## 5 Evaluation
### Qualitative Focus Group Discussions  
As part of the research methodology, focus group discussions were conducted. To be more precise, two focus group discussions were conducted to obtain higher reliability of statements [51]. The focus groups were conducted as described by [PERSON] et al. [54], and analyzed using the MAXQDA software [55]. A total of two focus group discussions were conducted, with seven and six people, respectively. The focus groups included two CEOs of software companies developing cloud applications, two software company team leaders, three scientific researchers, and six employees in cloud-based planning, developing, or testing services. Both focus groups emphasized that compliance is the central issue for practically adopting cloud applications. The focus groups confirmed that compliance issues primarily arise due to the adaptation of internal cloud applications or the sale of cloud applications to customers. The discussions reveal that technical solutions such as a configurable password policy, single sign-on, or multifactor authentication increase security and trust in the cloud application. However, when it comes to implementing service-level agreements by cloud providers (such as backup policy, geolocation of data storage, the configuration of a firewall, and intrusion-detection systems), it becomes essential to trust them. Due to their market position, bilateral agreements with service providers are often possible only to a limited extent. All participants confirmed that existing business processes for adapting compliance requirements have weak points. If disputes arise during the implementation of compliance requirements, the traceability of adjustments is often limited. Adjustments are typically discussed in emails or telephone meetings, and only recorded in notes. It is only possible to trace back exactly who made which decision and when to a limited extent. Consequently, changes can often only be implemented with delays, and are associated with consulting costs. Thus, both focus groups agreed on the need for additional transparency, traceability, and automation requirements in existing business processes. After discussing the current business state, the developed architecture prototype was presented as a demo. Subsequently, all focus group participants were provided with access to the prototype. The participants were thus able to test the prototype. In summary, the following can be noted from the focus group evaluations of the prototype. First, the participants agreed that they had not seen the presented approach before. Based on the literature review and the quantitative analysis, the approach presented is a new development that does not yet exist in this form. Overall, the experts also confirmed that the proposed prototype and its underlying business process and architecture could support the adoption of cloud services. However, the experts also agreed that the solution presented could mainly be used by small and medium-sized enterprises (SMEs), as introducing the proposed architecture might be very complex and resource-intensive in a large-enterprise environment. Furthermore, the experts see the presented approach primarily in the software-as-a-service area. They considered it as unlikely that the architecture would be used in the private sector. In particular, the architecture would mainly be used to implement and realize compliance requirements. Experts considered this use case to be unlikely in the private environment. The experts also stated that the prototype would still require some development before being used in the production environment. In particular, the participants considered implementation on the Hyperledger Fabric [31] platform to be the next important step. In summary, qualitative methods were used to show that the presented software solution solves the problem described. The experts evaluated the presented approach as being successful for the described problem. Based on the work of [PERSON] et al.