management of the services provided and processes operated [16]. 3.3 Cloud Service Capability and Maturity Since the implementation of cloud services may focus on individual process area or a set of process areas that related to an overall performance topic, for example, sustainable service management, CS-CMM also has two representations: continuous and staged. In the continuous representation, there are six levels of cloud service capability level (CSCL), indicating the roadmap of improvement on individual process area. In the staged representation, CS-CMM designs five cloud service maturity levels (CSML), which are different from CMM/CMMI. Table 2 illustrates the definitions of CSCL and CSML. 3.4 Sustainability Design The structure of the sustainability design in CS-CMM applies the institutionalization requirements from CMM/CMMI. In spite of this, however, there are modifications due to the differences between the operations of software development and cloud services. Table 3 is the tailoring results of the sustainability design for cloud services. In the table, since CSCL/CSML is defined for managing services provided, therefore, the associated generic practices in CMM/CMMI, i.e. GP 2.1 to GP2.10, are modified to better reflect the needs in sustaining a managed cloud service. For example, the requirement of planning in GP2.2 would focus on cloud service. The GP2.6 in CMM/CMMI is removed since it is defined in a process area, Configuration Control that is on a lower/basic maturity level in CS-CMM. Moreover, the establishment of the quantitative objectives and imposing of a quantitative management in the generic practice requirements of GG-4 would focus more on cloud service in CS-CMM. CSCL Level-0 Inadequate Level 1 Performed Level 2 Managed Level 3 Integrated Level 4 Quantitatively Managed Level 5 Optimizing CSML Level 1 Initial Level 2 Managed Level 3 Integrated Level 4 Quantitative ly Managed Level 5 Optimizing Table 2: CSCL and CSML Definition One or more specific goals are unsatisfying, and process has not been institutionalized. Specific goals in process areas are all satisfying. Process areas have reached management institutionalized. Process of process areas has been defined and adjustable. Process areas have been defined and managed in a quantitative way. Process areas have ability to innovate sustainably. Definition Unstable Cloud Service quality, sometimes may not attain customer's request. Providers have achieved service management realm in all available Cloud Services now. Cloud Service providers are capable of new service development, offering general services while customizing according to customers' needs, as well as can be integrated with other providers. Realm that providers define and manage in a quantitative approach as of service management, service development, and process performance. Providers have reached the realm of sustainable service innovation and process innovation.

6 C.Y. Chen et al.: Cloud Service Capability Maturity Model (CS-CMM): A Preliminary Study 195 Table 3: Modified Generic Goals and Associated Generic Practices for Cloud Services GG1: Achieve Specific Goals GP1.1 Perform specific practices GG2: Institutionalize a Managed Service GP2.1 Establish org. policy GP2.2 Plan the service GP2.3 Provide resources GP2.4 Identify and assign responsibilities to relevant stakeholders GP2.5 Train relevant stakeholders GP2.6 Monitor and control the service GP2.7 Objectively verify adherence GP2.8 Review service status with mgt. GG3: Institutionalize a Defined Service GP3.1 Establish a defined process GP3.2 Collect improvement info. GG4: Institutionalize a Quantitatively Managed Service GP4.1 Establish quantitative objectives for the processes of the service GP4.2 Stabilize sub-process performance. GG5: Institutionalize an Optimizing Service GP5.1 Ensure continuous service improvement GP5.2 Correct root causes of problems the process implementation of ML-5. Due to the original foreign (Chinese) language issue, the title of the screens in the demonstration is preserved for the showing the originality of the work. Users can also implement CS-CMM via CSCL. To guide what process areas (PAs) that need to be implemented, the system identifies and maintains frequently-encountered process issues and classifies the issues into seven categories in order to receive a more holistic improvement result. Figure 2 shows a page that guides the user in terms of asking a series of problems step by step, in order to match the defined process issues defined and for providing the PA recommendation. To enable the recommendation, the system features an IF-THEN rule-based inference engine. With the rule-based inference engine, users select the appropriate issues, and then the system provides the recommendation in terms of the desired process areas to address the selected issues. Table 4 below illustrates part of the rules used in the work. 4. IMPLEMENTATION This chapter implements the design into a Web-based information system, named CS-CMM Implementation Guiding System. The system helps cloud service providers diagnose and suggest the service improvement based on CS-CMM. Due to the space limit, here we only reveal the featured critical rule-based approach which is implemented as an engine for enabling the improvement guidance. 4.1 Scenario While users open the guiding system, they enter the system s main page. On the top of main page is a function bar, providing a list of use cases that users can select for using the model and the system. For example, if users click the model purpose button, the main page will show contexts of this model s benefits provided by CS-CMM, as well as how to use CS-CMM in guiding the system users to improve their services. In this system, Process improvement guidelines offers two main methods to help users improve their cloud service: (1) improvement through CSML and (2) improvement through addressing process issues in terms of CSCL. We will discuss more detail as follow: As Figure 1 shows below, the user selects ML-4 as the current maturity level, and then the system shows the next maturity level (ML-5) and the two process areas in this level, as well as shows the GGs that need to be implemented in order to sustain Figure 1: Guidelines of CSML implementation Figure 2: Guidelines of CSCL implementation

7 196 International Journal of Electronic Business Management, Vol. 12, No. 3 (2014) Table 4: The rule-based PA implementation recommendation (partial view) Categories Rules Process issues identified for cloud service improvement in terms of PA recommendation Question 1-1: Do you establish a CS process asset library for managing repeatable CS? Yes: Go to question 1-2. No: Suggest SPD to build the process definition asset library, which helps to establish and maintain the process issues. Question 1-2: Unable to find the root causes when a process-related service problem occurs? Yes: Suggest SPF for enabling a CS process improvement and CAR for identifying and coping root causes during the improvement. No: Go to Question1-3. Question1-3: Unable to the continual action in optimizing the cloud services? Yes: Suggest SIM process area. No: Unable to recommend appropriate process areas at this time. 5. DISCUSSION In this section, we discuss the potential strategic benefits of the model and the system. The discussion is presented through the comparison of related works such as CMM/CMMI related models and the potential values to various CS stakeholders. The research assumptions and limitations of CS-CMM are also discussed. 5.1 Comparison of Related Works We compare CS-CMM with CMM/CMMI and CMMI SVC in order to outline the future research work. The comparison is overly illustrated in Figure 3 and is explained as follows. Firstly, although CMMI-SVC is designed for all types of service operations, there should be some process areas in common, indicated as the A part in Fig.3, among CMMI-SVC and CS-CMM. The shared process areas are deemed core processes in the service industry, be they traditional or cloud computing related. Therefore, in the future development of process areas in CS-CMM, care must be taken to identify the process areas that can be applied from CMMI-SVC. Secondly, although software development has a different operational focus, it may also involve services, as indicated as B in Fig.3, which are also addressed and defined in CMMI SVC. For example, the development of software should include the interaction with the customer/users when performing requirement elicitation, validation test, etc. Thirdly, cloud service implementation should also involve the development of service systems [21, 15]. In this concern, there exist certain process areas, indicated as the part C in Fig.3, which are common in CMMI SVC and CMMI DEV. Finally, with the consideration of all of the three models together, we may find that the three models may also share some core process areas, as indicated as D in Fig.4. Therefore, in the future development of CS-CMM, we are to identify the shared and core processes among CS-CMM, CMMI-DEV and CMMI-SVC. Shared PAs among the three models (D) C B Figure 3: The relationships of CMM-SVC, CMMI-DEV and CS-CMM in a Vines Diagram 5.2 Strategic Benefits The CS-CMM is supposed to bring benefits to the stakeholders in cloud services. In this discussion we focus on the players such as service providers, suppliers of the providers, consultants and service users/customers: Cloud service providers Cloud Service providers are the direct users of CS-CMM. CS-CMM collects necessary process requirements for the providers in order to build more robust and sustainable cloud services. CS-CMM offers a roadmap with two implementation approaches (i.e. CSML and CSCL) that both emphasize a gradual way in improving the quality of the cloud services. Cloud service suppliers It may be the case that a requested service is an integration of many cloud services [10]. In this case, the integration involves multiple providers and the suppliers. When integration is an issue in providing a cloud service, CS-CMM serves as a shared platform for all of the providers and suppliers to communicate in order to establish a standardized and consistent quality performance. Consultants In some case, firms do not request cloud services from the providers but develop the services A

8 C.Y. Chen et al.: Cloud Service Capability Maturity Model (CS-CMM): A Preliminary Study 197 by themselves. In the development of in-house cloud services, consultants play a critical role in professionally helping directing the development [13]. The CS-CMM provides a standard guideline for the consultants to help the providers establish quality cloud services by selecting needed process areas from CS-CMM for the development. Customer/Users The CS-CMM provides an indicator (the level of service maturity or capability) regarding the quality of a requested cloud service and the sustainability of the quality developed by the providers. When selecting potential service providers, the customers can take advantage of the certified level of CSML/CSCL of the providers that help them justify the status of the candidate providers and determine the most appropriate provider. When determining a service provider who is responsible for integrating services, CS-CMM suggests a ML-3 or higher as the requirement for such a service integrator. 5.3 Research Limitations Model Limitations Comprehensiveness of model content So far, process areas in current development of CS-CMM were collected based on two major research reports. Because the model in this study is only focused on the conceptual design, its content, i.e. the process areas, is not yet comprehensively developed in current version. Moreover, because cloud services continually evolve as the business environments constantly change, the process areas once collected in CS-CMM also need to be continually updated in the future to better serve the stakeholders under contemporary business and service environments. Process as the core Cloud services could be studied from many different aspects, and the CS-CMM in this paper focuses on the process perspective, since process is a vital component that integrates human resources, methods, materials, tools, etc. [16]. In spite of this, the process does not play a sole role in cloud service improvements. Other aspects or disciplines such as people management, software engineering, and business intelligence, etc. may also play necessary roles in collaboratively delivering a more comprehensive cloud service System Limitations The implemented system in current study is a research prototype. It has several future works to be done. Firstly, the functions of the system need to be enhanced, such as the user interfaces and some usability issues. Secondly, since the system has implemented a rule-based inference engine for generating process implementation recommendation, the maintenance of the rules become critical as it influence the quality of the recommendation. In this regard, in the further development of the system, we would continually update the rules by collecting more practical feedbacks and expertise. 6. CONCLUSION As cloud computing services and big data are current market trend, there is a need for guidance in developing cloud services as well as a need for establishing a shared platform for service integration, and CS-CMM is developed to serve these needs. In this study we have presented a draft of a process reference model for helping implement and sustain superior cloud services. We have also implemented the design into an information system to demonstrate its usage. We have also discussed the potential benefits by reviewing the model design and walking through the system usage. The model and the system are to be continually improved and evolved. In the future, an empirical study would be conducted in this regard. It would include the more academically defined of process areas, a case report of real industrial usage, as well as the improvement of the system in terms of its user interfaces and the rules management. REFERENCES 1. Behrendt, M., Glasner, B., Kopp, P., Dieckmann, R., Breiter, G., Pappe, S. and Arsanjani, A., 2011, IBM Cloud Computing Reference Architecture 2.0, IBM. 2. Creese, S., Hopkins, P., Pearson, S. and Shen, Y., 2009, Data protection-aware design for cloud services, Cloud Computing, Springer Berlin Heidelberg, pp Dikaiakos, M. D., Pallis, G., Katsaros, D., Mehra, P. and Vakali, A., 2009, Cloud computing: Distributed internet computing for IT and scientific research, Internet Computing, IEEE, Vol. 13, No. 5, pp Durkee, D., 2010, Why Cloud computing will never be free, Communications of the ACM, Vol. 53, No. 5, pp Khalidi, Y. A. and Microsoft, 2011, Building a cloud computing platform for new possibilities, IEEE Computer Society, Vol. 44, No. 3, pp Leitner, P., Inzinger, C., Hummer, W., Satzger, B. and Dustdar, S., 2012, Application-level Performance monitoring of cloud services based on the complex event processing paradigm, th IEEE International Conference on Service-Oriented Computing

9 198 International Journal of Electronic Business Management, Vol. 12, No. 3 (2014) and Applications (SOCA), pp Liu, F., Tong, J., Mao, J., Bohn, R., Messina, J., Badger, L. and Leaf, D., 2011, NIST cloud computing reference architecture, National Institute of Standards and Technology. 8. Mattoon, S., Hensle, B. and Baty, J., 2011, Cloud computing maturity model guiding success with cloud, Oracle Corporation. 9. Mell, P. and Grance, T., 2011, The NIST definition of cloud computing (draft), National Institute of Standards and Technology. 10. Meng, S. and Liu, L., 2013, Monitoringas-a-service in the cloud: Spec phd award (invited abstract), ICPE 13 Proceedings of the 4th ACM/SPEC International Conference on Performance Engineering, ACM, pp Palson Kennedy, R. and Gopal, T., 2010, Assessing the risks and opportunities of cloud computing - defining identity management systems and maturity models, Trendz in Information Sciences & Computing (TISC), IEEE, pp Paulk, M. C., Curtis, B., Chrissis, M. B. and Weber, C. V., 1993, Capability maturity model, IEEE, Vol. 10, No. 4, pp Pearson, S. and Benameur, A., 2010, Privacy, security and trust issues arising from cloud computing, 2nd IEEE International Conference on Cloud Computing Technology and Science, pp Rahumed, A., Chen, H. C., Tang, Y., Lee, P. P. and Lui, J. C., 2011, A secure cloud backup system with assured deletion and version control, 2011 International Conference on Parallel Processing Workshops (IEEE), pp Sakka, M. A., Defude, B. and Tellez, J., 2010, Document provenance in the cloud: Constraints and challenges, networked services and applications - engineering, Control and Management, Springer Berlin Heidelberg, pp SEI (Software Engineering Institute), 2010, CMMI for development, version 1.3. software engineering institute, Carnegie Mellon University. 17. Shi-Qin. Y., Zhe, Z. and Huib, W., 2012, Research of cloud computing capability evaluation based on CMM/CMMI, Application Research of Computers, Vol. 2, No. 1, pp Subashini, S. and Kavitha, V., 2011, A survey on security issues in service delivery models of cloud computing, Journal of Network and Computer Applications, Vol. 34, No. 1, pp Vaquero, L. M., Rodero-Merino, L., Caceres, J. and Lindner, M, 2009, A break in the clouds: Towards a cloud definition, ACM SIGCOMM Computer Communication Review, Vol. 39, No. 1, pp Vaquero, L. M., Rodero-Merino, L., Caceres, J. and Lindner, M., 2009, A break in the clouds: Towards a cloud definition, ACM SIGCOMM Computer Communication Review, Vol. 39, No. 1, pp Wei, Y. and Blake, M. B., 2010, Service-oriented computing and cloud computing: Challenges and opportunities, Internet Computing (IEEE), Vol. 14, No. 6, pp ABOUT THE AUTHORS Chung-Yang Chen is an Associate Professor in the Department of Information Management at National Central University (NCU), Taiwan. His research and teaching expertise interests includes business process management, cloud computing, CMMI, project management, and information & service quality. He has published papers in known academic journals such as European Journal of Operational Research, International Journal of Project Management, IIE Transactions, Journal of Engineering and Technology Management, Computers and Education, Journal of Systems and Software, Total Quality Management and Business Excellence, etc. Chun-Shuo Chen and Xiang-Ting Wang are graduate students in the Department of Information Management at National Central University (NCU), Taiwan. (Received August 2014, revised September 2014, accepted September 2014)

10 C.Y. Chen et al.: Cloud Service Capability Maturity Model (CS-CMM): A Preliminary Study 199 雲端服務能力成熟度模 (CS-CMM) 研究 : 概念設計 陳仲儼 * 陳君碩 王香婷國立中央大學資訊管理學系桃園縣中壢市中大路 300 號 摘要 隨著科技演進及企業需求的改變, 許多業者逐漸加入雲端服務 (Cloud Services) 的行列 然而, 在競爭激烈的雲端服務市場中, 雲端服務的提供會因為業者服務範圍 服務層次與服務深化程度的不同, 而造成雲端服務的品質有所差異 因此, 雲端服務市場需要一個可以清楚表述雲端服務供應商服務提供水準的評估依據, 並可提供不同的服務提供者在進行服務整合的溝通平台 若雲端服務建置的改善與優化可從流程來著手, 那麼吾人可針對雲端服務供應商提供一種持續量測並改善自身雲端服務品質的規範與標準 為此, 本研究嘗試以同樣運用在流程改善的 CMMI(Capability Maturity Model Integration) 為基礎, 提出雲端服務能力成熟度 (Cloud Service-Capability Maturity Model, CS-CMM) 的指引模式 CS-CMM 藉由流程的觀點定義了雲端服務應具備的流程領域, 並針對雲端服務業者在服務管理 服務整合 服務創新等不同的主題境界而定義出服務成熟度與能力度, 並透過制度化設計 (Institutionalization) 確保各項雲端服務成果之永續 關鍵字 : 雲端服務管理 流程專注 能力成熟度整合模式 永續改善 (* 聯絡人 :cychen@mgt.ncu.edu.tw)