Cloud, mobile and smart technology: formula sheet

Key formulas

Service model control spectrum

IaaS (most control) → PaaS → SaaS (least control)

The further right, the more the provider manages and the less the customer manages.

What you manage under IaaS

Customer: operating system + applications + data. Provider: servers, storage, networking

Customer still handles patching, configuration and access to the operating system.

What you manage under PaaS

Customer: applications + data. Provider: everything beneath, including operating system

Good for building bespoke applications without server administration.

What you manage under SaaS

Customer: use of the software, user access and own data. Provider: everything else

Fastest to start, but least customisable.

Deployment models

Public (shared) | Private (single organisation) | Hybrid (public + private combined)

Choose by data sensitivity, control, cost and flexibility needs.

Benefit-risk evaluation

Net value of mobile = benefits (cost, speed, reach, engagement) − costs and risks (security, compliance, support, reputation)

A judgement framework, not a numerical formula. Always conclude on whether it is worthwhile for the scenario.

Risk assessment

Risk exposure = likelihood × impact

Use it to prioritise mobile risks such as device loss or data breach. Rank the risks, then match controls.

Mobile security control groups

Policy + technical controls + people controls + monitoring

Use this checklist for BYOD answers: policy and acceptable use; encryption, passwords, remote wipe, MDM; training; audit and review.

Suitability, Acceptability, Feasibility

Option is sound if it is Suitable AND Acceptable AND Feasible

Use this to evaluate any proposed technology adoption against the case facts.

Porter's generic routes to advantage

Cost leadership | Differentiation | Focus

Link each technology benefit to one of these routes to show how it creates advantage.

Value chain link

Primary activities + Support activities = Margin

Show which activity the technology improves, for example operations through sensors or marketing through mobile apps.

Cloud service models

IaaS (infrastructure) | PaaS (platform) | SaaS (software)

State which model fits the need and how much control the business keeps.

Simple payback logic

Payback period = Initial investment ÷ Annual net cash inflow (even inflows)

Use only when the case gives figures. Add non-financial factors, as benefits are often hard to quantify.

Quick revision

• IaaS gives you computing infrastructure such as servers and storage; you manage the operating system and applications.
• PaaS gives you a platform for building and running applications; the provider manages the underlying infrastructure.
• SaaS gives you ready-to-use software over the internet; the provider manages almost everything.
• Cloud benefits include scalability, lower upfront capital spend, flexibility and easier remote working.
• Cloud risks include data security, loss of control, supplier dependence, regulatory and data location issues, and outages.
• Moving to cloud shifts cost from capital to operating spend, so look at the whole cost over time.
• Mobile technology supports new channels, faster service and remote working, but adds device security and privacy risks.
• IoT connects devices that collect and share data, which can improve efficiency, monitoring and new services.
• IoT and mobile generate large amounts of data, so data protection, ethics and consent matter.
• Always judge technology against strategy: does it fit the organisation's goals, capabilities and risk appetite?
• Implementation needs a plan: business case, skills, change management, security, governance and review.
• In answers, apply to the scenario, give a balanced view and end with a clear recommendation.

Common mistakes

• Only giving definitions of IaaS, PaaS and SaaS. Fix: After each definition, add a sentence linking it to a named fact in the scenario.
• Mixing up service models and deployment models. Fix: Remember: service model is what you get (infrastructure, platform, software). Deployment model is who shares it and where it sits (public, private, hybrid).
• Listing generic advantages and disadvantages with no link to the scenario. Fix: Tie every point to a named fact in the case, such as the type of data, the countries involved or the growth plans.
• Treating the cloud as always cheaper. Fix: Say costs move from capital to operating spend. Mention that usage fees, data transfer charges and migration costs can raise total cost over time.
• Listing generic benefits and risks with no link to the scenario. Fix: Add a scenario fact to every point, such as 'its sales staff travel, so mobile access speeds up orders'.
• Treating BYOD as only a security problem. Fix: Also cover cost savings, staff satisfaction, legal ownership of data, support burden, and data protection on leaving.
• Defining IoT in general terms and stopping there. Fix: Give one sentence of definition at most, then use the company's own products, sites and customers.
• Listing only benefits and treating technology as automatically good. Fix: Always balance. Include at least two risks and a conclusion on whether the benefits justify them.
• Describing the technology in general terms instead of applying it to the case. Fix: Use a case fact in every paragraph. Ask yourself: what does this mean for this company's customers, costs or staff?
• Treating technology as automatically good and giving only benefits. Fix: Always balance. Include cost, security, data protection, skills gaps and the chance that competitors copy it.

Exam tips

• Always tie the model to scenario facts such as IT skills, data sensitivity and demand pattern. Generic answers score poorly.
• Show balance. Give benefits and risks, then a clear recommendation. Examiners reward judgement.
• Use the requested format, for example a short report to the board, and keep a professional tone to earn skills marks.
• Mention governance: the board remains accountable, so refer to contracts, service levels, exit plans and monitoring of the provider.
• Link cloud to wider issues in the case, such as cost structure, flexibility, cyber risk and data protection, but stay on the requirement.
• Always anchor points to the scenario. A generic list scores few marks, even if every item is correct.
• Cover both benefits and risks unless the requirement asks for only one. Balanced answers earn professional skills marks.
• Check what type of data the business holds and where it operates. These facts usually drive the data protection and security points.