Investigation of Cloud Computing Barriers: A Case Study in Saudi Arabian SMEs

Cloud Computing is arguably the most significant technological development after the Internet. It accelerated technology adoption and gave birth to new business models. More importantly, it is acting as a foundation for new technologies like the Internet of Things (IoT) and Artificial Intelligence (AI). The Cloud Computing paradigm provides a level playing field for Small and Medium-sized Enterprises (SMEs) as they are able to adopt technologies that were not affordable before. Governments, vendors and business support organisations across the world have a plethora of initiatives to encourage SME adoption of Cloud Computing technologies. Despite these initiatives, many SME decision makers are still hesitant to adopt the cloud. This research reports an engagement with 16 information technology (IT) managers working for Saudi manufacturing SMEs. This paper presents their perceived barriers to migrating their applications to cloud services.


INTRODUCTION
'Information and Communication Technology' (ICT) has played a vital role at the organisational level in transforming the 'operational practices' as well as 'electronic services' in both the public and private sectors (Basahel, Yamin, and Drijan, 2016). In the Middle East, Saudi Arabia is one of the largest markets for Enterprise IT products and services. Cloud Computing can be defined as the provision of IT services via the Internet, including storage, software, and computing power. Compared to traditional client server architecture, Cloud Computing provides IT solutions through virtualisation, service-oriented architecture, multi-tenancy and autonomic computing technologies. Accessing services via the cloud is attractive as businesses are invoiced based on consumption and there is little need for workforce to provide onsite support. Cloud Computing has eliminated the need for on site database, software, and server support. In recent years, Small and Medium-sized Enterprises (SMEs) have increased their investment in IT. Despite, the government's push in encouraging IT adoption, Saudi Arabia is still in the early stages of development. According to Amron, Ibrahim, and Chuprat (2017), the implementation of e-Government in Saudi Arabia has been delayed due to the weaknesses in the ICT infrastructure. The legal terms and conditions as well as appropriate resources are factors that delayed the Cloud Computing implementation in Saudi Arabia. It has been found in Basahel, Yamin, and Drijan (2016) that Saudi Arabia's current Revised Cloud Computing Regulatory Framework and strategies are helping them to accomplish quality outcomes in a timely manner. In the context of Saudi Arabian SMEs, many factors and conditions influence the decision to switch from an existing system to the cloud. Karim and Rampersad (2017) suggested that the decision is affected by the lack of knowledge and awareness. Cloud Computing implementation varied in other developed and developing countries, such as East Africa and South Africa (Aloraini and Hammoudeh, 2017). According to Alanezi (2018) Saudi Arabia has identified its productmanufacturing sector as one of the core drivers of the envisaged economic growth, with manufacturing continues to be a major contributor to its Gross Domestic Product (GDP). In 2018, the manufacturing and retail sectors continue to account for nearly half of all enterprises at 452,900 in total. The manufacturing sector accounts for approximately 103,700 enterprises. In Saudi Arabia, around 950,000 SMEs were registered in 2016 providing one million Saudis with employment (Raut et al., 2018). (GASTAT, 2016) predicted that in 2030 the number of SMEs in Saudi Arabia will be increased from 20% to 35%. There have been studies that analysed Cloud Computing in business. In this fast-developing technology, business dynamics changes and there is a need to continuously update research so that appropriate support polices can be in place to address adoption barriers.
This research aims to identify the barriers commonly faced by manufacturing SMEs of Saudi Arabia in adopting or migrating to Cloud Computing, using the qualitative research approach. The majority of previous studies of Saudi Cloud Computing are quantitative with the constructs re-used from the studies undertaken in the West. Since Saudi culture is very different from the west, qualitative research allows a deeper investigation of adoption barriers specific to the Saudi Arabia context. Furthermore, few studies explored decision makers' reasoning concerning Cloud Computing for manufacturing SMEs. SMEs are usually unaware of the risks and barriers that they might face during the transition, and thus, they often face severe consequences and ultimately fail to adopt Cloud Computing appropriately (Amron, Ibrahim, and Chuprat, 2017). Thus, hesitate to adopt Cloud services. The findings will enable the SMEs in the manufacturing sector of Saudi Arabia to gain a better understanding about the challenges of Cloud Computing adoption. This can pave the way for appropriate policy interventions to enable Cloud adoption, and contribute to the Saudi Arabia 2030 Vision.
The structure of this paper is as follows: Section II presents the literature review; Section III explains the methodology; Section IV provides a detailed analysis and interpretation of the interviews and Section V concludes the paper.

LITERATURE REVIEW
Recent views on the barriers to the adoption of Cloud Computing within SMEs of Saudi Arabia are listed in Table 1. Google Scholar, Emerald Insight, Science Direct and Scopus were used to identify the research relevant to cloud computing barriers and SMEs. The search range was limited to 2015-2019. According to a survey by the 'International Data Corporation' (IDC), the most common barrier to the adoption of Cloud Computing that concerns SMEs in Saudi Arabia is security and privacy (Raut et al., 2018). As they are less likely to control and own data, SMEs are usually hesitant to adopt Cloud Computing. Similarly, Al-Ruithe and Benkhelifa (2017), Al-Ruithe, Benkhelifa and Hameed (2017) indicate that the most common concern to the transition to Cloud Computing is privacy and security due to the lack of a physical structure. Almubarak (2017) reflects that the lack of trust of potential cloud services consumers is the main obstacle to adopting Cloud Computing. The work focuses on the fact that SMEs have less control over their data and are usually unaware of who is accessing their confidential data, resulting in trust issues. Al-Ruithe, Benkhelifa, and Hameed (2018) identifies the barrier of compliance. Due to the governmental laws and regulations that pertain to the storage and access of data on the Cloud, Saudi SMEs are hesitant to migrate to Cloud Computing. (AlBar and Hoque, 2019) suggests that availability and reliability are the main barriers that SMEs in Saudi Arabia tend to face, as the design and implementation of a reliable and available generic architecture for Cloud Computing is an open challenge. The research also focuses on the performance of Cloud Computing services. Karim and Rampersad (2017) states that the cost of the services for implementing the new technology is higher than that of the existing systems. Therefore, most of the SMEs in Saudi Arabia are hesitant in adopting Cloud Computing. Alharbi, Atkins, and Stanier (2017) studied five universities of Saudi Arabia, finding that Cloud Computing will soon be popular in the country.
The various barriers have been identified as shown in Figure 1 (arranged in alphabetical order).  (2017) Empirical findings from KSA public sector organisations Up to 70% of KSA organisations in the public sector currently do not adopt any cloud services, as they lack knowledge regarding Cloud Computing. 6 Raut et al. (2018) Through expert opinions and a literature review, 14 critical barriers are identified, and the ISM tool is used to establish the interrelationship between the identified barriers.
An analysis of the barriers reveals the three most significant barriers: lack of top management support (B3), lack of confidentiality (B8), and lack of sharing and collaboration (B2).
7 Al-Badi, Tarhini and Al-Qirim (2018) Qualitative, comprehensive study Three risk types (legal, organisational, and technical) are investigated. Security and privacy are also identified via a comprehensive analysis. 8 Shuaib and et al.
The literature review analysis methodology is used for the examination of key factors and challenges associated with the adoption of Cloud Computing.

METHODOLOGY
This study aims to identify the barriers commonly faced by manufacturing SMEs of Saudi Arabia in adopting or migrating to Cloud Computing. The chosen research method is qualitative. The primary data collection is semi-structured interview. This helps the researcher to assimilate rich data from the participants. The interview instrument is a set of open-ended questions that help the researcher to gather personal opinions regarding Cloud Computing. The semi-structured interviews were focused on identifying the barriers faced by manufacturing SMEs of Saudi Arabia. Questions focus on managers' perceptions of the cloud and its barriers and challenges. Questions such as; what challenges prevented your organisation from adopting the cloud services?.
Semi-structured interviews were conducted with a sample of 16 Information Technology (IT) managers from manufacturing SMEs within Saudi Arabia. The criterion for selecting the interviewees is that they have worked in SMEs in the manufacturing sector for at least three years. All the participants were familiar and aware of the barriers to the adoption of Cloud Computing. The profiles of the respondents are in Table 2.  As the researcher wanted to explore the rich insights, the entire interview conversation was recorded with consent from the respondent. The interview was transcribed for analysis and coded line by line to look for themes and patterns. The interviews were done observing the ethical policy and protocol of the university.
After 16 interviews the themes were recurring and new barriers categories were not identified. At that point, the researcher decided data collection reached saturation and there is no need for further interviews.
The responses were grouped into major themes and tallied based on the number of interviewees who mention them. Figure  2 highlights the ranked barriers. Figure 1 from literature are not present in Figure 2. This shows that the barriers are dynamic in nature. With advances in technology and the pressure to improve, some barriers have less priority in the Saudi manufacturing context. Figure 3.

The summary list of Saudi manufacturing SMEs' barriers from this research is depicted in
The identified barriers are in line with literature and no new emergent barriers were identified. This could be because Cloud Computing has been around for more than 10 years and the technology is becoming mature.

RESULTS AND DISCUSSION
The hindrances confirmed in the interviews were correlated with literature. From the analysis, the challenges and barriers retarding the endorsement of Cloud Computing by Saudi manufacturing SMEs include security, privacy, and lack of knowledge about the cloud, lack of governmental and top management support, provider lock-in, data control, service cost, and sufficient bandwidth.

Theme A: Security
In terms of the adoption of Cloud Computing, security is considered the foremost barrier that is still challenging for manufacturing SMEs in Saudi Arabia. During the interview, the CEO of one of the SMEs in Jeddah indicated that the prime reason behind SMEs' fear of and lack of interest in the implementation of Cloud Computing is security concerns. Cybersecurity threats and issues have adversely affected organisations such as hacking and phishing, whether they are giants or SMEs. Alharthi et al. (2017) supports the statement, according to which the problem of security becomes more complicated in Cloud Computing due to the addition of multiple dimensions, such as 'multi-tenancy'. The study also states that due to the lack of a physical structure, compliance with security is a critical task. Similarly, the CEO of another Jeddah-based manufacturing SME gave his stance on security as a barrier to the transition to Cloud Computing and stated, 'We believe that security is the only reason for the low uptake of the cloud. Alassafi (2018), and Basahel, Yamin and Drijan (2016) support the interpretation, reflecting that Cloud Computing is composed of various deployment and service delivery models that have security limitations with no current standards. Therefore, security is considered the foremost barrier to Saudi Arabian manufacturing SMEs' adoption of Cloud Computing.

Theme B: Lack of Top Management Support
One of the potential barriers to adopting Cloud Computing in Saudi Arabia is the lack of top management support. Management often does not show any concern or interest in the advancement of technology. An IT engineer of an SME in Jeddah stated, 'My manager still thinks that the Cloud is not suitable for our company despite successful implementations of some of our competitors'. The statement reflects the lack of interest in adopting cloud solutions. Almorsy, Grundy and Müller (2016) reflects that the interest of top management highly influences the decision to adopt Cloud Computing. However, if top management does not show any interest or support for the adoption of new technology, it becomes a huge barrier.

Theme C: Data Control
Another barrier that SMEs of Saudi Arabia usually face in adopting Cloud Computing is the control of data. SMEs fear they lose their control of the data in the Cloud. In this regard, the IT manager of an SME located in Dammam stated, 'Well, we just can't accept the fact that, we don't have controls over our data once it is with the service provider'. The findings of El-Gazzar, Hustad and Olsen (2016) reflect that SMEs cannot access and control their data is a potential barrier to the adoption of Cloud Computing in Saudi Arabia.

Theme D: Privacy
Another significant concern of Cloud Computing is privacy and it refers to more than information confidentiality. The data protection and safety of personal information derived from the privacy right through the associated right of self-determination. In the study of Albasri, Mishra and Elbeltagi (2016), the inefficiency in controlling the customers of cloud service is a severe threat towards confidentiality, data integrity, and principles of privacy. The fundamental principles that govern personal data use include fairness, lawfulness, data quality, proportionality, purpose specification, openness, and accountability. These are the basic principles of privacy that are common among legislation of different countries. From the perspective of consumers, Cloud Computing has privacy concerns. As per the survey of Ramachandra, Iftikhar and Khan (2017), around 74% of IT managers responded that the critical challenge that blocks them from using the services of cloud computing are privacy concerns. In this regard, the IT manager of one SME in Jeddah stated, 'Data privacy is so essential; we can't just rely on the cloud'. Martins, Sahandi, and Tian (2016) also supports the argument, reflecting that in Cloud Computing, multiple users share a single infrastructure at the same time, thus sacrificing privacy.

Theme E: Insufficient Bandwidth
Insufficient bandwidth is another critical barrier to Saudi Arabian SMEs' adoption of Cloud Computing. The IT assistant of a Medina-based SME stated, 'The bandwidth speed is still slow in some areas'. Similarly, the findings of El-Gazzar, Hustad and Olsen (2016) reflect that Cloud Computing requires 24*7 connectivity for accessing data. If due to technical issues and the internet is not available, one cannot access data on the cloud. Therefore, bandwidth is one serious barrier to adopting Cloud Computing as a permanent solution. It is supported by Al-Badi, Tarhini, and Al-Qirim (2018) according to which the lack of a secure internet connection is a potential barrier to Saudi Arabian SMEs' adoption of Cloud Computing.

Theme F: Lack of Government Support
Lack of government support is another key barrier to SMEs' adoption of Cloud Computing. SMEs in Saudi Arabia do not receive sufficient funding for the transition (Kalaiprasath, Elankavi and Udayakumar, 2017). The CEO of an SME in Riyadh stated, 'The government is not actually supporting SMEs to adopt the cloud. I do not know if they have funding or are introducing some sort of help'. In the same way, Amron, Ibrahim, and Chuprat (2017) supports the above notion, stating that there is a lack of appropriate governmental funding for cloud adoption, despite the fact that appropriate budgeting in the ICT sector is a potential challenge for SMEs. An IT manager of a Riyadh-based SME stated, 'The Saudi government places strict restrictions on storing data out of the country'. Alresheedi et al. (2018), andAlruithe et al. (2017) support the argument, reflecting that different countries have different laws and regulations about the usage and storage of data on the cloud due to different legal perspectives.

Theme G: Service Cost
One of the biggest concerns that SMEs of Saudi Arabia face is the high cost of services. One of the IT managers of a Makkahbased SME affirmed, 'Within our area, the service cost is high'. Supporting the argument, Amron, Ibrahim, and Chuprat (2017) reflects that due to the high cost of services in Saudi Arabia, it is difficult for SMEs to transition to Cloud Computing, as costs are likely to be higher than those of the existing system. Likewise, another IT manager of a Medina-based SME stated, 'The service cost of the cloud technologies is still high; most providers charge a lot'. Alresheedi et al. (2018), andAlruithe et al. (2017) further support the above notion by reflecting that the cost of services factor makes SMEs hesitant to adopt new technologies, particularly Cloud Computing. High costs affect Saudi SMEs in switching from the existing system.

Theme H: Provider Lock-in
Another significant barrier to the adoption of Cloud Computing is provider lock-in. Provider lock-in usually refers to proprietary technologies that are incompatible with or not required by companies. One of the IT specialists from a Jeddah-based SME stated, 'Being a medium-sized company, we do not want to lock our data with one supplier so if something goes wrong it won't be easy to transition to others'. Similarly, (Khan and Al-Yasiri, 2016) states that vendor lock-in is a potential barrier to the adoption of Cloud Computing because companies are restricted and tied to the same provider even if they do not need that technology. The study shows that this issue is still a big challenge for most of the SMEs of Saudi Arabia.

Theme I: Lack of 'Cloud' Knowledge
Even there is the popularity and enthusiasm of Cloud within the company, it has been identified that there is a shortage of operational skills and cloud knowledge, leading to unsuccessful adoption, barriers, and slower acclimatisation in continuous migration (Jouini, and Rabai, 2019) . Compliance must be considered to fulfil the legal requirements of stored and migrated data. Due to inadequate knowledge about the subject and the protocols, sometimes the legal obligations have not been complied in the fullest. Basahel, Yamin, and Drijan (2016) identified that there is a gap in technical skills that impact on the organisations and they can only use those components that are offered by cloud providers in which they have current knowledge. The interviews confirmed that the lack of Cloud Computing knowledge is one of the barriers that SMEs in Saudi Arabia face in adopting the infrastructure of the cloud. Without expertise and prior knowledge of Cloud Computing, the SMEs cannot migrate their existing systems to the cloud. One of the CEOs of a Jeddah-based SME suggested that 'Lack of appropriate knowledge of the cloud results in severe consequences'. As per Al-Badi, Tarhini, and Al-Qirim (2018), the SMEs' lack of expertise and knowledge of the functionalities of Cloud Computing make it very difficult for them to transition to and adopt the cloud. In the same way, the CEO of a Makkah-based SME stated, 'I believe training is a necessity (for cloud services); the knowledge we have is not enough'. Al-Ruithe, Benkhelifa and Hameed a.b (2017,2018) reflect that the implementation of Cloud Computing requires proper training as well as knowledge of the subject, which the SMEs in Saudi Arabia lack.
Similarly, another IT manager of a Jeddah-based SME stated, 'Support and help should be available from cloud service providers at all times'. Likewise, Beynon-Davies (2005) reflects that the adoption of Cloud Computing requires proper training and expertise, which is a barrier to implementing the cloud.

CONCLUSION
Cloud Computing is one of the most significant emerging technology of this era. However, there are barriers and challenges associated with the transition to Cloud Computing. This study presents an update on the perception of the key barriers that SMEs of Saudi Arabia are facing in the current stage of Cloud Computing. The study found the most common barriers are security, privacy, service cost, data control, insufficient bandwidth, lack of government support, lack of top management support, provider lock-in and lack of cloud knowledge and training. For SMEs in Saudi Arabia, these barriers are critical because Cloud Computing has the potential to unlock new growth opportunities for business. If prepared correctly, SMEs can easily overcome them and implement Cloud Computing in their organisations. The government of Saudi Arabia is playing a significant role in the advancement of ICT in the country. The barriers identified in this study can help the Saudi government as well as SMEs to develop effective strategies for migrating to Cloud Computing.