The potential commercial benefits of cloud computing such as infrastructure cost savings and flexibility will be at the forefront when looking at moving to a cloud service. But there are also potential issues with this type of IT service delivery that need to be considered. Some things to bear in mind include:
- Can I get my data back? Do you have a right to get a copy of your data back on exit and an obligation on the provider to provide disengagement services? In what format will data be provided to you and will it be useable? As one commentator said, cloud computing can be a bit like the Hotel California - you can check out any time you like but in reality you may never be able to leave!
What level of service will I get? As in any contract, your cloud computing contract needs to be clear about the nature of the service to be provided. For example:
- What level of service availability is the service provider committing to (if any)?
- What are the functions and performance capabilities of the software (if the cloud offering is software as a service) and what level of support services will be provided?
- Does the service provider offer service credits if it fails to comply with key performance obligations under the contract?
- Where is my data? Cloud computing services involve processing and storage of masses of data that is often commercially sensitive, confidential or "personal information". Unlike a server you own in your office or housed at a hosting provider's data centre, data in the cloud could end up anywhere in the world. Do you have any control in the contract over where and by whom the data is stored? You also need to know and be assured in the contract that your data will be held securely. Is the provider entitled to access it? Is it secure against hacking?
To address these types of issues at a New Zealand industry level the New Zealand Computer Society is overseeing the development by the industry of a voluntary Code of Practice for Cloud Computing. The draft Terms of Reference, which will set out the process to develop the Code of Practice can be found here.