Hybrid Cloud Services – A Buyer’s Guide

KuppingerCole’s Buyer’s Guide on Hybrid Cloud Services is positioned as a structured starting point for selecting Infrastructure as a Service (IaaS) vendors in a hybrid IT delivery model, not as a complete procurement methodology. It directs organizations to begin by identifying primary use cases, then evaluate vendors against weighted functional and non-functional criteria, request and score vendor information, ask targeted follow-up questions, and narrow to a shortlist for deeper RFIs and proof-of-concept testing. The guide emphasizes ensuring technical and organizational prerequisites are in place so hybrid IaaS becomes part of a consistent architecture with aligned governance and management processes.

The report frames IaaS as a common, comparable layer across vendors that enables migrating existing workloads with minimal change while leaving customers responsible for operating systems, middleware, applications, access control, and regulatory compliance. Hybrid IT is presented as a response to security and compliance concerns in multi-cloud reality: sensitive data and critical systems can remain on-premises or in private cloud resources, improving control but increasing management complexity. Security and compliance are explicitly shared responsibilities: the provider secures the infrastructure, while the customer secures what runs on it and must still meet legal obligations.

Five leading IaaS use cases are highlighted—DevOps, disaster recovery, external-facing applications, hybrid workloads/data, and analytics/machine learning—each implying different priority weights across selection criteria. Functional criteria span deployment models, compute (including specialized GPU and bare metal), networking (including TLS and hybrid connectivity), storage types, continuity/failover, DevOps tooling, containers/Kubernetes, virtualization support, migration tooling, and serverless options. Non-functional criteria stress vendor viability, geographic jurisdiction, partner ecosystem, portal/management integration, access management, data security, cyber resilience, and independent compliance certifications, reinforced by a vendor-question set focused on real-world SLA performance, breach handling, responsibility boundaries, and integration capabilities.

• The guide addresses Infrastructure as a Service in the context of a hybrid IT delivery model.
• IaaS customers do not manage or control the underlying cloud infrastructure.
• Customers remain responsible for the operating system, middleware, applications, and access to services in IaaS.
• Compliance with laws and regulations governing data processing remains the customer’s responsibility.
• The cloud service provider is responsible for management, security, and compliance of the infrastructure providing the service.
• The top five IaaS use cases listed are DevOps, disaster recovery, external-facing applications, hybrid workloads and data, and analytics and machine learning.
• The guide recommends moving from initial scoring to shortlisting, then deeper RFIs and proofs of concept.
• TLS v1.2 is stated as the minimum acceptable version where TLS is used for network security.
• Kubernetes is described as an open-source platform developed by Google and open-sourced in 2014.
• ISO/IEC 2700x standards, SOC reports (SSAE 16 / ISAE 3402), and CSA STAR are cited as examples of independent compliance assurance evidence.

• “This document is not a complete guideline for selecting vendors but should provide an excellent starting point to streamline the decision-making process.”
• “The hybrid IT service delivery model has emerged to address these concerns.”
• “The responsibility for security and compliance in the use of cloud services is shared between the customer and the cloud service provider (CSP).”
• “It is important to govern, manage, and secure all the components of a hybrid deployment in a consistent manner.”
• “The primary factor that most organizations consider when choosing a cloud service is how well the service meets their functional needs.”
• “Never assume that a service level beyond that specified in the SLA will be achieved.”
• “One significant challenge is to provide this in a way that is cloud service agnostic.”
• “Serverless computing is not actually serverless.”
• “It is very hard to successfully outsource something if you do not fully understand what is required or what is already being done.”
• “We see many situations that struggle not because of technical weaknesses and wrong products, but because of a lack of organizational maturity.”