Cloud Computing is set to redefine and take over the IT landscape and profoundly change the way companies around the world do business.
Cloud Computing is the delivery of computing resources as a service via the Internet. It is a special form of outsourcing in which parts of the IT environment are rented as a service. So rather than maintaining and controlling their data and computer resources on site businesses are increasingly relying on third parties to provide and maintain their IT resources.
The main types of Cloud Computing Services are:
- Infrastructure as a Service (IaaS). The provision of access to computer infrastructure over the Internet.
- Software as a Service (SaaS).Provision of software by a Cloud Provider remotely through the Internet rather than being installed onto a server.
- Platform as a Service (PaaS). The provision of computing platforms over the Internet on which the user can develop and execute its own software applications.
Businesses are rapidly adopting the Cloud. In 2015 the global Cloud market is expected to grow to £77 billion up from £24 billion in 2011. 78% of UK organisations have formally adopted at least one Cloud–based service.
There are five key benefits which explain why businesses are rapidly moving their IT resources to the Cloud.
- The Cloud is “elastic”. Cloud users only pay for the capacity they use.
- With Cloud computing businesses do not have to outlay capital on hardware or software and upgrades.
- The Cloud eliminates the physical presence of on-site servers.
- The Cloud permits data to be portable and instantly accessible.
- The Cloud permits the use of “big data”.
But along with any great innovation comes potential risk as things can go wrong in the Cloud. The main risks are Cloud attacks, Cloud outages and loss of data in the Cloud. The Cloud is an attractive cyber-attack target because data is most often stored for many different users on the same system. A single DOS attack on a particular Cloud can cause financial losses for a multitude of Cloud users whose business operations depend on that Cloud. Cloud outages can also have an impact on business operations as most Cloud Service Level Agreements usually only compensate the Cloud user for the subscription service value of the outage time and not for any value relating to lost business. The loss of access to critical sales data held in the Cloud can also impact on the business continuity of the Cloud user, as most Cloud providers disclaim liability for financial losses.
With businesses rapidly adopting the Cloud and with Cloud Providers disclaiming liability for financial loss the question arises who pays when the Cloud breaks?
Whilst bespoke Cloud computing covers are available many Cloud users might not have such cover in place, and will turn to their existing insurance policies to cover BI in the Cloud.
The problem with BI cover is that it is typically restricted to cover loss of income as a result of “damage to property at the insured’s premises”. The Cloud would ordinarily not be located at the insured’s premises. A claim based on the inability to access Cloud services might arguably fit more naturally as a CBI claim. But two main issues arise for triggering CBI in the Cloud context: first, could a Cloud be “dependent” property”? Second, whether the loss of data held in the Cloud satisfies the meaning of “physical loss or damage”?
Where dependent property is not specifically defined it might be arguable that the Cloud is a dependent property. Let’s take a simple definition of dependent property as “property operated by others whom you depend on to deliver materials or services to you or accept your products or services, or manufacture products for delivery to your customers.” Let’s now apply that definition to the main types of Cloud Computing services:
- It is the server farms owned by Cloud providers that delivers software services to the Cloud user. (SaaS)
- It is the server farm that that accepts storage of data sent to the Cloud. (IaaS)
- It is the server farm that provides a platform that is used by the Cloud user to develop software applications sold to customers. (PaaS)
What emerges is that the Cloud might satisfy the general definition of dependent property as an unspecified supplier or processor of services upon whom the insured depends.
Now to the second issue. It might be argued that damage to software or data does not constitute physical loss. Such an argument relies on the contention that data or software is not tangible or physical and cannot cause physical loss. But whilst there might be some initial appeal to this argument there is a growing body of case law in the US which has dealt with this question. The US courts are increasingly finding that loss of or corruption of data is “physical loss or damage”. Many of these cases have made their findings based on a forensic approach to how data is damaged, which makes their findings all the more compelling. Some courts have even gone further and held that “physical damage” is not restricted to the physical destruction or harm of computer circuitry but includes the loss of access, loss of use, and loss of functionality (even on temporary basis); all of which are relevant to issues that might arise in Cloud computing.
Thus, subject to all other policy terms and conditions CBI might be a source of cover for BI losses that occur in the Cloud. We can expect that many insurers in the UK will increasingly look to exclude cover. Some US insurers have excluded cover where the only damage to dependent property is to electronic data or software. Others have gone further and expressly excluded financial losses arising from Cloud Computing services.
With the growing use and expected growth of the Cloud many businesses might actually seek to have the Cloud they use specifically named as a dependent property or they will seek bespoke cloud computing covers for amongst other risks BI in the Cloud.
Whilst Cloud Computing creates new capabilities and opportunities it does have risks, and insurers should not underestimate their potential exposure to BI losses that can occur in the Cloud. At the same time, the risk of BI in the Cloud presents insurers with opportunities to grow the Cloud Insurance market and also to develop unique insurance products. The Cloud will be increasingly determinative of a company’s business continuity. And insurance will be increasingly important to a company’s business continuity when the Cloud Breaks.
This article was originally published by Insurance Day on 29 July 2015.