According to The Economist, "the cloud will transform the information technology industry…profoundly change the way people work and companies operate". Microsoft refers to "a wave of innovation" that has been powered by the cloud.

But first, what is cloud computing? Cloud computing is a special form of outsourcing, in which parts of the IT environment are rented as a service, instead of being operated by the company itself. Cloud computing is a buzzword.  "The concept, quite simply, is that vast computing resources will reside somewhere up there in the ether (rather than in your computer room) and you will connect to them and use them as needed".  (The Times online).

Cloud computing, at the broadest level, therefore, is the provision of computing as a service over a network, typically over the Internet. The term "cloud" refers to the Internet because of the practice of drawing a cloud shape to depict the Internet in computer network diagrams.  Networks were cumbersome to draw so engineers represented them as clouds and, in time, the cloud shape was adopted as a symbol for all networks, including the Internet.

Cloud computing services

Almost any IT resource can now be delivered as a cloud service.  The main types of service are Software as a Service, Platform as a Service and Infrastructure as a Service.

  • Software as a Service (SaaS) – Programs are no longer purchased through licenses.  Instead, software is provided over a network.
  • Infrastructure as a Service (IAAS) – Instead of setting up their own IT infrastructure (computers, networks, storage devices), companies rent them from a provider as required.
  • Platform as a Service (PaaS) – The cloud provides a computing platform on which the user can develop and execute its own applications.

Cloud computing is offered through public clouds, private clouds, hybrid clouds and managed clouds.

  • Public Clouds - are intended to be used by multiple parties at once and are designed to provide maximum value for money.  The resources are provided on a shared, self service, "pay as you go" basis. 
  • Private Clouds - are intended to be restricted to a single customer.  These are popular amongst organisations looking to access the benefits of cloud computing, but who wish to retain higher control and flexibility compared to a public cloud. 
  • Private clouds - can be run inside a company data centre or they can be hosted by a third party Private clouds are an ideal solution where data sovereignty is a key issue.
  • Hybrid Clouds - a combination of public and private clouds, hybrid clouds allow users to protect their most highly sensitive information on a private cloud and to reap greater costs savings for less critical data on a public cloud.
  • Managed Clouds - these clouds are managed by a third party provider, like a private cloud, but are owned by the customer.  Managed clouds are similar to a hosted IT arrangement.

Benefits of cloud computing

Cloud computing is becoming increasingly attractive, primarily due to:

  • The potential cost savings;
  • It allows data to be portable and instantly accessible; and
  • The cloud is elastic:  Cloud users pay for the capacity they use, which can be adjusted to fluctuations in resource demands.

The movement to the cloud is expected to be significant in terms of the numbers of companies using the cloud and the anticipated growth of the global cloud market. 

  • Global cloud market is expected to grow to £77 billion by 2015 from £24 billion in 2011.
  • By 2015 75 per cent of companies are expected to be using cloud services in one form or another.
  • By 2015 at least 30 per cent of Fortune 1000 enterprises will deploy at least one business critical system in the cloud.

Storm clouds

So it all sounds very good.  But it is here that the storm clouds gather, as things can, and do, go wrong on the cloud; and this is why insurance is expected to be integral to the use and growth of the cloud. 

A number of possible things can go wrong on the cloud:

  • Loss of service as a result of a cloud outage. There have been a number of recent high profile cloud outages which have taken down the websites of a number of companies who use such cloud providers, with the effect that they are unable to access their data or trade on line.  Most service level agreements with cloud providers usually only compensate customers for the service value of the outage time, and not for any value related to lost business.
  • The data is lost in a cloud and disaster recovery is inadequate.  A recent survey in the United States found that 15 per cent of data centres do not have data back up and recovery plans and 30 per cent did not have back up sites.
  • The cloud is hacked into and data stolen.
  • There is a dispute with the cloud provider and the data becomes "locked in" in the cloud.
  • Many cloud service agreements provide that the data is owned once it "lives in" the cloud, which can lead to all sorts of problems if a cloud user decides it wants to switch its cloud provider.
  • Your cloud goes down permanently.  This could be because of the insolvency of the cloud service provider.

Insurance- a silver lining?

Most companies would agree that data or information is one of their most important assets.  Yet some might not realise that a standard property policy might not respond to a loss at cloud level.  Let’s take an example.  As a result of a cloud outage a company is unable to access its data or use software in the cloud.  This impairs or prevents the company from operating, causing it to lose income.  Can a company claim under its traditional property and business interruption policy?  It is unlikely that there has been property damage, as simply because data cannot be accessed does not mean it is damaged.  Some courts have also expressed the view that data is not property susceptible to damage.  Property damage they say requires injury to tangible property.  Can the company claim its PI losses?  Probably not, as such cover is typically restricted to cover loss of income as a result of "damage to property at the insured’s premises".  The “cloud” would ordinarily not be located at the Insured’s premises.

It is worth noting that even if one can bring the loss within the terms of the policy, many policies exclude computer or data related losses, have very low limits of cover or are subject to time deductibles.  The average cloud outage is about seven hours, so many standard types of policies might be of little value to a cloud user whose business has been struck by a cloud outage.

Even a cyber insurance policy might not be adequate to deal with losses that occur at cloud level.  Some commentators say that if the cyber policy does not specifically mention cloud based data and services, then losses arising from the cloud might not be covered.  Additionally, many cyber policies refer to a "computer network", which might, depending on the definition of computer network, not include cloud based services.

Cloud specific insurance

In view of the special nature of cloud computing, insurers are developing bespoke cloud computing products for cloud providers and cloud users.

Cloud providers have historically disclaimed all liability for losses.  However, as the cloud provider market is maturing and there are calls for this industry to be regulated, it is anticipated that cloud providers will not be able to disclaim all accountability.  It appears that the insurance market is already recognising these changes in the form of specific cloud provider policies and bespoke products are being offered which provide:

  • Cover against liability claims for outages and data loss.
  • Cover for the costs of dealing with an outage (technical issues, back up and data restoration).
  • Cover for the costs of dealing with a security breach or being hacked into.
  • Cover for damage to the cloud’s infrastructure.

Similarly, insurers are developing specific insurance cover for cloud users.  The cover given on these policies continues to evolve and is extending beyond simply providing cover for data outages. The types of bespoke products that are emerging include cover for:

  • Loss of income caused by outages.
  • Losses incurred as a result of leakage or a security breach of sensitive commercial information.
  • Costs incurred procuring services from a new provider e.g. cloud provider goes insolvent.
  • Costs incurred as a result of data breaches.
  • Costs incurred to recover data.

Conclusion

The cloud has become an everyday resource.  Cloud computing will continue to rapidly evolve, creating new capabilities and new opportunities.  Those new capabilities and opportunities will present new challenges for the insurance market to create policies that respond to the rapid pace of the cloud’s development.