What we need to know before entering into a contract
for Cloud Computing Services.
Already some companies and
government agencies have adopted cloud computing technologies for
business processes. There have been many news reports over the last few
years talking about Cloud Computing as well as successes some
organizations are having and reservations or delays that others are
experiencing. Before your company decides to trust critical business
processes to this not-very-new technology, and asks procurement to issue
a service contract, there are a few things I think you should consider.
Cloud computing is a new
name for an old internet service concept. Remember the terminology
“Application Service Provider” in which a business contracts for
web-based software services? Have you done online banking or logged in
to Amazon to order books? If so, you have “been in the clouds” and
that’s about all it really means. Think of cloud computing as a vendor
offering to outsource one or more aspects of a business data process.
Examples of cloud computing include Web-based e-mail applications and
common business applications that are accessed online through a browser,
instead of through a local computer.
These can be very valuable
services to a business. Considering the cost of investing in capital
equipment, software, maintenance, technical support, buying a ready-made
online service can be a considerable short-term cost savings. In
addition, the time to purchase and set up a network environment vs,
signing a contract today and starting use tomorrow can be critical to a
time-sensitive business process.
For example: Assume your company has a
major accident or product recall. The CEO might want to set up a
network for people to log in and submit claims, reports, pictures,
request data, etc. This could be hundreds or thousands of people
from all over the world. And the CEO wants to turn it on today.
Would you realistically have time to buy the equipment, obtain the
technical resources and implement? Wouldn’t it be easier to call a
service provider and write a notice to proceed? Obviously! The
Department of Commerce had exactly this same issue when they were
directed to implement the “cash for clunkers” program in less than a
Here are some other
examples of services which fall under the “cloud” umbrella.
Online shared application = Google Gmail.
Users log in to vendor owned system and use the vendor’s software to
perform business functions. Vendor is responsible for the software
and what it does, buyer just contracts for the service. A business
startup doesn’t need to set up an email server, they can just
contract with Google to provide email accounts using the new
company’s business name instead of the Google “G”mail. Google
already has the servers, the technical staff, the user security,
etc. Adding your company name to the email accounts is not a big
Online user-controlled application = Web
site, hosted on web server. Buyer uploads and manages content which
is running on the contractor-owned hardware and software. Consider
setting up an online store for your business or organization. For a
fee, the vendor provides the internet hosted computer – and we would
set up, upload and maintain the catalog of products to sell. This
could be on vendor provided software or purchased software that is
also uploaded to the web server.
Online data center = Buyer rents hardware
rack space from the vendors and installs and operates the complete
system. Vendor is responsible for the data center, hardware, and
maintenance of the facility (electricity, cooling, disaster
At the extreme end, we could literally
outsource our complete IT operation, user help desk and even include
leased desktop computers or laptops.
This is an interesting example. This NASA
vendor provided and operates a complete mobile data center housed in
a shipping container. How cool is that! When a NASA scientist wants
more computing power, just plug it in.
Regardless of what we call
it, using online data and computing service can include a number of
hidden risks along with the potential benefits. Writing a contract to
obtain those services and outsource a company’s data processing is a
complex task. Pricing structure notwithstanding, there are many other
issues that should be considered for negotiation and inclusion in the
contract terms. We discussed some of these issues several years ago when
migration to e-commerce and e-marketplaces was a hot topic (both could
be considered forms of cloud computing). Many of the risks that need to
be addressed in our contracts are the same. http://www.mltweb.com/ec/eccheck.htm
Here are some common
threads to consider:
User control, access and training: Who will
respond to user questions or problems. Will the response to
questions be timely? How can a user access be terminated (with
prejudice) in a hurry?
Data security, data ownership, backup: Are
security systems in place and are they adequate to protect your
sensitive corporate information? Are the databases backup up? What
is the process to restore data that is accidentally erased? Who owns
the data on the vendor computers? Is the vendor obligated to erase
the data when the contract is terminated? Are there penalties for
disclosure or loss?
Functionality: Are there up-time
guarantees? What is the restore time if the system goes down? Will
software and operating systems be automatically updated to new
versions and will there be a cost to do so? Who is responsible to
maintain legal licenses to use the software?
Data archiving: Is there a plan to archive
data in away that meets legal document retention requirements? Can
records be retrieved? If legal discovery notice is received, will
the data be subject to search and seizure?
Can the service be terminated for any
reason? Can your data be downloaded to transfer to a competitor’s
Obviously cloud computing
services are already in use by many companies. As the applications and
processes become powerful, cost and time pressure to use shared
applications and online computing will become significant. It will
become a contracting opportunity for many of us in one way or another.
Still don’t believe it’s
becoming the next hot business strategy? Take a look at this web site
Cloud Computing Journal
Before writing a contract,
ask questions of all the various vendors. It’s a great way to gather
information; as the salesmen all try to convince you that their
solutions is better, they’ll give you hints about weaknesses to address
in the specification. I’d suggest doing some reading about cloud
computing services, and making some notes specific to your company and
possible issues. Then you’ll be ready to add value when the CEO wants to
jump on the band wagon.
Here is an objective
review of Cloud Computing processes and alternatives by the GAO. The
second report is an assessment of government agencies problems and
issues in implementing cloud computing services. I highly recommend
reading them if you want to get some background and starting thinking
about future involvement.
One of the benefits [?]
being promoted about Office 2010 is the enhanced ability to shared data
online. An executive in your company is probably already thinking about
using this capability. It’s just another form of cloud computing. You
read more about Office 2010 online collaboration and start
formulating questions or concerns.
And of course
use the power of Google to find thousands of news articles, vendors
Good luck in your