A little more than a year ago I presented a session on cloud computing at a CIO conference where I highlighted the three key issues preventing cloud computing adoption: security/privacy, availability and performance. However, in doing some research for a session I gave at CA World this past November, I realized that things have changed. Back in the mid-1990s companies were nervous about leveraging the Internet for these same reasons, and a few years later were equally concerned about moving virtual machines into production.

Today, everyone is using the Internet and running VMs in production, so it's logical to assume that any artificial barriers to cloud adoption will also be broken, certainly in the next 12-18 months. Companies no longer need to know what cloud computing is, they need to learn how to use it.

From many conversations I've had with CIOs and senior IT leaders I've found a growing trend towards companies dipping their toes into public SaaS offerings like Salesforce.com while simultaneously building out some sort of private "cloudish" environment (the "if you build it they will come" strategy). In many cases, the less critical applications were targeted to move first, along with new services launched directly into the private cloud. But is that the best solution?

In my CA World session titled "Cloud Transformation for the Enterprise" I discussed 4 major criteria that need to be considered when it comes to cloud adoption: cost, risk, speed (or agility) and value (or quality). Ironically, most of the people I've spoken with do not consider cost as the main driver for cloud computing. The real #1 driver is speed, and its associated reduction in time-to-market for new and updated services. This should immediately make you think about how to prioritize the migration of cloud applications and services.

If that's the case, should you move your less critical applications to your private cloud first? Should you consider using a public cloud? The answer of course is "it depends" - security, governance and risk all play a role, as well as the need to support handheld devices, drive revenue, etc.

I haven't heard many customers tell me that they have put a thoughtful, detailed plan in place to look at their existing and future applications and services - and determine which ones are actually suitable for a cloud computing environment, based upon technology fit, business value and other criteria. Some are better off remaining in the data center. And, of course, deciding what to move before starting to build out an internal cloud or getting compute capacity from a public cloud provider. Moving without planning (detailed or otherwise) can work, but the risk is pretty high. If you're wrong, costs can actually go up instead of down and quality can suffer. That's the "ready, fire, aim" approach.

That's why I make the case for cloud planning. Do a portfolio analysis of your applications and services first (or at least a good subset of them). Understand any service level requirements, KPIs and key metrics. Project your capacity requirements for proposed target environments. Have a testing plan. Once you have all of that in place, then negotiate contracts and open your checkbook, knowing that you're managing costs, managing risk, maintaining quality and doing it at the right pace to meet your business needs.