Analyst(s): Lydia Leong, Douglas Toombs, Bob Gill
The market for cloud IaaS is in a state of upheaval, as many service providers are shifting their strategies after failing to gain enough market traction. Customers must exercise caution when choosing providers.
Cloud computing is a style of computing in which scalable and elastic IT-enabled capabilities are delivered as a service using Internet technologies. Cloud infrastructure as a service (IaaS) is a type of cloud computing service; it parallels the infrastructure and data center initiatives of IT. Cloud compute IaaS constitutes the largest segment of this market (the broader IaaS market also includes cloud storage and cloud printing). Only cloud compute IaaS is evaluated in this Magic Quadrant; it does not cover cloud storage providers, platform as a service (PaaS) providers, software as a service (SaaS) providers, cloud service brokerages (CSBs) or any other type of cloud service provider, nor does it cover the hardware and software vendors that may be used to build cloud infrastructure. Furthermore, this Magic Quadrant is not an evaluation of the broad, generalized cloud computing strategies of the companies profiled.
In the context of this Magic Quadrant, cloud compute IaaS (hereafter referred to simply as "cloud IaaS" or "IaaS") is defined as a standardized, highly automated offering, where compute resources, complemented by storage and networking capabilities, are owned by a service provider and offered to the customer on demand. The resources are scalable and elastic in near real time, and metered by use. Self-service interfaces are exposed directly to the customer, including a Web-based UI and an API. The resources may be single-tenant or multitenant, and hosted by the service provider or on-premises in the customer's data center. (For more details, see "Technology Overview for Cloud Infrastructure as a Service").
Cloud IaaS includes not just the resources themselves, but also the automated management of those resources, management tools delivered as services, and cloud software infrastructure services. The last category includes middleware and databases as a service, up to and including PaaS capabilities. However, it does not include full stand-alone PaaS capabilities, such as application PaaS (aPaaS) and integration PaaS (iPaaS).
We draw a distinction between cloud infrastructure as a service, and cloud infrastructure as a technology platform; we call the latter cloud-enabled system infrastructure (CESI). In cloud IaaS, the capabilities of a CESI are directly exposed to the customer through self-service. However, other services, including noncloud services, may be delivered on top of a CESI; these cloud-enabled services may include forms of managed hosting, data center outsourcing and other IT outsourcing services. In this Magic Quadrant, we evaluate only cloud IaaS offerings; we do not evaluate cloud-enabled services. (For more on this distinction, see "Technology Overview for Cloud-Enabled System Infrastructure" [Note: This document has been archived; some of its content may not reflect current conditions], "Technology Overview for Cloud-Enabled Managed Hosting" and "Don't Be Fooled by Offerings Falsely Masquerading as Cloud Infrastructure as a Service" [Note: This document has been archived; some of its content may not reflect current conditions].)
This Magic Quadrant covers all the common use cases for cloud IaaS, including development and testing, production environments (including those supporting mission-critical workloads) for both internal and customer-facing applications, batch computing (including high-performance computing [HPC]) and disaster recovery. It encompasses both single-application workloads and "virtual data centers" (VDCs) hosting many diverse workloads. It includes suitability for a wide range of application design patterns, including both "cloud-native" application architectures and enterprise application architectures.
Customers typically exhibit a bimodal IT sourcing pattern for cloud IaaS (see "Bimodal IT: How to Be Digitally Agile Without Making a Mess" and "Best Practices for Planning a Cloud Infrastructure-as-a-Service Strategy — Bimodal IT, Not Hybrid Infrastructure"). Most cloud IaaS is bought for Mode 2 agile IT, emphasizing developer productivity and business agility, but an increasing amount of cloud IaaS is being bought for Mode 1 traditional IT, with an emphasis on cost reduction, safety and security. This Magic Quadrant considers both sourcing patterns and their associated customer behaviors and requirements.
This Magic Quadrant primarily evaluates cloud IaaS providers in the context of the fastest-growing need among Gartner clients: the desire to have a "data center in the cloud," where the customer retains most of the IT operations responsibility (even if the customer subsequently chooses to outsource that responsibility via third-party managed services). Gartner's clients are mainly enterprises, midmarket businesses and technology companies of all sizes, and the evaluation focuses on typical client requirements.
This Magic Quadrant strongly emphasizes self-service and automation in a standardized environment. It focuses on the needs of customers whose primary need is self-service cloud IaaS, although this may be supplemented by a small amount of colocation or dedicated servers. Organizations that need significant customization or managed services for a single application, or that are seeking cloud IaaS as a supplement to a traditional hosting solution ("hybrid hosting"), should consult the Magic Quadrants for Managed Hosting instead ("Magic Quadrant for Cloud-Enabled Managed Hosting, North America," "Magic Quadrant for Cloud-Enabled Managed Hosting, Europe" and "Magic Quadrant for Cloud-Enabled Managed Hosting, Asia/Pacific"). Organizations that want a fully custom-built solution, or managed services with an underlying CESI, should consult the Magic Quadrants for data center outsourcing and infrastructure utility services ("Magic Quadrant for Data Center Outsourcing and Infrastructure Utility Services, North America," "Magic Quadrant for Data Center Outsourcing and Infrastructure Utility Services, Europe" and "Magic Quadrant for Data Center Outsourcing and Infrastructure Utility Services, Asia/Pacific").
This Magic Quadrant evaluates all industrialized cloud IaaS solutions, whether public cloud (multitenant or mixed-tenancy), community cloud (multitenant but limited to a particular customer community), or private cloud (fully single-tenant, hosted by the provider or on-premises). It is not merely a Magic Quadrant for public cloud IaaS. To be considered industrialized, a service must be standardized across the customer base. Although most of the providers in this Magic Quadrant do offer custom private cloud IaaS, we have not considered these nonindustrialized offerings in our evaluations. Organizations that are looking for custom-built, custom-managed private clouds should use our Magic Quadrants for data center outsourcing and infrastructure utility services instead (see above).
Cloud IaaS providers that target enterprise and midmarket customers generally offer a high-quality service, with excellent availability, good performance, high security and good customer support. Exceptions will be noted in this Magic Quadrant's evaluations of individual providers. Note that when we say "all providers," we specifically mean "all the evaluated providers included in this Magic Quadrant," not all cloud IaaS providers in general. Keep the following in mind when reading the vendor profiles:
In previous years, this Magic Quadrant has provided significant technical detail on the offerings. These detailed evaluations are now published in "Critical Capabilities for Public Cloud Infrastructure as a Service, Worldwide" instead.
When describing each provider, we first summarize the nature of the company and then provide information about its industrialized cloud IaaS offerings in the following format:
Offerings: A list of the industrialized cloud IaaS offerings (both public and private) that are directly offered by the provider. Also included is commentary on the ways in which these offerings deviate from the standard capabilities detailed in "Understanding the Vendor Profiles, Strengths and Cautions," above. We also list related capabilities of interest, such as object storage, content delivery network (CDN) and managed services, but this is not a comprehensive listing of the provider's offerings.
Locations: Cloud IaaS data center locations by country, languages that the company does business in, and languages that technical support can be conducted in.
Recommended mode: We note whether the vendor's offerings are likely to appeal to Mode 1 traditional IT, Mode 2 agile IT, or both, and whether the offerings are likely to be useful for organizations seeking IT transformation. This recommendation reflects the way that a provider goes to market, provides service and support, and designs its offerings. All such statements are specific to the provider's cloud IaaS offering, not the provider as a whole.
Recommended uses: These are the circumstances under which we recommend the provider. These are not the only circumstances in which it may be a useful provider, but these are the use cases it is best used for. For a more detailed explanation of the use cases, see "Recommended Uses" below.
In the list of offerings, we state the basis of each provider's virtualization technology and, if relevant, its cloud management platform (CMP). We also state what APIs it supports — the Amazon Web Services (AWS), OpenStack and vCloud APIs are the three that have broad adoption, but many providers also have their own unique API. Note that supporting one of the three common APIs does not provide assurance that a provider's service is compatible with a specific tool that purports to support that API; the completeness and accuracy of API implementations vary considerably. Furthermore, the use of the same underlying CMP or API compatibility does not indicate that two services are interoperable. Specifically, OpenStack-based clouds differ significantly from one another, limiting portability; the marketing hype of "no vendor lock-in" is, practically speaking, untrue.
For many customers, the underlying hypervisor will matter, particularly for those that intend to run commercial software on IaaS. Many independent software vendors support only VMware virtualization, and those vendors that support Xen may support only Citrix XenServer, not open-source Xen (which is often customized by IaaS providers and is likely to be different from the current open-source version).
For a detailed technical description of public cloud IaaS offerings, along with a use-case-focused technical evaluation, see "Critical Capabilities for Public Cloud Infrastructure as a Service, Worldwide."
We also provide a detailed list of evaluation criteria in "Evaluation Criteria for Cloud Infrastructure as a Service." We have used those criteria to perform in-depth assessments of several providers: see "Amazon Web Services: In-Depth Assessment," "In-Depth Assessment of Google Cloud Platform," "In-Depth Assessment of SoftLayer, an IBM Company" and "Microsoft Azure: In-Depth Assessment."
We summarize all the provider descriptions, and compare their capabilities against our baseline expectation of capabilities, in tabular format in "Toolkit: Comparison Matrix for Cloud Infrastructure-as-a-Service Providers, 2015."
For each vendor, we provide recommendations for use. The most typical recommended uses are:
For all the vendors, the recommended uses are specific to self-managed cloud IaaS. However, many of the providers also have managed services, as well as other cloud and noncloud services that may be used in conjunction with cloud IaaS. These include hybrid hosting (customers sometimes blend solutions, such as an entirely self-managed front-end Web tier on public cloud IaaS, with managed hosting for the application servers and database), as well as hybrid IaaS-PaaS solutions. Even though we do not evaluate managed services, PaaS and the like in this Magic Quadrant, they are part of a vendor's overall value proposition and we mention them in the context of providing more comprehensive solution recommendations.
Source: Gartner (May 2015)
Amazon Web Services (AWS), a subsidiary of Amazon.com, is a cloud-focused service provider with a very pure vision of highly automated, cost-effective IT capabilities, delivered in a flexible, on-demand manner.
Offerings: AWS offers Xen-virtualized multitenant and single-tenant compute, with multitenant storage, along with extensive additional IaaS and PaaS capabilities, including object storage with an integrated CDN (Amazon S3 and CloudFront) and a Docker container service (EC2 Container Service). It is willing to negotiate large-scale single-tenant and on-premises deals (such as the U.S. intelligence community cloud deal). The AWS Marketplace has an extensive selection of third-party software and services. Enterprise-grade support is extra. It has a multi-fault-domain SLA. Colocation needs are met via AWS Direct Connect. See the In-Depth Assessment for a detailed technical evaluation.
Locations: AWS groups its data centers into "regions," each of which contains at least two availability zones. It has regions on the East and West Coasts of the U.S., and in Germany, Ireland, Japan, Singapore, Australia, Brazil, and (in preview) China. It also has one region dedicated to the U.S. federal government. It has a global sales presence. The portal, documentation and support are provided in English, Dutch, French, German, Japanese, Korean, Mandarin, Portuguese, and Spanish, although documentation is comprehensively localized only in English, Japanese and Mandarin.
Recommended mode: AWS primarily appeals to Mode 2 buyers, but is now commonly chosen for Mode 1 needs as well. Transformation efforts are best undertaken in conjunction with an SI.
Recommended uses: All use cases that run well in a virtualized environment, although highly secure applications, strictly compliant or complex enterprise applications (such as SAP business applications) require special attention to architecture.
CenturyLink, a U.S.-based global communications service provider, acquired Savvis, a Web hoster with a long track record of leadership in the hosting market, in 2011. It acquired Tier 3, a pure-play cloud IaaS provider, in November 2013, and merged it into Savvis to create the CenturyLink Technology Solutions business unit.
Offerings: CenturyLink Cloud (CLC) is VMware-virtualized; it can be either multitenant or fully single-tenant. CenturyLink continues to sell legacy Savvis offerings, such as Cloud Data Center 2 and Cloud Servers, when those solutions are appropriate. The Marketplace Program provides third-party software. Enterprise-grade support is extra. Managed services are optional. CenturyLink offers an aPaaS (AppFog), but it is not an integrated solution.
Locations: CLC is available in multiple data centers across the U.S., along with Canada, the U.K., Germany and Singapore. The legacy Savvis cloud offerings are available in a broad range of data centers globally. CenturyLink has global sales, and business is conducted in local languages, but the service is offered only in English.
Recommended mode: CenturyLink primarily appeals to Mode 1 buyers, but may meet Mode 2 requirements that are limited to basic cloud IaaS.
Recommended uses: Self-service cloud IaaS in conjunction with managed services, for all applications that run well in a virtualized environment, excluding batch computing.
CSC is a large, traditional IT outsourcer with a broad range of data center outsourcing capabilities.
Offerings: CSC's offering is VMware-virtualized and supports the vCloud API. It is offered in several tenancy models — CSC-hosted and fully-multitenant (CloudCompute), CSC-hosted single-tenant compute with a multitenant back-end (BizCloud VPE), and fully single-tenant on the customer's premises (BizCloud). While customers can access vCloud Director if they prefer, CSC has built its own, more user-friendly portal. Customers can also choose to use the Agility Platform CMP (formerly ServiceMesh). Managed services are optional. Via its acquisition of Infochimps, CSC also has big-data-related services.
Locations: CSC has multiple cloud data centers in the U.S., as well as in Canada, Brazil, Germany, Luxembourg, the Netherlands, the U.K., Australia, Malaysia and Singapore. It has a global sales presence. Customer support is provided in English, French, German, Italian, Spanish, and Mandarin; technical support is provided in the local language of each data center region. The portal and documentation are available only in English.
Recommended mode: CSC primarily appeals to Mode 1 buyers, but may meet Mode 2 requirements via a hybrid solution that combines the Agility Platform and its own cloud with third-party cloud IaaS offerings.
Recommended uses: Cloud-enabled data center transformation for customers that want a VMware-based service or a private cloud.
Dimension Data, an NTT Group company, is a large SI and value-added reseller. It entered the cloud IaaS market by acquiring OpSource in 2011.
Offerings: Dimension Data's Compute-as-a-Service (CaaS) offering is available in Public (multitenant VMware-virtualized) and Private (single-tenant VMware or Hyper-V-virtualized) flavors. Managed services are optional.
Locations: Dimension Data has data centers on the East and West Coasts of the U.S., plus Canada, the U.K., Netherlands, Australia, Hong Kong, Japan, Brazil and South Africa. Local-language sales and support is provided in 51 countries, with cloud-specialized support provided from its regional service centers. The portal is available only in English. Documentation is available in English and Japanese.
Recommended mode: Dimension Data appeals primarily to Mode 1 buyers, including conservative SaaS vendors. It may meet Mode 2 requirements that are limited to basic cloud IaaS.
Recommended uses: E-business hosting, cloud-native applications and general business applications for customers that have very diverse geographic needs, or need a private cloud.
Fujitsu is a large diversified technology company.
Offerings: Fujitsu Cloud IaaS Trusted Public S5 is Xen-virtualized and comes in two flavors — a fully multitenant service, and a Dedicated service with single-tenant compute and a multitenant back-end. Fujitsu also has regional offerings that use different technology platforms, and carry the Fujitsu Cloud IaaS Private Hosted brand in conjunction with a region name or the "Global" designation. Managed services are optional.
Locations: S5 is available in data centers in the U.S. (West Coast), Germany, the U.K., Australia, Japan and Singapore. Fujitsu has global sales, and provides support in 34 languages; the S5 portal and documentation are available in English, German and Japanese. The regional offerings have their own capabilities and locations, which are different from those of S5.
Recommended mode: Fujitsu appeals primarily to Mode 1 customers.
Recommended uses: General business applications for customers who need managed services in conjunction with cloud IaaS. Development environments for customers who only need basic cloud IaaS.
Google is an Internet-centric provider of technology and services.
Offerings: Google Cloud Platform combines an IaaS offering (Compute Engine), an aPaaS offering (App Engine) and a range of complementary services, including object storage and a Docker container service (Container Engine). Compute Engine VMs are KVM-virtualized and metered by the minute. Enterprise-grade support is extra. It has a multi-fault-domain SLA. Colocation needs are met via Google Cloud Interconnect. See the In-Depth Assessment for a detailed technical evaluation.
Locations: Google groups its IaaS data centers into "regions," each of which contains at least two availability zones. There is a central U.S. region, a European region (located in Belgium), and an Asian region (located in Taiwan). Google has a global sales presence. Support is available in English and Japanese. The portal is available in English, French, German, Spanish, Portuguese, Korean, Japanese and Mandarin. Documentation is available only in English.
Recommended mode: Google appeals to Mode 2 buyers.
Recommended uses: Cloud-native applications and batch computing, as well as projects leveraging Google Cloud Platform as a whole.
IBM is a large diversified technology company with a range of cloud-related products and services. In July 2013, it acquired SoftLayer, an independent Web hoster with a focus on small and midsize businesses (SMBs), and in January 2014, it shut down its own SmartCloud Enterprise cloud IaaS offering, after migrating its existing customers to SoftLayer.
Offerings: SoftLayer, an IBM company, offers both multitenant and single-tenant Citrix-Xen-virtualized compute (Virtual Servers). It also offers, as part of its cloud, paid-by-the-hour nonvirtualized dedicated servers (Bare Metal Servers). It has OpenStack-based object storage with an integrated CDN (via a partnership with EdgeCast). SoftLayer's primary business is noncloud offerings, such as paid-by-the-month dedicated servers (a broader range of configurations than is available per hour) and hosted appliances, but it does not make a clear distinction between these offerings and its cloud IaaS capabilities. Managed services are available through IBM. There is no support for colocation. IBM's aPaaS (BlueMix) is hosted in SoftLayer data centers but the offerings are not integrated. See the In-Depth Assessment for a detailed technical evaluation.
Locations: SoftLayer has multiple data centers in the U.S., along with data centers in Canada, Mexico, France, Germany, the U.K., Netherlands, Australia, Hong Kong, Japan and Singapore. It has a global sales presence. It offers support in English, Dutch, French, German, Italian, Spanish and Japanese. The portal and documentation are available in English only.
Recommended mode: Before the IBM acquisition, SoftLayer typically sold to Mode 2 customers (specifically startups and gaming companies with a strong interest in bare-metal dedicated hosting). Since the acquisition, IBM has increasingly focused on acquiring Mode 1 customers, but SoftLayer better meets the needs of Mode 2 customers (as long as they only require basic cloud IaaS and specifically want bare metal).
Recommended uses: E-business hosting, general business applications and batch computing, in circumstances that require both API control over scalable infrastructure and bare-metal servers in order to meet requirements for performance, regulatory compliance or software licensing. Alternatively, IBM outsourcing deals that use SoftLayer bare-metal servers as the hosting platform, where the customer has a need for supplemental basic cloud IaaS.
Interoute is a U.K.-based Pan-European communications service provider.
Offerings: Interoute Virtual Data Centre (VDC) is a CloudStack-based offering that can be delivered in the customer's choice of tenancy models and of VMware, Citrix Xen or KVM virtualization. A wide variety of payment models are supported. Interoute's CloudStore provides a marketplace for third-party software and solutions. Managed services are optional.
Locations: Interoute VDC is located in data centers on the East and West Coasts of the U.S., plus the U.K., France, Germany, Italy, Netherlands, Spain, Switzerland, and Hong Kong. It has global sales. Centralized support is available in English, Dutch, French, German, Italian, and Spanish, and Interoute's local technical support can cover most languages spoken in Western and Central Europe. The portal is available in English and Spanish. Documentation is available only in English.
Recommended mode: Interoute is likely to appeal primarily to Mode 1 customers, but may be a good fit for the needs of Mode 2 customers who value Interoute's unique intersection of networking and cloud IaaS capabilities.
Recommended uses: E-business hosting, general business applications, and development environments for customers who need a broad Pan-European geographic footprint or for whom tight integration with the WAN is important.
Joyent is a small, independent service provider that focuses solely on cloud services and software.
Offerings: Joyent Compute Service is a fully multitenant cloud IaaS offering, although Joyent can also offer it as a hosted private cloud. Joyent's architecture is container-native; compute resources run in Triton Zones (Joyent's SmartOS virtualization technology, similar to Solaris Zones). Customers can run Linux guests in Triton Zones (on bare metal), or Windows guests on KVM-based VMs. There is a Docker container service (Triton). Joyent offers a free open-source version of its software as SmartDataCenter, and sells a commercial version as Triton Elastic Container Infrastructure; Joyent can also offer this as a Joyent-operated service on the customer's premises. Joyent's object storage service (Manta) has a unique architecture designed for batch jobs that require high-performance access to large amounts of storage, with an in-place batch compute service separate from Joyent's main compute service. Enterprise-grade support is extra.
Locations: Joyent has data centers in the eastern and western U.S., along with a data center in the Netherlands. It has local sales presence in the U.S. and U.K. Support, the portal and documentation are in English only.
Recommended mode: Joyent will appeal primarily to Mode 2 organizations, but may appeal to Mode 1 organizations that are seeking a secure hybrid solution for Docker containers.
Recommended uses: Cloud-native or microservice architecture applications deployed into OS containers; cloud-native applications and e-commerce sites where visibility into application performance is crucial; batch computing on large datasets.
Microsoft is a large and diversified technology vendor that is increasingly focused on delivering its software capabilities via cloud services. Its Azure business was previously strictly PaaS, but Microsoft launched Azure Infrastructure Services (which include Azure Virtual Machines and Azure Virtual Network) into general availability in April 2013, thus entering the cloud IaaS market.
Offerings: Microsoft Azure offers Hyper-V-virtualized multitenant compute (Virtual Machines), with multitenant storage, along with many additional IaaS and PaaS capabilities, including object storage (Blob Storage) and a CDN. The Azure Marketplace offers third-party software and services. Enterprise-grade support is extra. It has a multi-fault-domain SLA. Colocation needs are met via Azure ExpressRoute. See the In-Depth Assessment for a detailed technical evaluation.
Locations: Microsoft calls Azure data center locations "regions." There are multiple Azure regions in the U.S., as well as regions in Ireland, the Netherlands, Australia, Hong Kong, Japan, Singapore and Brazil. There are also two regions for the U.S. federal government. (Azure China is a separate service operated by 21Vianet.) Microsoft has global sales. Azure support is provided in English, French, German, Italian, Spanish, Japanese, Korean, Mandarin and Portuguese. The portal and documentation are available in those languages, as well as Russian.
Recommended mode: Microsoft Azure appeals to both Mode 1 and Mode 2 customers, but for different reasons; Mode 1 customers tend to value the ability to use Azure to extend their infrastructure-oriented Microsoft relationship and investment in Microsoft technologies, while Mode 2 customers tend to value Azure's ability to integrate with Microsoft's application development tools and technologies.
Recommended uses: General business applications and development environments for Microsoft-centric organizations; cloud-native applications; batch computing.
NTT Communications (hereafter "NTT Com"), an NTT Group company, is a Japan-based global communications service provider.
Offerings: NTT Com has two cloud IaaS offerings. Cloudn is a fully multitenant, CloudStack-based, KVM-virtualized offering. Cloudn has an associated object storage offering, CDN, MySQL-based database as a service, and Cloud Foundry-based aPaaS. Enterprise Cloud is a VMware-virtualized, vCloud API-enabled offering with an SRP pricing model, and it can be either fully multitenant or single-tenant; almost all customers use managed services, but they are optional.
Locations: Cloudn is available in multiple data centers in Japan, as well as a U.S. East Coast data center. NTT Enterprise Cloud is available in data centers on the East and West Coasts of the U.S., plus the U.K., Germany, Australia, Hong Kong, Japan, Malaysia, Singapore and Thailand. NTT Com has a global sales presence. Cloudn support is available in English and Japanese. NTT Enterprise Cloud support is available in English, French, German, Spanish, Cantonese, Hindi, Japanese, Mandarin, Malay and Thai. The portal and documentation for both offerings are available in English and Japanese.
Recommended mode: Cloudn will appeal primarily to Mode 2 customers. NTT Enterprise Cloud will appeal primarily to Mode 1 customers.
Recommended uses for Cloudn: Development environments and cloud-native applications where Japan-based hosting is desirable.
Recommended uses for NTT Enterprise Cloud: Development environments and general business applications for customers who need a Pan-Asian footprint and want a VMware-virtualized environment in conjunction with managed services.
Rackspace is an independent Web hoster with a long track record of leadership in the managed hosting market. It has numerous related businesses; some, such as SaaS email, are part of Rackspace itself, while others, such as Jungle Disk, are subsidiaries.
Offerings: Rackspace Public Cloud is a fully multitenant, OpenStack-based, Citrix Xen-virtualized offering; the offering also has OpenStack Ironic-based bare-metal servers (OnMetal) that are provisioned in approximately 5 minutes, and paid for per minute. Rackspace also offers three flavors of hosted private cloud: vCloud Director-based and VMware-virtualized, Microsoft Cloud OS-based and Hyper-V virtualized, and OpenStack-based and KVM-virtualized. It also offers a Rackspace-operated OpenStack private cloud on the customer's premises. Private clouds are priced on the basis of dedicated capacity. Rackspace has object storage with an integrated CDN (Cloud Files). Customers must choose either a paid support plan or managed services.
Locations: Rackspace Public Cloud and the hosted private cloud services are offered in data centers in the central and eastern U.S., the U.K., Australia and Hong Kong. However, accounts are region-specific; Europe is a separate region from the rest of the world. Rackspace has sales presence in the countries where it has data centers, along with the Netherlands, Switzerland and Mexico. Support is provided in English only. The portal and documentation are available only in English.
Recommended mode: Rackspace appeals to both Mode 1 and Mode 2 customers who value highly responsive customer service.
Recommended uses for Rackspace Public Cloud: Cloud-native applications requiring a basic cloud IaaS offering that includes bare-metal servers; cloud IaaS as part of a hybrid hosting solution with DevOps-oriented managed services; hybrid hosting where cloud IaaS is supplementary to a primarily dedicated infrastructure; development environments where simplicity and ease of use are crucial.
Recommended uses for Rackspace Private Cloud: Private OpenStack environments for development or cloud-native applications; VMware or Hyper-V-based "rented virtualization" for general business applications or development environments; private "Azure-like" (Windows Azure Pack) environments for development; hybrid environments with Microsoft Azure.
Verizon is a U.S.-based global communications service provider. Verizon acquired Terremark, a managed hosting and cloud IaaS provider, in 2011. During 2014, Verizon phased out the Terremark brand.
Offerings: During 2014, Verizon consolidated most of its cloud IaaS offerings under the "Verizon Cloud" umbrella brand and portal. The "Verizon Cloud" brand was previously used for a new cloud IaaS offering that Verizon introduced into beta in October 2013. This offering is now in general availability, with three deployment models: Virtual Private Cloud (VPC) Reserved Performance (fully multitenant), Public Cloud (fully multitenant, with a simplified subset of features) and Private Cloud (single-tenant). It is based on AMD SeaMicro servers, is fully multitenant and can be either Xen-virtualized or VMware-virtualized; it also encompasses Verizon's object storage offering. Verizon's other offerings are fully multitenant and VMware-virtualized. The former Terremark Enterprise Cloud (eCloud) is now offered as Verizon Cloud's VPC Elastic Resource, although it remains a distinct deployment model with its own distinctive environment, capabilities, UI and API; it uses an SRP pricing model. The Federal Edition of eCloud remains a separate offering outside Verizon Cloud. The vCloud Express offering and Verizon's Enterprise Cloud Managed Edition (ECME) are being retired. Optional managed services are available for all offerings other than Public Cloud and eCloud Federal Edition. Enterprise-grade support is extra.
Locations: Verizon Cloud is available in multiple U.S. data centers, plus the U.K., Netherlands, Hong Kong and Brazil, but not all offerings are available in all locations. Verizon has a global sales presence. Support for all of Verizon Cloud is provided in English, Spanish and Portuguese; other offerings are supported only in English. The portal and documentation for all offerings are only in English.
Recommended mode: Verizon primarily appeals to Mode 1 customers.
Recommended uses: Development environments and general business applications.
Virtustream is a small, independent service provider focused solely on cloud services and software.
Offerings: Virtustream's service, xStream, is hypervisor-neutral but typically supports VMware and KVM. It is offered in both single-tenant and multitenant variants; furthermore, it can support single-tenant compute with a multitenant back-end, as well as bare metal. VMs are available by the hour, bare metal is available by the month, and both paid-by-the-VM and SRP models are available. The offering embeds a tool for governance, risk management and compliance (GRC), including capabilities from Virtustream's 2014 acquisition of ViewTrust Technology. There are variants of xStream targeted specifically at customers who need PCI compliance, and U.S. federal government customers. Managed services are optional. Virtustream also offers xStream as software, and has licensed some of its technology to other service providers, such as IBM.
Locations: Virtustream has multiple data centers in the eastern and western U.S., and in the U.K. and Netherlands. It has sales presence in the U.S., along with London, Walldorf (the German home of SAP), and Dubai sales offices. The service is provided in English only.
Recommended mode: Virtustream's focus on complex traditional enterprise applications means that it appeals primarily to Mode 1 customers, especially those seeking improved agility.
Recommended uses: Complex workloads, particularly those related to ERP or other enterprise software suites, including applications that may not have been designed to run in virtualized environments.
VMware has historically been a software vendor focused on virtualization technologies. It entered the cloud IaaS market when it launched the VMware vCloud Hybrid Service (vCHS), now renamed vCloud Air, into general availability in September 2013. It is a subsidiary of EMC.
Offerings: vCloud Air is a VMware-virtualized, vCloud-API-enabled offering that comes in three variants: On-Demand (fully multitenant), Virtual Private Cloud (fully multitenant and SRP-priced) and Dedicated Cloud (single-tenant compute with multitenant back-end, and SRP-priced with customer-controlled oversubscription). There is also a disaster recovery service. All vCloud Air services share a common portal and are delivered as resource pools out of the same shared hardware.
Locations: vCloud Air is available in multiple data centers in the U.S., as well as in the U.K., Germany, Australia and Japan. VMware has a global sales presence. Support is available in English, French, German, Portuguese, Spanish, Hindi, Japanese and Mandarin. The portal is available in English only; documentation is available in English and Japanese.
Recommended mode: vCloud Air primarily appeals to Mode 1 customers with existing investments in VMware technology.
Recommended uses: Development environments, general business applications, supplementing existing VMware-virtualized environments, Pivotal Cloud Foundry hosting, and disaster recovery for customers seeking a VMware-based solution.
We review and adjust our inclusion criteria for Magic Quadrants and MarketScopes as markets change. As a result of these adjustments, the mix of vendors in any Magic Quadrant or MarketScope may change over time. A vendor's appearance in a Magic Quadrant or MarketScope one year and not the next does not necessarily indicate that we have changed our opinion of that vendor. It may be a reflection of a change in the market and, therefore, changed evaluation criteria, or of a change of focus by that vendor.
To be included in this 2015 Magic Quadrant, vendors had to demonstrate the following, as of January 2015:
This Magic Quadrant is global in scope, but most of the providers are based in the U.S. This is a reflection of the way the market is evolving. The market has matured more quickly in the U.S. and the bulk of revenue comes from U.S.-based customers and flows to U.S.-based companies — U.S.-based IaaS providers typically derive 20% or more of their revenue from customers outside the U.S. However, all the providers in this Magic Quadrant offer their services on a global basis, and most have at least one data center in North America, Western Europe and Asia/Pacific.
Significant Europe-based providers not in this Magic Quadrant include arsys, CloudSigma, Colt, Gigas, Orange Business Services, OVH and Skyscape. Providers with significant presence in the Asia/Pacific region that are not in this Magic Quadrant include Datapipe and Tata Communications.
In the evaluations for this Magic Quadrant, we considered a variety of interesting cloud IaaS providers that did not meet the criteria for inclusion. The more distinctive ones, by use case, include:
There are also many cloud IaaS providers that specialize in serving small businesses that typically use just one or two VMs; examples are DigitalOcean, ElasticHosts and Linode. These low-cost providers are often used as an alternative to mass-market virtual private server (VPS) hosting. Gartner clients typically have needs beyond what such "cloud VPS" providers can fulfill.
Even though some businesses may use PaaS in a very IaaS-like manner, we have excluded PaaS providers from this Magic Quadrant, with the exception of those PaaS providers that also have a qualifying IaaS offering. PaaS offerings do not allow customers to obtain raw VMs that can be loaded with arbitrary operating systems, middleware and applications, which is a requirement for being considered as IaaS. For PaaS providers, see "Magic Quadrant for Enterprise Application Platform as a Service" and "Magic Quadrant for Enterprise Integration Platform as a Service, Worldwide."
Gartner analysts evaluate technology vendors on the quality and efficacy of the processes, systems, methods or procedures that enable IT providers' performance to be competitive, efficient and effective, and to positively affect revenue, retention and reputation. Ultimately, technology providers are judged on their ability to capitalize on their vision, and on their success in doing so.
We evaluated vendors' Ability to Execute in this market by using the following criteria:
Our evaluation of a service provider's Ability to Execute remains similar to that of the 2014 Magic Quadrant. We have continued to raise our expectations of a provider's feature set, and we have further increased the weighting of Overall Viability, reflecting our belief that even though some providers can accomplish great things with relatively few resources, long-term success in this market will require substantial investment, as well as the ability to attract an ecosystem.
Source: Gartner (May 2015)
Gartner analysts evaluate technology vendors on their ability to articulate logical statements convincingly about current and future market direction, innovation, customer needs and competitive forces, as well as how they map to Gartner's position. Ultimately, technology providers are assessed on their understanding of the ways in which market forces can be exploited to create opportunities.
We assessed vendors' Completeness of Vision in this market by using the following criteria:
Our evaluation of Completeness of Vision remains similar to that of the 2014 Magic Quadrant. However, we have continued to increase our expectations for the breadth and depth of a provider's vision. We believe that a comprehensive vision must encompass the ambition to run any workload, at anytime, anywhere in the world, with the appropriate availability, performance, security and isolation — including the ability to self-service all the necessary compute, storage, network and management capabilities — in cooperation with an ecosystem of supporting partners.
Source: Gartner (May 2015)
Leaders distinguish themselves by offering a service suitable for strategic adoption and having an ambitious roadmap. They can serve a broad range of use cases, although they do not excel in all areas, may not necessarily be the best providers for a specific need, and may not serve some use cases at all. They have a track record of successful delivery, significant market share and many referenceable customers.
Challengers are well-positioned to serve some current market needs. They deliver a good service that is targeted at a particular set of use cases, and they have a track record of successful delivery. However, they are not adapting to market challenges sufficiently quickly, or do not have a broad scope of ambition.
Visionaries have an ambitious vision of the future, and are making significant investments in the development of unique technologies. Visionaries may be new market entrants, or they may be existing providers who are reinventing their business. Their services are still emerging, and they have many capabilities in development that are not yet generally available. While they may have many customers, they might not yet serve a broad range of use cases well.
Niche Players may be excellent providers for the use cases in which they specialize, but may not serve a broad range of use cases well, or have a broadly ambitious roadmap. They may be relatively new entrants to this market, or may not yet have gained significant market share. Some may have solid leadership positions in markets adjacent to this market, but are still in the relatively early stages of developing capabilities in cloud IaaS. Providers that specialize in managed services on top of a "good enough" IaaS platform may be in this category. The more highly targeted your needs, the more likely it is that there will be a Niche Player ideal for your needs.
When people think about "cloud computing," cloud IaaS is often one of the first things that comes to mind. It's the "computing" in cloud computing — on-demand compute, storage and network resources, delivered on-demand, in near real time, as a service. There has been tremendous hype about these services, but there are also a number of use cases for which cloud IaaS delivers excellent business value. Although the market is immature, it is evolving rapidly; it has begun its journey up the Slope of Enlightenment on Gartner's "Hype Cycle for Cloud Computing, 2014." Unfortunately, many customers do not clearly understand their requirements, and many providers are in a state of turmoil and articulate their offerings poorly. Therefore, care should be taken when sourcing these services.
In 2014, the absolute growth of public cloud IaaS workloads surpassed the growth of on-premises workloads (of any type) for the first time. Market share has continued to grow more heavily concentrated, even while the market has dramatically expanded. 2014 has been a year of reckoning for many cloud IaaS providers, and many cloud IaaS providers believe that their current strategy is failing them. Some of these providers intend to launch an entirely new cloud IaaS platform, or are in the process of making substantial changes to their current platform. Others are considering or in the process of executing a pivot to providing managed services on leading cloud IaaS providers. Many providers have indicated that they intend to discontinue or significantly reduce their investment in their cloud IaaS offerings, and others intend to eliminate or replace their current offerings. We urge buyers to be extremely cautious when selecting providers; ask specific and detailed questions about the provider's roadmap for the service, and seek contractual commitments that do not permit the provider to modify substantially or to discontinue the offering without at least 12 months' notice.
Cloud IaaS is now used for virtually all use cases that can be reasonably hosted on virtualized x86-based servers. The most common use cases for cloud IaaS are development and testing environments; HPC and batch processing; Internet-facing websites and Web-based applications (which may or may not have architectures specifically designed for the cloud); and non-mission-critical internal business applications. An increasing number of organizations now run mission-critical business applications on cloud IaaS (Gartner's cloud computing survey indicates 28% in 2014), and a significant number of organizations are in the midst of migrating most or all of their infrastructure to cloud IaaS. Migrations are most frequently done to avoid major capital expenditure, such as a hardware refresh or the construction of a data center.
Initially, most businesses adopt cloud IaaS for Mode 2, agile IT projects; such projects may be peripheral to the organization's IT needs, but may have a high business impact. Over time, as a business becomes more comfortable with the use of cloud IaaS, it will be used in Mode 1, traditional IT projects as well, usually mirroring the past decade's adoption pattern of virtualization in the data center. Many businesses, especially in the midmarket, will eventually migrate away from running their own data centers in favor of relying primarily on infrastructure in the cloud. Gartner's 2015 CIO survey indicates that 83% of CIOs consider cloud IaaS as an infrastructure option, and 10% are already cloud-first with cloud IaaS as their default infrastructure choice. (See "Flipping to Digital Leadership: The 2015 CIO Agenda.")
Although some organizations still source cloud IaaS in a tactical, per-project fashion, most organizations are now looking for long-term strategic partners. This 2015 Magic Quadrant focuses on evaluating providers through the lens of their suitability for strategic adoption. We believe that while the market is still relatively immature, customers may reasonably begin making strategic choices, based on their own speed of adoption. Customers who will not have the majority of their workloads on cloud IaaS until 2017 or later may choose strategic providers whose offerings are still substantively incomplete, if they are confident that those providers will have the necessary capabilities by the time they need them. We recommend that prospective customers with immediate needs focus on finding the cloud provider that matches their anticipated use cases for the next year. In some cases, businesses may have to use multiple cloud IaaS providers to meet the needs of diverse use cases.
Cloud IaaS provides on-demand, near-real-time, self-service access to abstracted, programmatically accessible and highly automated infrastructure resources (at minimum, compute resources, along with associated storage and network resources), on-demand and in near real time. In IaaS, the provider manages the data center facilities, hardware and virtualization, but everything above the hypervisor layer — the operating system, middleware and application — is managed by the customer, or is an add-on managed service from the provider or another third party. This market is wholly separate and distinct from cloud PaaS and SaaS.
Cloud IaaS is owned, built and operated by a service provider, but it may be delivered on-premises within a customer's data center or hosted in the provider's data center. It may be "public" (multitenant) or "private" (single-tenant), although, in practice, there is no consistency in the application of these labels to varying degrees of resource isolation, and most hosted offerings use some degree of shared resources in services labeled "private."
Cloud IaaS is not a commoditized service, and even providers with very similar offerings and underlying technologies often have sufficiently different implementations that there is a material difference in availability, performance, security and service features.
There are four broad categories of customer need in cloud IaaS:
Digital business needs account for the majority of workloads in cloud IaaS. Digital business, however, is not limited to technology companies. Almost every business is being impacted by digital disruption and an increasing number of businesses have "internal startups" or digital business units. (See "CEOs and CIOs Must Assume That Every Industry Will Be Digitally Remastered.") Digital business use cases are very broad, and include digital marketing, e-commerce, e-CRM, SaaS and data services. These are generally production applications, although cloud IaaS is typically used for the whole application life cycle. Many of these customers have mission-critical needs.
In addition to digital business projects, many organizations have a wide variety of IT projects that they are executing in an agile fashion. Rapid application development, prototyping, experiments and other IT projects that require agility, flexibility and the ability to meet urgent infrastructure needs are frequently executed on cloud IaaS. Although most such Mode 2, agile IT projects are not core to the organization's overall IT portfolio, they may have high visibility and high business impact.
In many organizations, cloud IaaS is gradually replacing or supplementing traditional data center infrastructure. It is typically used very similarly to the organization's internal virtualization environment. Organizations typically begin with development environments or less-mission-critical production applications, but gradually expand to also host mission-critical applications on cloud IaaS. Mode 1, traditional IT organizations typically look to cloud IaaS to deliver cost reductions, but may also be interested in long-term IT transformation.
The least common need, but one that nevertheless generates significant revenue for the small number of providers that serve this portion of the market, is batch computing. For these customers, IaaS serves as a substitute for traditional HPC or grid computing. Customer needs include rendering, video encoding, genetic sequencing, modeling and simulation, numerical analysis and data analytics. These customers need to access large amounts of commodity compute at the lowest possible price, with little concern for infrastructure reliability. Some HPC use cases benefit from specialized hardware such as graphics processing units (GPUs) and high-speed interconnects.
Cloud IaaS can now be used to run most workloads, although not every provider can run every type of workload well. Service providers are moving toward infrastructure platforms that can offer physical (nonvirtualized) and virtual resources, priced according to the level of availability, performance, security and isolation that the customer selects. This allows customers to run "cloud native" applications that have been architected with cloud transaction processing principles in mind (see "From OLTP to Cloud TP: The Third Era of Transaction Processing Aims to the Cloud"; Note: This document has been archived; some of its content may not reflect current conditions), as well as to migrate existing business applications from their own virtualized servers in internal data centers into the cloud, without changes. Cloud IaaS is best used to enable new IT capabilities, but it has become a reasonable alternative to an internal data center.
Cloud IaaS is not a commodity. Providers vary significantly in their features, performance, cost and business terms. Although in theory, cloud IaaS has very little lock-in — a VM is just a VM, in the end — in truth, cloud IaaS is not merely a matter of hardware rental, but an entire data center ecosystem as a service. This encompasses the entirety of the ITOM stack, including traditional IT service management capabilities, DevOps-oriented capabilities, and new forms of automation, analytics and insight, including "smart" infrastructure capabilities that take advantage of the unique perspective offered by the delivery of integrated compute, storage and networking resources. The more you use those capabilities, the more value you will receive from the offering, but the more you will be tied to that particular service offering. The dynamics of this market resemble a software market, not a traditional IT services market. Providers are in a race to deliver features, and the "winners" are likely to be those that are highly innovative and that have the most resources to invest in the breadth and depth of capabilities development.
IaaS and PaaS capabilities are overlapping. Cloud IaaS providers are increasingly offering middleware capabilities as a service, and are likely to add capabilities such as the provisioning and orchestration of application containers (particularly Docker containers). Many leading providers will offer both IaaS and PaaS, and in many cases will blend IaaS and PaaS capabilities into cloud integrated infrastructure services (CIIS). The spectrum of services allows customers to decide on a trade-off between control and convenience. Customers want to develop, deploy and manage applications efficiently, and will choose the combination of capabilities that best suits their needs. To make it easy for applications to span the spectrum of capabilities, a provider's CIIS needs a single self-service portal and catalog, common identity and access management, an integrated low-latency network context, and an integrated security context.
Providers' size and scale matter. While scale does impact operational efficiency to some degree, more importantly, it impacts engineering efficiency — the ability to leverage an investment in developers as well as partner capabilities across as large a customer base as possible. Software requires a large upfront investment, but each incremental customer adds comparatively little cost, and software markets tend to become "winner takes all" arenas, where a small number of vendors command dominant market shares. Scale also matters because the ability to deliver a broad range of integrated capabilities will become increasingly crucial. A provider's size, its existing customer relationships, and the strength of its brand have an enormous impact on its ability to gain market share and traction, especially on a global basis. Furthermore, the solution ecosystem is rapidly consolidating around a small number of market leaders.
The market is in a state of upheaval. The sky is not falling — customers are getting great value out of cloud IaaS — but the earth is moving as the competitive landscape shifts. Few providers have the financial resources to invest in being broadly competitive in the cloud IaaS market. While there is room in the market for highly specialized providers, most providers are trying to compete for a broad range of use cases. Many providers are struggling to grow their businesses, despite rapid overall market growth. Some less successful providers may try to build new platforms, become specialists in particular niches, acquire another provider in order to use their platform instead, pivot to become third-party managed service providers on other clouds, or exit the market entirely. This may be very disruptive for customers who choose such providers. However, customers who have chosen market leaders should be well-insulated from these troubling market conditions.
Bimodal IT impacts cloud IaaS sourcing decisions. Mode 2, agile IT organizations typically value cloud IaaS providers that invest deeply in engineering in order to provide a rich suite of features and extensive automation for self-service enablement. Mode 2 adoption is often business-led — driven by business managers who hold the budget, need greater agility and have shorter time frames than IT operations are able to accommodate, and who therefore turn to application developers and enterprise architects for a solution. IT operations organizations typically have a Mode 1 mindset and may initially look for providers that provide a basic set of IaaS features within a familiar environment that is similar to their existing virtualized infrastructure, but they are likely to rethink this approach if their ultimate goal is IT transformation. Cloud IaaS providers vary in their ability to target these different buying centers. Furthermore, most providers focus on either a Mode 1 or Mode 2 audience, and their feature set and style of service are oriented accordingly, although leading providers offer capabilities attractive to both audiences.
Automation will increasingly transform operations in the cloud. To deliver greater value to customers, cloud IaaS providers must improve the quality and efficiency with which customers can manage their infrastructure. They must find ways to reduce the burden of operational chores such as patch management and backups. While manual managed services are frequently used to substitute for automated offerings, efficiency demands automation instead of operators, and successful IaaS providers will push "up the stack" to deliver highly automated solutions.
Customers are separating cloud IaaS platform decisions from managed services decisions. Some customers want to use an industrialized cloud IaaS offering, but would like to outsource the management of that infrastructure. These customers increasingly choose to adopt a best-in-class IaaS offering, and then seek a MSP to manage it, rather than adopt a "managed cloud" offering from a MSP that can offer only basic IaaS capabilities on its own platform. Customers may also extend existing outsourcing relationships to include management of a third-party cloud IaaS offering. While some Mode 1, traditional IT customers consider it acceptable for an MSP's platform to offer only a basic set of IaaS features, it is generally unacceptable to Mode 2, agile IT customers. Furthermore, such deficiencies have a long-term impact on the quality and cost of the customer's IT operations, which may be strategically unacceptable to Mode 1 customers. Some MSPs specialize in cloud-native operations, usually with significant use of DevOps, and can help customers through the transformation process, which may be attractive to both Mode 1 and 2 customers, as well as digital businesses.
Public and private cloud IaaS are converging. Service providers are increasingly using dynamic physical and logical isolation mechanisms to create "private" infrastructure within a shared, multitenant capacity pool. This allows for economies of scale, while enabling customers to meet a broader range of security and compliance requirements. For details of this convergence and how to choose the level of isolation you need, see "Best Practice: Evaluate Isolation Mechanisms in Public and Private Cloud IaaS" (Note: This document has been archived; some of its content may not reflect current conditions). We believe that, over time, the leading providers will offer a single, highly flexible platform across both their own data centers and customers' data centers. As a result, this Magic Quadrant covers not only public cloud IaaS, but industrialized private cloud IaaS as well.
Most organizations are multicloud at the point of provisioning. While many customers use multiple cloud IaaS providers, each individual project (or component of a composite application) is typically hosted on a single provider. While it is relatively straightforward to move VM images from one cloud to another, truly hybrid multicloud scenarios are rare. The tools to enable true "single pane of glass" management and seamless movement across infrastructure platforms are not mature, and there are significant differences in cloud IaaS implementations, even between providers using the same underlying CMP. Note that the claim that an ecosystem is "open" has nothing to do with actual portability. Due to the high degree of differentiation between providers, the organizations that use cloud IaaS most effectively will embrace cloud-native management, rather than allow the legacy enterprise environment to dictate their choices.
The software-defined data center is the center of a partner ecosystem. Programmatic (API) access to infrastructure is crucial, as it enables customers, as well as third parties, to build management tools for their platforms, and to enable applications to take maximum advantage of the infrastructure environment. Providers need to foster rich ecosystems of capabilities. While the leading providers are likely to build a substantial number of capabilities themselves, partners will extend the range of their capabilities, provide overlays for complex heterogeneous multivendor environments, and add "stickiness" to these platforms by offering tight integrations between applications, middleware and infrastructure.
Local sourcing matters to some customers. Customers normally prefer to keep data in-region for reasons of network latency. However, regulatory concerns that require keeping data in-country, as well as revelations about foreign intelligence agencies obtaining access to private data, have heightened the desire of non-U.S.-based customers to purchase cloud IaaS from local providers. (See "The Snowden Effect: Data Location Matters.") Unfortunately, local providers typically lack the scale and capabilities of the global providers, and may focus primarily on small businesses, not enterprises. Furthermore, keeping data local is no guarantee of freedom from either domestic or foreign surveillance. It is nevertheless possible that the cloud IaaS markets in Europe and Asia will become highly fragmented, which may result in only basic, commodity capabilities being available to customers that cannot use a foreign provider (even when that provider has local presence).
Public cloud IaaS provides adequate security for most workloads. Although many security controls are the responsibility of the customer, not the provider, most major cloud IaaS providers offer a high degree of security on the underlying platform. Transparent encryption of LAN, WAN and storage will become increasingly commonplace as a bundled element of cloud IaaS offerings, as providers react to defend themselves against intrusion from government entities.
Customers do not always save money by using cloud IaaS. Although many customers first investigate using IaaS to achieve cost savings, most customers buy IaaS to achieve greater business agility or to access infrastructure capabilities that they do not have within their own data center. IaaS can drive significant cost savings when customers have short-term, seasonal, disaster recovery or batch-computing needs. It can also be a boon to companies with limited access to capital and to small companies, especially startups, that cannot afford to invest in infrastructure (see "Cloud Computing Can Be the Singular Solution for at Least Five Use Cases"; Note: This document has been archived; some of its content may not reflect current conditions). For larger businesses with existing internal data centers, well-managed virtualized infrastructure, efficient IT operations teams and a high degree of automation, IaaS for steady-state workloads is often no less expensive, and may be more expensive, than an internal private cloud. The less efficient your organization, the more likely you are to save money by using a cloud provider, especially if you take advantage of this opportunity to streamline and automate your operations. The largest-scale providers are continually lowering their prices, and automated managed services will substantially drive down the cost of infrastructure management over time, so cost advantages will continue to accrue to the providers.
Analyst(s): Lydia Leong
Some cloud IaaS providers offer solutions specifically designed for U.S. federal government customers.
A cloud infrastructure as a service (IaaS) solution designed for U.S. federal government customers ("federal IaaS") is expected to be Federal Risk and Authorization Management Program (FedRAMP)-compliant. U.S. federal government entities are supposed to use FedRAMP-compliant solutions, but in practice, they do not always do so.
Because the FedRAMP certification process is lengthy, providers may be in the process of certification. Cloud IaaS providers exist in all three forms of FedRAMP compliance — Joint Accreditation Board Provisional Authority to Operate (JAB P-ATO), agency ATO, and security assessment package ("CSP Supplied Package") assessed by a FedRAMP-accredited Third Party Assessment Organization (3PAO) — and all forms of compliance are considered valid for federal IaaS. Some other providers may not want to undertake the effort and expense of an ATO, but may have solutions that meet the FedRAMP requirements; note, however, that these solutions are not considered FedRAMP-compliant. Because FedRAMP is the expected standard in this market, but acquiring an ATO is a difficult, expensive and lengthy process, the number of federal IaaS providers is limited.
Note that some cloud IaaS providers have a very broad solution, which may include platform as a service (PaaS) capabilities. A 3PAO may not have assessed everything in their portfolios, but providers will normally be specific about which parts of their solution have been reviewed by a 3PAO.
Federal IaaS solutions normally adhere to International Traffic in Arms Regulations (ITAR) restrictions. Some providers are also Federal Information Security Management Act (FISMA) Moderate accredited. Some have also received authorization under the Department of Defense (DoD) Cloud Security Model (CSM). Federal IaaS is often, but not always, delivered from data centers that are specifically for government customers. When such solutions are hosted in the same data centers as are used for commercial customers, the federal IaaS solutions are usually physically and logically segregated from the commercial solutions. These federal solutions are normally operated by U.S.-based personnel.
Use of federal IaaS solutions is normally restricted to U.S. federal government customers, but in most cases, contractors and other third parties performing work on behalf of government agencies can also use them. Notably, SaaS providers with government customers are often allowed to use these solutions.
State and local government entities are usually not permitted to use federal IaaS solutions, although this varies by provider — it is the provider that decides which customers are permitted in the community cloud. Such entities may need to find commercial cloud IaaS solutions instead. In most cases, customers use Criminal Justice Information Services Division (CJIS) compliance as a proxy for determining whether a cloud IaaS offering can adequately meet government security requirements.
Government organizations contemplating the use of cloud IaaS should pay careful attention to bimodal IT requirements. Government IT personnel frequently have a cautious mindset and a tendency to operate only Mode 1 reliable IT, but they increasingly face agile demands that are better served with Mode 2 IT. Government IT organizations often attempt to source cloud IaaS in a Mode 1 fashion, even if the primary need is agility; such an approach is unlikely to fully satisfy users. Conversely, government IT organizations that are trying to drive Mode 1-oriented cost reductions need to source differently than those whose primary need is agility and transformation. When selecting an offering, it is vital to keep bimodal requirements in mind.
Government customers should be careful to distinguish between cloud IaaS and more traditional forms of outsourcing. Many so-called "cloud" solutions that are marketed to government entities are simply "cloudwashed" outsourcing; they often come with long-term contracts, with relatively inflexible capacity constraints, and lack the automation and industrialization of true cloud IaaS offerings (for more details, see "Don't Be Fooled By Offerings Falsely Masquerading as Cloud Infrastructure as a Service").
Some government customers find it difficult to contract directly with cloud IaaS providers, due to government acquisition rules. There are third-party cloud service brokerages — usually managed service providers (MSPs) and system integrators (SIs), such as Accenture, Datapipe, Smartronix and Unisys — that resell major cloud IaaS providers' solutions, and that typically add significant value as well; these are probably the best choice for government entities that need a brokered solution. There are other brokers that may add little or no value, but are willing to resell a major cloud IaaS provider's solution while offering much more attractive contract terms, usually with far higher liability caps. Government customers should beware of such resellers as they frequently lack the financial solvency to fulfill their obligations. Government customers may also want to buy through an 8(a) company in order to fulfill procurement obligations; again, they should be careful, as such resellers often mark up the price without adding value.
Vendors included in this Magic Quadrant Perspective have customers that are successfully using their products and services. Selections are based on analyst opinion and references that validate IT provider claims; however, this is not an exhaustive list or analysis of vendors in this market. Use this perspective as a resource for evaluations, but explore the market further to gauge the ability of each vendor to address your unique business problems and technical concerns. Consider this research as part of your due diligence and in conjunction with discussions with Gartner analysts and other resources.
AWS's GovCloud is an AWS region located in Oregon. It is a community cloud dedicated to the U.S. federal government, including contractors, third parties and SaaS providers providing services to federal customers. It has a FedRAMP agency ATO from the Department of Health and Human Services, as well as a DoD CSM Level 3-5 Provisional Authorization. It adheres to ITAR regulations. It can be used for workloads that must adhere to CJIS requirements. Most AWS services are available in GovCloud, though only the core services have been assessed by a 3PAO.
AWS has the largest market share in cloud IaaS for government customers. It serves federal customers both in GovCloud and its commercial regions. It also serves a significant customer base of state and local customers from its commercial regions. AWS has a rich ecosystem of partners, and many government customers adopt AWS through an MSP or SI.
VMware vCloud Government Service (vCGS) provided by Carpathia is a partnership between VMware and Carpathia to provide a government community cloud. There are two vCGS data centers, one in Northern Virginia and one in Arizona. vCGS has a FedRAMP JAB P-ATO, and can be used for workloads that must adhere to CJIS requirements. Note that this service uses the same architecture as VMware's own vCloud Air and must meet the same quality metrics, but it is still a distinct service operated by a VMware partner, not VMware itself. Carpathia has a long history as a managed hosting provider for government customers.
Microsoft Azure Government Cloud is a community cloud for U.S. federal, state and local government customers, as well as qualified partners serving those entities. There are two regions, one in Northern Virginia and one in Iowa. Completion of a FedRAMP JAB P-ATO is expected in May 2015. It can be used for workloads that must adhere to CJIS requirements. Many Azure services are available in the Azure Government Cloud, although the newer, higher-performing compute instance types are not yet available in these regions. The main Microsoft Azure service also has a FedRAMP JAB P-ATO, although only a subset of Azure services has been assessed by a 3PAO.
Microsoft has been aggressively pursuing government customers, especially state customers. There are many ways in which government customers can purchase Azure services, which eases what is sometimes a complex procurement process.
Verizon's Enterprise Cloud: Federal Edition is a community cloud for U.S. federal government customers. It is based on the Terremark Enterprise Cloud; it is not part of Verizon Cloud. It is deployed in Northern Virginia, and has an agency ATO from the Department of Health and Human Services.
Virtustream's Federal Managed Cloud Services (FMCS) is a community cloud for U.S. federal government customers. It is similar to Virtustream's Enterprise Cloud, with Northern Virginia and San Francisco-based isolated deployments of Virtustream's xStream platform. Virtustream expects to receive a FedRAMP JAB P-ATO in May 2015. FMCS can be used for workloads that must adhere to CJIS requirements. In addition, Virtustream's ViewTrust solution can be used for continuous monitoring and on-demand compliance reporting.