Paper title (Paper Title style) Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption Security and Privacy Concerns for Australian SMEs Cloud Adoption: Empirical Study of Metropolitan vs Regional SMEs Ishan Senarathna Department of Information Systems and Business Analytics Deakin Business School William Yeoh Department of Information Systems and Business Analytics Deakin Business School william.yeoh@deakin.edu.au Matthew Warren Department of Information Systems and Business Analytics Deakin Business School Scott Salzman Department of Information Systems and Business Analytics Deakin Business School Abstract New national infrastructure initiatives such as the National Broadband Network (NBN) allow small and medium-sized enterprises (SMEs) in Australia to have greater access to cost- effective Cloud computing. However, the ability of Cloud computing to store data remotely and share services in a dynamic environment brings with it security and privacy concerns. Evaluating these concerns is critical to address the Cloud computing underutilisation issue and leverage the benefits of costly NBN investment. This paper examines the influence of privacy and security factors on Cloud adoption by Australian SMEs in metropolitan and regional area. Data were collected from 150 Australian SMEs (specifically, 79 metropolitan SMEs and 71 regional SMEs) and structural equation modelling was used for the analysis. The findings reveal that privacy and security factors do not significantly influence the decision-making of Australian SMEs in the adoption of Cloud computing. Moreover, the results indicate that Cloud computing adoption is not influenced by the geographical location (i.e., metropolitan or regional location) of the SMEs. The findings extend the current understanding of Cloud computing adoption by Australian SMEs. The results will be useful to SMEs, Cloud service providers and policy makers devising Cloud security and privacy policies. Keywords: Cloud adoption, SMEs, Security, Privacy, Structural equation modelling 1 Introduction The National Broadband Network (NBN) enables Australians to access affordable, high-speed Internet and telephone services (NBNCO, 2015a) and, therefore, increases the proliferation of Cloud computing across Australia. In particular, Cloud computing has become increasingly important for Australian small- and medium-sized enterprises (SMEs), as Cloud computing affords SMEs access to the information and communication technology (ICT) applications that, previously, only large companies could afford (NBNCO, 2015b). Many Cloud service providers, such as Amazon Web Services and Salesforce.com, are offering SMEs cost-effective solutions to lower their operating costs and improve their productivity (Marston et al., 2011). Gartner defined Cloud computing as “a style of computing in which scalable and elastic IT- enabled capabilities are delivered as a service using Internet technologies” (Plummer et al., 2009). Besides shifting a specific business function to an outsourcer (Lee & Kim, 1999), Cloud computing constitutes a more radical move and involves the automation of a business process or a subset of activities. While having similar benefits as ICT outsourcing, Cloud computing is 1 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption more flexible because it is location independent, and this enables customers to access and use the services wherever they have access to the Internet. Also, Cloud computing is device independent, which means the service is able to function on a wide variety of devices. As Marston et al. (2011) explained, Cloud computing provides almost direct access to shared computing resources, thus SMEs can launch new operations quickly with little or no upfront capital investment, enabling a faster time to market. In fact, Forrester Research estimated that the global Cloud computing market will grow from $732 million in 2011 to $3.2 billion in 2020 (ACMA, 2014). International Trade Administration predicted that businesses will spend over $191 billion on Cloud services by 2020, compared to $72 billion in 2014 (ITA, 2015). The International Data Corporation (IDC) forecast a 2017 Cloud market worth $107 billion, over twice as much as its 2013 estimate of $47.4 billion (IDC, 2015). Cloud computing is a new business model, which is particularly valuable for SMEs with limited budgets for ICT investment (Mudge, 2010). Cloud computing is commercially viable for many SMEs due to its flexibility and pay-as-you-go cost structure (Sultan, 2011). However, within the SME sector, and despite the potential benefits, the adoption rate of Cloud computing is still relatively low in Australia compared with other countries in the Asian region (ACCA, 2012). According to the Australian Communications and Media Authority, less than half of the SMEs in Australia are currently using Cloud services, due in particular to concerns over privacy and security factors (Ericson, 2015; NBNCO, 2015b). The most recent global survey on Cloud computing conducted by Dresner Advisory Services revealed that security concerns are a primary barrier to adoption of Cloud computing (Ericson, 2015). Currently, Cloud computing poses an inherent challenge to privacy because Cloud computing services usually present data in an unencrypted form on a machine owned and operated by a different organisation than the data owner. The research literature indicates that the main inhibiting factor for Cloud computing adoption is the fear of sending organisational data to a third party (Rittinghouse & Ransome, 2009; Shimba, 2010). Further, previous findings suggest that Cloud computing adoption is more than just technology adoption (Tehrani & Shirazi, 2014). It includes a number of important changes relating to cross-border data transfer, storing data with a third party, remotely accessing resources and utilising applications through the Internet. In other words, there are a number of privacy and security issues associated with Cloud computing, including lack of user control, potential unauthorised secondary usage, data proliferation, cross-border data flow, multi-tenancy, and lack of standardisation (Pearson & Benameur, 2010). Because Cloud computing providers employ multiple data centres at different geographical locations around the world to optimally serve consumers’ needs, jurisdictional issues can cause regulatory and legislative complexities. In most Cloud service scenarios, consumers have no idea where their data are stored, due to the dynamic nature of the Cloud (Pearson & Benameur, 2010). Legal and regulatory issues arise that require careful consideration, because the physical location of data centres determines the set of laws that govern the management of data (Sahandi, Alkhalil & Justice, 2012). It is also interesting to note that IT adoption mainly refers to in-house IT infrastructure, whereas Cloud computing adoption involves accessing resources outside the organisation via the Internet. Yet the security and privacy issues related to Cloud computing adoption among Australian SMEs have not been the subject of previous empirical research. Therefore, this research aims to investigate the security and privacy concerns of Australian SMEs adopting Internet-based Cloud computing, with a focus on metropolitan and regional SME organisations. Section two of the paper reviews the literature and proposes the research hypotheses. Section three outlines the quantitative research methodology and measurement validity. Section four discusses the empirical findings, research contributions and limitations, and provides suggestions for further studies. Section five concludes the study. 2 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption 2 Literature Review and Hypotheses 2.1 Cloud Computing Cloud computing provides different types of services delivered under different deployment models and uses a pay-as-you-go method. Three service models are extensively used by the Cloud computing community to categorise Cloud computing services (Ahuja & Rolli, 2011; Dillon et al., 2010; George & Shyam, 2010), such as Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS) on demand and pay-as-you-go. SaaS in Cloud computing eliminates the need to install and run an application on the client’s computer (Marston et al., 2011). In addition, it is not necessary for SMEs to worry about software licensing or upgrading, because it is performed by the Cloud service providers. SMEs need to focus on Service Level Agreement or contract only. According to Sullivan (2010), there are various types of services that come under SaaS, namely, Customer Relationship Management (CRM), video conferencing, IT service management, accounting, web analytics, and web content management. Similarly, application design, development, testing, deployment and hosting are services provided by PaaS. The development and deployment of applications without the cost and complexity of buying and managing the underlying hardware and software layers is facilitated by PaaS (Marston et al., 2011). Further, Sullivan (2010) explained that IaaS provides services such as server space, networking equipment, memory, storage space and computing capabilities. Services provided by Cloud computing can be categorised according to the level of service and mode of provision. Deployment models are recorded based on these service characteristics. Four Cloud computing deployment models have been defined in the Cloud computing community (i.e., public Cloud, private Cloud, hybrid Cloud and community Cloud) (Chang et al., 2013; Gangwar et al., 2015; Tehrani & Shirazi, 2014; Zhao et al., 2014). A public Cloud computing service model is available from a third-party service provider via the Internet. It is a cost-effective way to deploy IT solutions and provides many benefits, such as being elastic and service-based, as, most of the time, resources are not utilised to maximum capacity, which wastes money. The scalability of Cloud computing significantly reduces the time resources are idle and allows SMEs to use only the amount of computing resources they need. They can instantly scale resources up or down when demand increases or decreases. Public Cloud is the most commonly used model and is especially suitable for SMEs because it provides near- immediate access to hardware resources, with no upfront capital investments for users, leading to a faster time to market for many businesses. This treats IT as an operational expense, rather than a capital expense (‘Opex’ as opposed to a ‘Capex’ model) (Marston et al., 2011). Private Cloud computing provides greater control over the Cloud computing infrastructure and can be managed within the organisation. Therefore, it is often suitable for large organisations, as they are using larger installations (Marston et al., 2011). Hybrid Cloud computing is a combination of public and private Cloud computing models that addresses the limitations of each (Zhang et al., 2010). The community Cloud computing infrastructure is controlled and shared by a group of organisations and supports a specific community with shared concerns (e.g., mission, security requirements, policy and compliance considerations) (Sasikala, 2011). 2.2 Cloud Computing Adoption in SMEs The Australian Bureau of Statistics defined SMEs as businesses with less than 200 employees, with medium-sized businesses employing 20–199 staff, and small businesses employing fewer than 20 staff (DIISR, 2011). Australian SMEs play a substantial role in economic development; they represent 96% of all Australian business and 69% of the total workforce, and account for 33% of Gross Domestic Product (GDP) (ACMA, 2014). Senarathna et al. (2015) suggested that, in many instances, using Cloud computing provides the first opportunity for SMEs to try new software approaches in a cost-effective manner. Often SMEs are unable to afford their own dedicated IT, but they have an IT budget sufficient to buy the bandwidth and pay according to their need and usage (Monika et al., 2010). In a Cloud computing environment, SMEs can reduce their capital expenditure for IT infrastructure and, instead, utilise and pay for the resources and services provided by Cloud computing (Rittinghouse & Ransome, 2009). A 3 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption KPMG report on Australian lessons and experiences showed that using Cloud computing allowed Australian organisations to adopt innovative IT technologies quickly, without paying upfront for capital investment (McCabe & Hancook, 2009). According to Lawrence et al. (2010), all direct and indirect go-to-market models in Cloud computing are able to cater to the needs of SMEs, but they are not necessarily suitable for large enterprises because of their organisational scale and complexity. It has been found that the current charging pattern and other aspects of Cloud computing make it more suitable for SMEs than for larger organisations (Misra & Mondal, 2010). Further, the public Cloud service provides a more valuable service to SMEs, as they require many of the same business services provided to large organisations (e.g., software such as CRM, ERP, HRM and payroll, and hardware such as server and storage), even though they may only have a PC and an Internet connection (Handler et al., 2012). Cloud adoption in Australia is growing rapidly, with key global players such as Amazon Web Services extending their offerings in the region with new data centres, while a host of local and regional Cloud providers are also expanding (Miller, 2014). Telstra (2011) stated that its entire network is robust and sufficiently extensive to provide reliable Cloud services to customers in metropolitan and regional areas. Moreover, the NBN was introduced as an investment in infrastructure to provide high capacity data communications across the nation. The NBN planned to reach 93% of the Australian homes, schools and businesses that could be accessed by the NBN through optic fibre, providing peak speeds of up to 25Mbps. The NBN consists of the provision of broadband services over a mix of three technologies: optic fibre, fixed wireless, and next-generation satellite (Matthew, 2014). The NBN could enable SMEs in Australia to further embrace Cloud computing services. Minifie (2014) argued that businesses need reliable high bandwidth, low-latency uploads and downloads, and sufficient international backbone bandwidth. Minifie (2014) also argued that bottlenecks in suburbia and regional and remote areas should be addressed to enable rapid Cloud adoption. In addition, the findings of Sultan (2011) and Bharadwaj and Lal (2012) revealed that Cloud computing is likely to be a more attractive option for most SMEs because of flexible cost structure and scalability. Further, Cloud services can be used easily by SMEs due to relative advantage, flexibility and scalability features (Salleh et al., 2012). According to Gartner, the public Cloud services market (the most popular services needed by SMEs) would reach US$250 billion by 2017, with continuous rapid growth from 2011 to 2017 (Anderson et al., 2013). Therefore, there is a burgeoning need to conduct focussed research on the issue. 2.3 Hypotheses Development To ensure a comprehensive coverage, the constructs used in this study are explored through a myriad of theoretical, practitioner and government underpinnings. The academic, government and practitioner literatures for each construct was reviewed and is listed separately in Table 1. Based on the literature, Cloud security and privacy factors are discussed in detail. Constructs Academic Government Practitioner Cloud security Gangwar et al., 2015; Li et al., 2015; Oliveira et al., 2014; Ross & Blumenstein, 2015; Safari et al., 2015; Stieninger & Nedbal, 2014; Tang and Liu, 2015; Tarmidi et al., 2014; Tehrani & Shirazi, 2014; Zhao et al., 2014 Anthony, 2012; DBCDE, 2013; DFD, 2011b, 2011c, 2011d; DOC, 2014; IMO, 2012; IMO, 2013; ITIIC, 2011; Jansen & Grance, 2011; SWI, 2012 ACCA, 2014; Ben, 2014; Dave, 2012; Handler et al., 2012; Herhalt & Cochrane, 2012; Hutley, 2012; Mark, 2011; Minifie, 2014; Pearson, 2012; Ren et al., 2012; Telstra, 2011 Cloud privacy Fairchild, 2014; Fakieh et al., 2014; Gangwar et al., 2015; Kauffman et al., 2014; Mahmood et Anthony, 2012; DBCDE, 2013; DFD, 2011b, 2011c, 2011d; DOC, 2014; IMO, ACCA, 2014; Ben, 2014; Dave, 2012; Herhalt & Cochrane, 2012; Hutley, 2012; 4 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption al., 2014; Ross & Blumenstein, 2015; Safari et al., 2015; Stieninger & Nedbal, 2014; Tang & Liu, 2015; Tehrani & Shirazi, 2014; Vanessa, 2014 2012; IMO, 2013; ITIIC, 2011; Jansen & Grance, 2011 Ko et al., 2011; LEMT, 2011; Mark, 2011; Minifie, 2014; Pearson, 2012; Ren et al., 2012; Telstra, 2011 Table 1: Constructs used to examine Cloud computing adoption 2.4 Cloud Privacy Privacy is an important issue in technological innovations, particularly when it has an online interaction. In the Cloud environment, privacy reflects a consumer’s concerns about information being stored in the Cloud and accessed by other individuals anywhere in the world (Vanessa, 2014). In other words, input data for Cloud services are uploaded by a user to the Cloud, which the user does not own or control. As Abadi (2009, pp. 2–3) indicated, “Computer power is elastic, but only if the workload is parallelisable … data is stored at an un-trusted host … data is replicated, often across large geographic distances”, which are some of the Cloud characteristics that make the Cloud a risk. Featherman and Pavlou (2003) recognised privacy as a key factor hindering the uptake of some ICT technologies, due to the open nature of the Internet. Privacy risk is typically a major concern of businesses considering Cloud computing (Aziz, 2010; Hailu, 2012). According to a survey carried out among Chief Information Officers (CIOs) in Europe, approximately 70% of CIOs were prevented from launching Cloud computing solutions due to their own concerns over privacy and security fears (Wijesiri, 2010). In particular, lack of transparency creates legal issues that are affected by the Cloud’s physical location, which creates difficulties in determining jurisdiction. Because of this key issue, the Australian Federal Government is concerned about the locations of outsourced personal data storage and strongly prefer for Cloud services to be located only within Australia’s borders (Hutley, 2012). It is notable that the European Union (EU) has privacy regulations that prohibit the transmission of some types of personal data outside the EU (Sultan, 2010). In a survey conducted by Tang and Liu (2015), the respondents indicated that data privacy issues were their top concern in considering whether to adopt Cloud computing. According to Gupta, Seetharaman and Raj (2013), privacy is the top concern of 50% of organisations in considering whether to adopt Cloud computing. A study by Safari, Safari and Hasanzadeh (2015) likewise showed that privacy is a significant determinant in the adoption of Cloud computing. Xu and Gupta (2009) included privacy concerns as a way of evaluating the potential adoption of location-based services. Chen, Paxon and Katz (2010) expressed concern that privacy has emerged as one of the most significant disadvantages of joining a Cloud computing group. According to Alkhater, Wills and Walters (2014), privacy is the main concern for organisations thinking about Cloud computing, because they cannot fully control the information stored on Cloud-based servers. Tancock, Pearson and Charlesworth (2013) also argued that privacy issues form the major hurdle to large-scale acceptance of Cloud computing. Trust in privacy has also been shown to be a primary determinant of IT innovation acceptance and diffusion in organisations (Li, Hess & Valacich, 2008; Schoorman, Mayer & Davis, 2007). Transferring personal data to a third party without privacy policies in place creates huge risks in terms of data loss, data theft, data damage and data misuse. Even with policies in place, risks remain (Ko et al., 2011) but the associated controls that support the policies, help minimise the risk. The Victorian State Government identified key legal issues with Cloud computing, including information privacy related to Cloud services and their relationship with the Australian Privacy Principles (Anthony, 2012). The Australian Government’s Department of Finance and Deregulation published a best practice guide to help agencies navigate typical legal issues in Cloud computing agreements, with the intention of emphasising privacy concerns (DFD, 2011b). Further, the Australian Federal Information Management Office provided a best practice guide (‘Privacy and Cloud Computing for Australian Government 5 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption Agencies’) to better understand how to comply with privacy laws and regulations when choosing Cloud-based services (IMO, 2013). Along these lines, this study hypothesises that: H1: Cloud privacy influences the decision-making of Australian SMEs considering whether to adopt Cloud computing. 2.5 Cloud Security Information security refers to the “preservation of confidentiality, integrity and availability of information; in addition, other properties such as authenticity, accountability, non- repudiation and reliability can also be involved” (Pearson, 2012, p. 14). The foundations of information security are based upon the confidentiality, integrity, availability, accountability, assurance and resilience of information (Friedman & West, 2010). In recent studies, information security concerns have been cited as the most significant barrier to Cloud adoption (Armbrust et al., 2010; Kshetri, 2013; Xiao & Xiao, 2013). Security issues in Cloud computing were generally discussed by many researchers (Jamil & Zaki, 2011; Kshetri, 2013; Zissis & Lekkas, 2012) and with specific reference to SMEs (Adam, 2014; Alshamaila, 2013; Gupta et al., 2013). Further, several studies have demonstrated that security is one of the major challenges keeping end-users away from Cloud computing (Gens et al., 2009; Shaikh & Haider, 2011). In particular, major issues pertaining to data security in the Cloud computing environment include data location and data transmission, data availability, data security (Mahmood, 2011), malicious insiders, outside attacks and service disruptions (Behl, 2011). Other major challenges include the delegation of confidentiality, and the availability and integrity of data provided to a third party. The security of Cloud computing is complicated because of the multi-tenancy of the virtualised resources (Opala, 2012). Cloud users may think that Cloud computing simplifies security issues for users by outsourcing the responsibility to another party who is presumed to be highly skilled in such matters (Anthes, 2010). Industry practitioners have reported that security was a critical concern in the initial stages of Cloud computing adoption (Chakraborty et al., 2010; McCabe & Hancock, 2009). Bhayal (2011) stated that Cloud security is the most important concern among Cloud clients, as the data owner does not know where the data are stored and data hosts cannot be considered completely reliable. According to Benlian and Hess (2011), research regarding the adoption of Cloud computing has considered security as a barrier and Feuerlicht, Burkon and Sebesta (2011) identified security as a potential risk and challenge in Cloud computing adoption. The security issues of Cloud computing related to third parties’ involvement also pose challenges (Subashini & Kavitha, 2011). According to Katzan (2010), Cloud computing security is not just about authenticity, authorisation and accountability; it is more concerned with data protection, disaster recovery and business continuity. The architecture of Cloud computing also leads to many new security issues, such as data leakage, virtualisation vulnerability and hypervisor vulnerability (Gonzalez et al., 2012). Garg and Stiller (2014) suggested that Cloud security risks also include contractual loopholes, confidentiality, information security and service outages. A survey of CIOs and IT executives by the IDC rated security as their main Cloud computing concern, and almost 75% of respondents were worried about security (Sultan, 2010). Dillon and Vossen (2014) also found that security issues were the most limiting factor for Cloud adoption. Security is one of the concerns about Cloud computing that continues to delay adoption (Jamwal, Sambyal & Sambyal, 2011). Sarwar and Khan (2013) found that security is the biggest issue in Cloud computing as, while utilising storage service in a remote location, the consumers are generally unaware of what happens to their data. According to Forrester research, Sahandi et al. (2012) reported that security concerns are the most commonly cited reason why enterprises are not interested in SaaS Cloud. Therefore, this study hypothesises that: H2: Cloud security influences the decision-making of Australian SMEs considering the adoption of Cloud computing. 6 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption 2.6 Metropolitan vs Regional The location of an organisation is an important consideration in innovation adoption (Carcary et al., 2014; Drew, 2003; Gengatharen & Standing, 2005; Minifie, 2014). Robert and Mira (2010) argued that SMEs in regional areas are particularly constrained by great distances. Vanessa (2014) suggested that it is useful to examine different geographic regions to further distinguish the differences between urban and rural areas in facilitating Cloud computing adoption behaviour. Alshamaila et al. (2013) pointed out that the nature of Cloud computing transcends boundaries and regional ICT infrastructure is not considered a major obstacle for the adoption process. Cheng and Kam (2008) observed that Cloud computing allows for computing resources to be distributed across regional locations for seamless access. Further, Trend Micro’s annual security survey found that significant regional differences, such as regional differences in Cloud security, are less likely to adopt Cloud computing (Dave, 2012). Therefore, the geographical location of the SMEs was considered and included as the control variable of this study. Thus, this study also hypothesises that: H3: The decision-making process to adopt Cloud computing is different between Australian SMEs in metropolitan and regional areas. Based on the aforementioned hypotheses, Figure 1 presents the research model of this study. In this model, latent variables, that is, Cloud privacy (CP) (Hypothesis 1) and Cloud security (CS) (Hypothesis 1), are the independent variables that could influence the decision of Australian SMEs considering whether to adopt Cloud computing. These latent variables are measured using three items each, while SME location (regional vs metropolitan) represents the control variable. Cloud adoption is the dependent variable and measured by four items. The detail of the items is available at: https://goo.gl/RD76uf Figure 1. Research model 3 Methodology A positivist paradigm quantitative research method was applied in this study. In this study, a structured questionnaire was used to collect the quantitative data from Australian SMEs in metropolitan and regional areas. Data were collected from the SME IT managers or decision- makers. The Australian Communications and Media Authority reported that 94% of SMEs are connected to some form of Internet service (ACMA, 2014). Hence, an online survey was used for data collection. The questionnaire was divided into two parts. The first part of the survey 7 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption captured the demographic details of the responding organisations, and the second part of the survey captured perceptions of the security and privacy of Cloud computing. For each construct, three to four items were formulated capturing the perception and adoption of Cloud computing by SMEs. All of the reflective indicators of a construct were measured on a 7-point Likert scale, using scales ranged from (1) ‘strongly disagree’ to (7) ‘strongly agree’. As recommended by Bryman and Bell (2015), ethical approval to undertake research is an important step, hence ethics approval was obtained from the Faculty Human Ethics Advisory Group (available at: https://goo.gl/btILDT). This was performed to protect the respondents from any adverse consequences that could result from conducting this research. 3.1 Measurement Reliability and Validity The researchers used structural equation modelling (SEM) (IBM SPSS AMOS) to perform the data analysis. First, the reliability of the measurement was assessed based on the composite reliability and Cronbach’s alpha coefficient. As shown in Table 2, the minimum composite reliability and Cronbach’s alpha values for all constructs in this study were above the recommended threshold value of 0.7 (Hair et al., 2010; Malhotra, 2010), suggesting good reliability. Construct Items Loading AVE Cronbach’s alpha Composite reliability Cloud adoption ADOPT1 0.994 0.989 0.993 0.871 ADOPT2 0.982 ADOPT3 0.994 ADOPT4 0.987 Cloud security CS1 0.774 0.834 0.703 0.815 CS2 0.777 CS3 0.834 Cloud privacy CP1 0.730 0.847 0.750 0.889 CP2 0.882 CP3 0.820 Table 2: Measurement reliability and validity results Second, to assess convergent validity, the average variance extracted (AVE) for each construct must meet the minimum recommended value of 0.50 (Fornell & Larcker, 1981). The AVE for the constructs of this study ranged from 0.834 to 0.989, hence adequately demonstrating convergent validity. Third, confirmatory factor analysis was conducted to assess the factor loadings of each construct. As depicted in Table 3, the results indicate that items load higher on their constructs and higher than cross-loadings. Overall, the results have good reliability, convergent validity and discriminant validity, and thus are appropriate for testing the research model. Moreover, to reduce the likelihood of common methods bias, items were randomised within the instrument to limit the ability of participants to detect underlying construct patterns (Straub et al., 1989). Because both the dependent variable and independent variables were measured using the same instrument, Harman’s one-factor test (Podsakoff et al., 2003) was also performed, ie., all items were entered into an unrotated exploratory factor analysis to determine whether a single factor emerges or a single factor accounts for the majority of the variance. In this test, three factors emerged clearly; therefore, common methods bias is not an issue in our data set. Construct Items ADOPT CS CP Cloud adoption ADOPT1 0.994 0.013 0.006 ADOPT2 0.982 0.027 0.010 ADOPT3 0.994 0.010 0.004 ADOPT4 0.987 0.013 0.006 8 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption Construct Items ADOPT CS CP Cloud security CS1 −0.088 0.774 −0.182 CS2 −0.017 0.777 0.044 CS3 0.157 0.834 −0.012 Cloud privacy CP1 −0.123 −0.094 0.730 CP2 0.083 0.010 0.882 CP3 0.065 −0.043 0.820 Table 3: EFA results 4 Results and Discussion Table 4 summarises the demographic characteristics of the SME respondent organisations. Not surprisingly, those states with larger populations provided higher response rates. Survey participant organisations (N=150 SMEs) State/Territory VIC 29 19.3% NSW 30 20.0% QLD 41 27.3% WA 19 12.7% SA 17 11.3% TAS 11 7.3% NT 3 2.0% N=150 100% Table 4: Demographic characteristics of respondent organisations The locations of the organisations were categorised based on regional Australian postcodes (TCP, 2015). Table 5 shows that 52.7% of the respondents in the sample were from metropolitan areas, and 47.3% were from regional areas. Frequency Percent Valid Percent Cumulative Percent Valid Metropolitan 79 52.7 52.7 52.7 Regional 71 47.3 47.3 100.0 Total 150 100.0 100.0 Table 5: Frequencies of respondent location The descriptive analysis of all the multi-item factors in the research model used to examine the hypotheses are presented as follows. 9 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption 4.1 ADOPT (Intention to Adopt) Table 6 shows the frequency distribution of the items used to measure the perception of SMEs to adopt Cloud computing. The means of the items of ADOPT ranged from 𝑋𝑋 = 5.43 (stdev. 1.759) to 𝑋𝑋 = 5.57 (stdev. 1.569). The highest mean was for item ADOPT2: ‘Our organisation feels that organisations’ needs can be met by Cloud computing’ (𝑋𝑋 = 5.57; stdev. 1.569). The lowest mean was for item ADOPT4: ‘Our organisation will adopt Cloud computing within the next 12 months’ (𝑋𝑋 = 5.43; stdev. 1.759). The overall mean of ADOPT was 𝑋𝑋 = 5.51, which indicates a high degree of agreement by SMEs to adopt Cloud computing. The majority of the respondents agreed or strongly agreed that they are planning or intending to adopt Cloud computing in the near future. 10 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption Item SME Responses Mean Std. Dev. Strongly Disagree Disagree Somewhat Disagree Neither Agree nor Disagree Somewhat Agree Agree Strongly Agree ADOPT1 8 7 3 17 5 69 41 5.50 1.670 ADOPT2 7 4 4 18 7 69 41 5.57 1.569 ADOPT3 7 6 5 16 6 69 41 5.53 1.625 ADOPT4 10 7 4 17 2 69 41 5.43 1.759 Overall mean 5.51 Table 6: Frequency distribution of the ADOPT 4.2 Cloud Security Table 7 depicts the frequency distribution of the items of CS. The means of the items of CS ranged from 𝑋𝑋 = 4.29 (stdev. 0.824) to 𝑋𝑋 = 4.92 (stdev. 0.799). The highest mean was for item CS1: ‘Our organisation is not concerned about the security of the Cloud computing’ (𝑋𝑋 = 4.92; stdev. 0.799). The lowest mean was for item CS2: ‘Our organisation considers that Cloud computing is more secure than traditional computing’ (𝑋𝑋 = 4.29; stdev. 0.824). The overall mean of CS was 𝑋𝑋 = 4.60, which indicates a fair degree of agreement of SMEs’ perceptions of CS to adopt Cloud computing. This factor was not correlated with ADOPT, with a correlation coefficient of only 0.006. Item SME Responses Mean Std. Dev. Strongly Disagree Disagree Somewhat Disagree Neither Agree nor Disagree Somewhat Agree Agree Strongly Agree CS1 0 0 5 36 78 28 3 4.92 0.799 CS2 0 0 20 80 37 12 1 4.29 0.824 CS3 0 1 16 60 49 16 8 4.58 1.018 Overall mean 4.60 Table 7: Frequency distribution of the CS 4.3 Cloud Privacy Table 8 presents the frequency distribution of the items of CP. The means of the items of CP ranged from 𝑋𝑋 = 3.19 (stdev. 1.161) to 𝑋𝑋 = 3.57 (stdev. 1.200). The highest mean was for item CP3: ‘Our organisation feels Cloud computing can be trusted’ (𝑋𝑋 = 3.57; stdev. 1.200). The lowest mean was for item CP1: ‘Our organisation prefers to store data in the Cloud data centre located within Australia’ (𝑋𝑋 = 3.19; stdev. 1.161). The overall mean of CP was 𝑋𝑋 = 3.34, which indicates a fair agreement of SMEs’ perception of CP to adopt Cloud computing. This factor was not correlated with ADOPT, with a correlation coefficient of only 0.044. In short, the results show that, although Cloud security and privacy factors are considered somewhat important by the SMEs, these factors do not significantly influence the SMEs’ decision to adopt Cloud computing. 11 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption Item SMEs Responses Mean Std. Dev. Strongly Disagree Disagree Somewhat Disagree Neither Agree nor Disagree Somewhat Agree Agree Strongly Agree CP1 8 37 47 40 13 5 0 3.19 1.161 CP2 11 29 42 52 12 4 0 3.25 1.158 CP3 9 18 36 61 17 9 0 3.57 1.200 Overall mean 3.34 Table 8: Frequency distribution of the CP Next, the hypotheses proposed in the study were tested using SEM. The model fit was evaluated with comparative fit index (CFI), root mean square error of approximation (RMSEA) and relative chi-square (CMIN/DF). The results indicated a good model fit, as the CFI was 0.985, the RMSEA was 0.073, and the CMIN/DF was 1.803 (i.e., less than 3). As shown in Figure 2, the analysis revealed that Cloud security and privacy factors do not have a significant influence in relation to Cloud computing adoption by SMEs. Figure 2. Results of AMOS structural model analysis Hypothesis 1, which proposes that higher levels of privacy in the Cloud computing environment, as perceived by SMEs, may motivate them to adopt Cloud computing services, was not supported by the analysis (path coefficient = 0.10, p>0.5). This finding is not consistence with previous research by Chen and Chang (2013), indicating that privacy influence the decision of technological innovation adoption. The second hypothesis (H2), which proposes that higher levels of security in the Cloud computing environment may motivate SMEs to adopt Cloud computing services, was not supported (path coefficient = 0.11, p>0.5). A possible explanation for this may be that the SMEs were not fully aware of the security and privacy issues related to Internet-based Cloud computing provision. It is also possible that SMEs, which are usually on a tight budget, are more concerned about cost- effectiveness rather than security and privacy issues. As can be observed in Table 9, the ANOVA analysis indicated that the SME location difference between metropolitan and regional areas was not statistically significant (F (1, 148) 1.601 and p>0.05). In other words, this result revealed that variances of Cloud computing adoption among the locations of the SMEs do not differ. Therefore, H3 is not supported. This finding is in contrast with the assertions of previous studies (e.g., Carcary et al., 2014; Minifie, 2014). For 12 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption instance, Minifie (2014) argued that regional location was an inhibiter for Cloud computing, and recommended that the bottlenecks in the suburbs and regional areas should be addressed. Carcary et al. (2014) suggested location as a potential barrier to Cloud computing adoption. However, the present finding indicates that the perceptions of Australian SMEs considering Cloud adoption is not different between metropolitan and regional areas. A possible explanation for this is that Internet connection is easily accessible in regional areas, offering SMEs convenient access to Cloud computing services. In fact, according to the Australian Communications and Media Authority, 94% of SMEs in Australia, including those in regional areas, were connected to the Internet, with 87% of these utilising a broadband service (ACMA, 2014). Hence, the location of the SME does not exert a significant influence on the Cloud adoption. Sum of Squares df Mean Square F Sig. Between groups Within groups Total 1.601 140.631 142.232 1 148 149 1.601 .950 1.685 .196 Table 9: SME geographical location and Cloud adoption ANOVA 4.4 Contributions This paper contributes to Cloud adoption research. The study bridges the research gap and provides insightful evidence on these issues, especially within the context of Australian SMEs. It is one of the first scholarly, empirical studies of Australian SMEs, with 150 observations across metropolitan and regional areas. Contrary to the existing literature (Tang & Liu, 2015; Vanessa, 2014; Dillon & Vossen, 2014), the survey findings indicate that company location, security and privacy factors do not play the most significant role in the decision-making process of SMEs considering whether to adopt Cloud computing. A possible reason for this might be that they are not fully aware of Cloud computing and its nature. Also a fair explanation is that SMEs are typically less concerned about security and privacy threats, in part because they do not have dedicated IT staff and the associated knowledge. Thus, this study extends our current understanding of Cloud computing adoption by Australian SMEs and contributes to the literature of Cloud computing and organisational innovation adoption. Additionally, a methodological contribution of the study is the synthesis of the existing literature to define forms of measurement and operationalisation. The research constructs were developed through a comprehensive review of theoretical, practitioner and government underpinnings. As the field of Cloud computing is still relatively new, the research constructs provide foundations for further studies on the adoption of specific Cloud services, such as IaaS, PaaS and SaaS. This study has practical contributions. The new understandings (i.e., that security and privacy factors do not possess significant influences on SMEs) enable SMEs, Cloud service providers, IT practitioners and policy makers to concentrate on other critical factors that have more impact on Cloud computing adoption, such as broadband affordability and speed. As SMEs are generally not capable of spending significant amounts of investment on ICT, it is essential for Cloud service providers, professional bodies and the government to devise strategies for the widespread adoption of Cloud computing for this SME category. It is also essential to reduce the feeling of uncertainty regarding Cloud computing adoption by SMEs through a wider coverage of NBN, especially for those in regional areas. 4.5 Limitations and Future Research As with any research work, this research has some limitations that also offer opportunities for future studies. The first limitation is that this research focuses only on SMEs within Australia, 13 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption excluding SMEs from other countries. Therefore, the findings of this study are limited and should be considered carefully in other regions, as they may not be applicable to SMEs from different parts of the world. Hence, this study would have benefited from the inclusion of perspectives of SMEs from other countries. Second, this study is limited in terms of its qualitative data. Further qualitative research, such as case studies and longitudinal studies, are required to gain a solid understanding of this phenomenon. Third, Cloud computing adoption by SMEs is still in its initial stage, and further detailed research incorporating other important aspects in this area is required. Future studies could focus on variables such as cultural factors and the differences in legal systems in the use of technology throughout different countries. 5 Conclusion This paper has empirically examined how security and privacy concerns for Cloud computing are influencing the adoption by SMEs in Australia. Through an online survey method, this study concludes that security and privacy factors are not significantly influential for Australian SMEs in Cloud adoption decisions. Further, the findings reveal that Cloud computing adoption is not influenced by the geographical location of the SMEs (i.e., metropolitan vs regional). This research contributes to the emerging literature of Cloud computing adoption. References Abadi, D. J. (2009) "Data management in the cloud: Limitations and opportunities", IEEE Data Engineering Bulletin, 32(1): 3-12. ACCA (2012) Cloud Readiness Index 2012, Asia Cloud Computing Association. ACMA (2014) Communications report 2013-2014, The Australian Communications and Media Authority, 1-130. Adam, I.O. (2015) 'Small and Medium Enterprises (SMEs) in the Cloud in Developing Countries: A Synthesis of the Literature and Future Research Directions', Journal of Management and Sustainability, 5(1): 115-139. Ahuja, S. P. & Rolli, A. C. (2011) "Survey of the State-of-the-Art of Cloud Computing", International Journal of Cloud Applications and Computing, 1(4): 34-43. Alkhater, N., Wills, G. & Walters, R. (2014) 'Factors influencing an organisation's intention to adopt Cloud computing in Saudi Arabia', IEEE 6th International Conference on Cloud Computing Technology and Science (CloudCom), 15-18 Dec 2014, 1040-1044. Alshamaila, Y., Papagiannidis, S. & Li, F. (2013) Cloud computing adoption by SMEs in the north east of England: A multi-perspective framework. Journal of Enterprise Information Management, 26(3): 250-275. Anthes, G. (2010) "Security in the cloud", Communications of the ACM, 53(11): 16-18. Anthony, B. (2012) "Forecast: Cloudy but fine?", Privacy risks and potential benefits in the Cloud, Victoria Privacy Commissioner. Armbrust, M., Fox, A., Griffith, R., Joseph, A.D., Katz, R., Konwinski, A., Lee, G., Patterson, D., Rabkin, A., Stoica, I.O.N. & Zaharia, M. (2010) 'A view of Cloud computing', Communications of the ACM, 53(4): 50-8. Aziz, N. (2010) French higher education in the Cloud, Grenoble, France: Grenoble Ecole de Management. Behl, A. (2011) Emerging security challenges in cloud computing: An insight to cloud security challenges and their mitigation. World Congress on Information and Communication Technologies (WICT), 217-222. 14 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption Benlian, A., Koufaris, M. & Hess, T. (2011) Service quality in software-as-a-service: Developing the SaaS-Qual measure and examining its role in usage continuance. Journal of Management Information Systems, 28(3): 85-126. Bharadwaj, S.S. & Lal, P. (2012) "Exploring the impact of Cloud Computing adoption on organizational flexibility: A client perspective”, International Conference on Cloud Computing Technologies, Applications and Management (ICCCTAM), 121-131. Bhayal, S. (2011) A Study of Security in Cloud Computing, Available from ProQuest Dissertations and Theses. (UMI No: 1504430) Bryman, A. & Bell, E. (2015). Business research methods, Oxford University Press. Carr, N.G. (2005) "The end of corporate computing", MIT Sloan Management Review 46(3): 67-73. Carcary, M., Doherty, E. & Conway, G. (2014) The Adoption of Cloud Computing by Irish SMEs–an Exploratory Study. Electronic Journal Information Systems Evaluation, 17(1):3-14. Chakraborty, R., Ramireddy, S., Raghu, T.S. & Rao, H.R. (2010) "The information assurance practices of cloud computing vendors", IT Professional 12(4): 29-37. Chang, V., Walters, R.J. & Wills, G. (2013) "The development that leads to the Cloud Computing Business Framework", International Journal of Information Management, 33(3): 524-538. Chen, K.Y. & Chang, M.L. (2013) “User acceptance of ‘near field communication’ mobile phone service: an investigation based on the unified theory of acceptance and use of technology model”, The Services Industries Journal, 33(6): 609-623. Cheng, S.K. & Kam, B.H. (2008) A conceptual framework for analysing risk in supply networks. Journal of Enterprise Information Management, 21(4): 345-360. Chin, W.W., Marcolin, B.L. & Newsted, P.R. (2003) A partial least squares latent variable modeling approach for measuring interaction effects: Results from a Monte Carlo simulation study and an electronic-mail emotion/adoption study. Information Systems Research, 14(2): 189-217. Dave, A. (2012) The state of Cloud Computing Security in Asia, Trend Micro, 1-5. DBCDE (2013) The National Cloud Computing Strategy, Department of Broadband, Communication and the Digital Economy, 1-38. DFD (2011) "Negotiating the cloud – legal issues in cloud computing agreements", Department of Finance and Deregulation, 1-18. DIISR (2011) Key statistics: Australian small business, Australian Government, 1-56. Dillon, T., Wu, C. & Chang, E. (2010) "Cloud Computing: Issues and Challenges”, 27-33. DOC (2014) Cloud Computing Regulatory Stock Take, Australian Government, 1-91. Drew, S. (2003) Strategic Uses of E-Commerce by SMEs in the East of England. European Management Journal, 21(1): 79-88. Ericson, J. (2015) Cloud Computing and BI 2015: Three Takeaways, Available at: http://www.dresneradvisory.com/2015_Cloud_Computing_and_BI [Accessed 20 April 2015]. Fakieh, B., Blount, Y. & Busch, P. (2014) Success in the Digital Economy: Cloud Computing, SMEs and the impact to National Productivity. Paper presented at the 25th Australasian Conference on Information Systems, Auckland, New Zealand. Fairchild, A.M. (2014) 'Patterns of Trust: Role of Certification for SME Cloud Adoption', in Continued Rise of the Cloud, Springer, 145-58. 15 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption Featherman, M. & Pavlou, P. (2003) 'Predicting e-services adoption: a perceived risks facets perspective', International Journal of Human-Computer Studies, 59(1): 451-74. Feuerlicht, G., Burkon, L. & Sebesta, M. (2011) Cloud computing adoption: What are the issues, Systémová Integrace. Fornell, C. & Larcker, D.F. (1981) Evaluating structural equation models with unobservable variables and measurement error. Journal of marketing research, 18(1): 39-50. Friedman, A.A. & West, D.M. (2010) Privacy and Security in Cloud Computing, Issues in Technology Innovation, Center for Technology Innovation at Brookings, (3). Gangwar, H., Date, H., Ramaswamy, R., Irani, Z. & Irani, Z. (2015) Understanding determinants of cloud computing adoption using an integrated TAM-TOE model. Journal of Enterprise Information Management, 28(1): 107-130. Garg, R. & Stiller, B. (2014) 'Design and evaluation of an Impact Analysis Methodology for the adoption of Cloud-based services (IAMCIS)', in Network and Service Management (CNSM), 2014, 10th International Conference, 260-263. Gengatharen, D. E. & Standing, C. (2005) A framework to assess the factors affecting success or failure of the implementation of government-supported regional e-marketplaces for SMEs. European Journal of Information Systems, 14(4): 417-433. Gens, F., Mahowald, R., Villars, R.L., Bradshaw, D. & Morris, C. (2009) Cloud Computing 2010: An IDC Update, Available at: http://www.slideshare.net/JorFigOr/cloud- computing-2010-an-idc-update [Accessed 13 August 2012]. George, F. & Shyam, G. (2010) "Impact of Cloud Computing: Beyond a Technology Trend", Systems Integration, 262-269. Gonzalez, N., Miers, C., Redígolo, F., Simplicio, M., Carvalho, T., Näslund, M. & Pourzandi, M. (2012) 'A quantitative analysis of current security concerns and solutions for cloud computing', Journal of Cloud Computing, 1(1): 1-18. Grover, V., Cheon, M.J. & Teng, J.T. (1996) 'The effect of service quality and partnership on the outsourcing of information systems functions', Journal of Management Information Systems, 12(4): 89-116. Gupta, P., Seetharaman, A. & Raj, J.R. (2013) 'The usage and adoption of cloud computing by small and medium businesses', International Journal of Information Management, 33(5): 861-74. Hailu, A. (2012) 'Factors influencing Cloud-computing technology adoption in developing countries', PhD Thesis. Hair, J. F., Black, W.C., Babin, B.J. & Anderson, R.E. (2010) Multivariate data analysis, (7 ed.) Englewood Cliffs: Prentice Hall. Handler, D.P., Barbier, J. & Schottmiller (2012) SMB Public Cloud Adoption: Opening a Hidden Market, Cisco Internet Business Solutions Group. Herhalt, J. & Cochrane, K. (2012) Exploring the cloud A Global Study of Governments’ Adoption of Cloud, Klynveld Peat Marwick Goerdeler (KPMG), 1-46. Hutley, N. (2012) Modelling the economic impact of cloud computing, KPMG, 1-52. IDC (2015) Worldwide Cloud IT infrastructure market growth expected to accelerate to 21% in 2015, driven by public Cloud datacenter expansion, according to IDC, International Data Corporation, Available at: https://www.idc.com/getdoc.jsp?containerId=pr US25576415 [Accessed 13 December 2015]. IMO (2013) Privacy and Cloud Computing for Australian Government Agencies, Version 1.1', 1-10. 16 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption ITIIC (2011) Cloud Computing: Opportunities and Challenges, Department of Innovation Industry, Science and Reasearch, 1-31. ITA (2015) Cloud ComputingTop Markets Report, International Trade Administration, 1-38. Jamil, D. & Zaki, H. (2011) 'Security issues in Cloud computing and countermeasures', International Journal of Engineering Science and Technology (IJEST), 3(4): 2672-6. Jamwal, D., Sambyal, A. & Sambyal, G.S. (2011) "Cloud Computing: Its security & Privacy Aspects", International Journal of Latest Trends in Computing, 2(1): 25-28. Jansen, W. & Grance, T. (2011) Guidelines on security and privacy in public cloud computing, US Department of Commerce. Katzan, H. (2010) 'On the privacy of Cloud computing', International Journal of Management & Information Systems, 14(2): 1-12. Kauffman, R. J., Ma, D. & Yu, M. (2014) A Metrics Suite for Firm-Level Cloud Computing Adoption Readiness Economics of Grids, Clouds, Systems, and Services, Springer,19-35. Ko, R. K., Jagadpramana, P., Mowbray, M., Pearson, S., Kirchberg, M., Liang, Q. & Lee, B. S. (2011) TrustCloud: A framework for accountability and trust in cloud computing, In IEEE World Congress on Services (SERVICES), 584-588. Kshetri, N. (2013) 'Privacy and security issues in Cloud computing: The role of institutions and institutional evolution', Telecommunications Policy, 37(4): 372-86. Lawrence, M.W.L., Brad, D.C.C., Chris, C. & Denna, M. (2010) Cloud Computing Business Models for the Channel, A CompTI A Cloud/SaaS Community Resource, 1-12. Lee, J.N. & Kim, Y.G. (1999) "Effect of Partnership Quality on IS Outsourcing Success: Conceptual Framework and Empirical Validation." Journal of Management Information Systems, 15(4): 29-60. LEMT (2011) The potential for cloud computing services in Australia A Lateral Economics report to Macquarie Telecom, 1-45. Li, M., Zhao, D. & Yu, Y. (2015) 'TOE drivers for cloud transformation: direct or trust- mediated?', Asia Pacific Journal of Marketing and Logistics, 27(2): 226-48. Li, X., Hess, T.J. & Valacich, J.S. (2008) 'Why do we trust new technology? A study of initial trust formation with organizational information systems', Journal of Strategic Information Systems, 17(1): 39-71. Mahmood, Z. (2011) Data location and security issues in cloud computing. International Conference on Emerging Intelligent Data and Web Technologies (EIDWT), 49-54. Malhotra, N.K. (2010) Marketing research: An applied orientation, Pearson Upper Saddle River, NJ. Mark, D.R. (2011) Cloud computing privacy concerns on our doorstep, Communications of the ACM, 54(1): 36-38. Marston, S., Li, Z., Bandyopadhyay, S., Zhang, J. & Ghalsasi, A. (2011) "Cloud computing-The business perspective", Decision Support Systems, 51(1): 176-189. Matthew, L.J. (2014) National Broadband Network (NBN) 2014, Available at: http://www.aph.gov.au/About_Parliament/Parliamentary_Departments/Parliamentar y_Library/pubs/rp/BudgetReview201314/NBN [Accessed 2 December 2015]. McCabe, B. & Hancook, I. (2009) Cloud computing: Australian lessons and experiences, KPMG, 1-20. Miller, M. (2014) Cloud adoption in Australia, Available at: http://www.abc.net.au/technology/articles/2014/10/24/4113810.htm [Accessed 5 January 2015]. 17 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption Minifie, J. (2014) The silver lining: cloud computing and small and medium enterprises, Sydney, Australia. Misra, S.C. & Mondal, A. (2010) "Identification of a company’s suitability for the adoption of cloud computing and modelling its corresponding Return on Investment", Mathematical and Computer Modelling, 53(3): 504-521. Monika, S., Ashwani, M., Haresh, J., Anand, K., Madhvendra, M. & Vijayshri, T. (2010) "Scope of cloud computing for SMEs in India", Journal of Computing, 2(5): 144-149. Mudge, J.C. (2010) Cloud computing opportunities and challenges for Australia, ATSE, Melbourne, Victoria, 1-34. NBNCO (2015a) The Cloud – What’s all the fuss about, Available at: http://www.nbnco.com.au/blog/the-cloud-whats-all-the-fuss-about.html [Accessed 10 November 2015]. NBNCO (2015b) The Cloud: What can it do for Aussie businesses?, Available at: http://www.nbnco.com.au/blog/the-cloud-what-an-it-do-for-aussie-businesses.html [Accessed 16 November 2015]. Oliveira, T., Thomas, M. & Espadanal, M. (2014) "Assessing the determinants of cloud computing adoption: An analysis of the manufacturing and services sectors", Information & Management, 51(5): 497-510. Opala, O.J. (2012) An Analysis of Security, Cost-Effectiveness, and IT Compliance Factors Influencing Cloud Adotion by IT Managers, Available from ProQuest Dissertations and Theses. Pearson, S. (2009) "Taking account of privacy when designing cloud computing services", Workshop on Software Engineering Challenges of Cloud Computing (CLOUD'09), 44- 52. Pearson, S. (2012) Privacy, Security and Trust in Cloud Computing, 1-57. Pearson, S. & Benameur, A. (2010) Privacy, security and trust issues arising from cloud computing. Annual International Conference Cloud Computing Technology and Science (CloudCom), 693–702. Plummer, D.C., Smith, D.M., Bittman, T.J., Cearley, D.W., Cappuccio, D.J., Scott, D., Kumar, R. & Robertson, B. (2009) "Five refining attributes of public and private cloud computing", Gartner Research. Podsakoff, P.M., MacKenzie, S.B., Lee, J.Y. & Podsakoff, N.P. (2003) Common method biases in behavioral research: a critical review of the literature and recommended remedies. Journal of applied psychology, 88(5), 879-903. Ren, K., Wang, C. & Wang, Q. (2012) Security challenges for the public cloud. IEEE Internet Computing, 16(1): 69-73. Rittinghouse, J.W. & Ransome, J.F. (2009) Cloud computing: implementation, management, and security, CRC Press: New York, London. Robert, C.M. & Mira, K. (2010) Perception of Barriers to E-Commerce Adoption in SMEs in a Developed and Developing Country: A Comparison Between Australia and Indonesia, Journal of Electronic Commerce in Organizations, 8(1): 61-82. Ross, P.K. & Blumenstein, M. (2015) 'Cloud computing as a facilitator of SME entrepreneurship', Technology Analysis & Strategic Management, 27(1): 87-101. Safari, F., Safari, N. & Hasanzadeh, A. (2015) 'The adoption of software-as-a-service (SaaS): ranking the determinants', Journal of Enterprise Information Management, 28(3): 400-422. 18 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption Sahandi, R., Alkhalil, A. & Justice, O.M. (2012) "SMEs’ Perception of Cloud Computing: Potential and Security", Collaborative Networks in the Internet of Services, Springer, 186-195. Salleh, S.M., Teoh, S.Y. & Chan, C. (2012) "Cloud Enterprise Systems: A Review Of Literature And Its Adoption", PASIS 2012 Proceedings, 1-11. Sarwar, A. & Khan, M.N. (2013) 'A review of trust aspects in Cloud computing security', International Journal of Cloud Computing and Services Science (IJ-CLOSER), 2(2): 116-22. Sasikala, P. (2011) "Cloud Computing in Higher Education", International Journal of Cloud Applications and Computing, 1(2): 1-13. Schoorman, F.D., Mayer, R.C. & Davis, J.H. (2007) 'An integrative model of organizational trust: Past, present, and future', Academy of Management Review, 32(2): 344-54. Sen, J. (2013) Security and privacy issues in cloud computing. Architectures and Protocols for Secure Information Technology Infrastructures, 1-45. Senarathna, I., Warren, M., Yeoh, W. & Salzman, S. (2015) 'A Conceptual Model for Cloud Computing Adoption by SMEs in Australia', in Delivery and Adoption of Cloud Computing Services in Contemporary Organizations, IGI-Global, 100-128. Shaikh, F.B. & Haider, S. (2011) 'Security threats in cloud computing', in Internet technology and secured transactions (ICITST), 2011 International Conference, 214-219. Shimba, F. (2010) Cloud Computing: Strategies for Cloud Computing Adoption. Dissertation. Stieninger, M. & Nedbal, D. (2014) 'Diffusion and Acceptance of Cloud Computing in SMEs: Towards a Valence Model of Relevant Factors', in 47th Hawaii International Conference on System Sciences (HICSS 2014), 3307-3316. Straub, D.W. (1989) 'Validating instruments in MIS research', MIS Quarterly, 13(2): 147-69. Subashini, S. & Kavitha, V. (2011) 'A survey on security issues in service delivery models of cloud computing', Journal of Network and Computer Applications, 34(1): 1-11. Sullivan, D. (2010) The Definitive Guide to Cloud Computing, Realtime publishers, IBM. Sultan, N. (2010) "Cloud computing for education: A new dawn?", International Journal of Information Management, 30(2): 109-116. Sultan, N. A. (2011) "Reaching for the “cloud”: How SMEs can manage", International Journal of Information Management, 31(3): 272-278. SWI (2012) The Power Of Cloud Computing For Small Businesses. Software World, 43(3): 11- 12. Tancock, D., Pearson, S. & Charlesworth, A. (2013) 'A privacy impact assessment tool for Cloud computing', in Privacy and security for Cloud computing, Springer, 73-123. Tang, C. & Liu, J. (2015) 'Selecting a Trusted Cloud Service Provider for Your SaaS Program', Computers & Security, 50(1): 60-73. Tarmidi, M., Rasid, S.Z.A., Alrazi, B. & Roni, R.A. (2014) 'Cloud Computing Awareness and Adoption among Accounting Practitioners in Malaysia', Procedia-Social and Sciences, 164(1): 569-74. TCP (2015) Regional Australia postcode list, Available at: http://www.travellers.com.au/Default.aspx?TabId=505 [Accessed 25 December 2015]. Tehrani, S. R. & Shirazi, F. (2014) Factors Influencing the Adoption of Cloud Computing by Small and Medium Size Enterprises (SMEs) Human Interface and the Management of Information, Information and Knowledge in Applications and Services, Springer, 631- 642. 19 Australasian Journal of Information Systems Senarathna, Yeoh, Warren & Salzman 2016, Vol 20, Research Article Security & Privacy for SME Cloud Adoption Telstra (2011) Moving to Cloud: Key considerations for government. Telstra Report, 1-21. Vanessa, R. (2014) "A US-China comparative study of cloud computing adoption behavior: The role of consumer innovativeness, performance expectations and social influence", Journal of Entrepreneurship in Emerging Economies, 6(1): 53-71. Wijesiri, S. (2010) Cloud computing - a new wave in IT, Daily News. Xiao, Z. & Xiao, Y. (2013) 'Security and privacy in Cloud computing', Communications Surveys & Tutorials, IEEE, 15(2): 843-59. Xu, H. & Gupta, S. (2009) 'The effects of privacy concerns and personal innovativeness on potential and experienced customers' adoption of location-based services', Electronic Markets, 19(2): 137-49. Zissis, D. & Lekkas, D. (2012) 'Addressing cloud computing security issues', Future Generation Computer Systems, 28(3): 583-92. Zhang, Q., Cheng, L. & Boutaba, R. (2010) "Cloud computing: state-of-the-art and research challenges", Journal of Internet Services and Applications 1(1): 7-18. Zhao, F., Scheruhn, H.J. & Rosing, M. (2014) The Impact of Culture Differences on Cloud Computing Adoption Human-Computer Interaction. Applications and Services, Springer, 776-785. Copyright: © 2016 authors. This is an open-access article distributed under the terms of the Creative Commons Attribution-NonCommercial 3.0 Australia License, which permits non- commercial use, distribution, and reproduction in any medium, provided the original author and AJIS are credited. 20 http://creativecommons.org/licenses/by-nc/3.0/au/ 1 Introduction 2 Literature Review and Hypotheses 2.1 Cloud Computing 2.2 Cloud Computing Adoption in SMEs 2.3 Hypotheses Development 2.4 Cloud Privacy 2.5 Cloud Security 2.6 Metropolitan vs Regional 3 Methodology 3.1 Measurement Reliability and Validity 4 Results and Discussion 4.1 ADOPT (Intention to Adopt) 4.2 Cloud Security 4.3 Cloud Privacy 4.4 Contributions 4.5 Limitations and Future Research 5 Conclusion