Cloud Compliance Meeting

12th July

Cloud services and platforms have been employed within business for some time, particularly within the outsourcing sector. With many companies feeling the pinch of the economic downturn, the cloud is becoming increasingly attractive for businesses looking for cost-savings.

This seminar continued on from a series of NOA cloud focused seminars which seek to identify best practices and address concerns and questions regarding the technology. This cloud special interest seminar was chaired by Andy Rogers, NOA Board Member, and Natalie Donovan, IT professional support lawyer at Slaughter and May, and focused on the importance of compliance in cloud contracts.

The Cloud Compliance Meeting began with a detailing of the expansion of cloud services within the business market by Dr Bharat Vagadia, NOA Board Director. The prominence of cloud services in big business has been apparent over the last couple of years, however the deployment of the cloud is now being seen in other areas. A recent Microsoft survey, (SME Cloud Adoption Study 2011) of 3000 SMEs in 16 countries showed that nearly 40 percent of SME’s are now buying cloud services. This is an increase of a third from 2010, while a 2012 IBM study recorded that two thirds of businesses have or intend to implement cloud services.

The IBM study highlighted the need for agility in cloud deployment and predicted that in three years, 1 trillion cloud-ready devices would exist, allowing for increased mobility.

The Microsoft SME survey predicted that cloud adoption by SMEs will nearly double over the next three years. The survey also identified that the larger the business, the more likely it was to adopt cloud services.

The meeting looked at recent developments in cloud technology including an increased focus on scalability, which goes against the past trend of providers offering one-size-fits all approach to delivering cloud service packages.

The survey also looked at the practical concerns surrounding the cloud and the additional infrastructure that is required. 82 percent of surveyed cloud users said that it would be ‘critical’ to have local support cloud services.

The meeting covered the main reasons for cloud adoption with cost and flexibility ranking as the most prevalent reasons for employing cloud services. Standardisation of service was also identified as a key caveat in attracting SMEs to employing cloud services despite the growing demand for scalability within the service.

The meeting addressed key concerns, including the scale of impact disruption of internet services could have on the use of cloud and how precautions and safeguards could be established to diminish such risk. Future trends were also addressed by the special interest group and identified mobile applications and simplification of software as key areas of development for cloud services.

Natalie Donovan, Slaughter and May, detailed the risks associated with cloud services. Natalie described how cloud services and platforms represent a relatively new market, and as such new models exist, in regard to creating standardised contracts. Natalie described how: “At this stage early procurement is far away from being fully optimised.” Most current contracts are first generation. The relative immaturity of the cloud market is reflected in the basic nature of the current common contracts that are being employed. The attractions for using basic contracts were explained, with the ability to implement a speedy procurement ranking highly.

The meeting identified that a new legal approach was needed when looking at cloud compliance. In her presentation Natalie demonstrated the need to focus on the key issues while employing the correct contract base. A new legal contract approach should be carried out alongside a new procurement approach which should provide tending based on user reviews.

Quality of service, changes of service and security remain the major issues in employing cloud services and in standardising cloud contracts.

The meeting covered the termination of cloud services and the best practice in regard to exit strategies. Natalie spoke on the importance of exit assistance and the need for suspension and termination clauses built into the contract.

Data regulation was also identified as an area of importance with the need to understand the laws surrounding data privacy in cloud services. A new cloud approach should be undertaken which focuses on securing the key issues, such as security while trying to avoid the undermining of commercial benefits, such as agility.

At this early stage in cloud service employment, uses are wary of uploading data to the platform because of the perceived security risks involved.

While risk was identified as not being inherently negative, efforts should be made to find the right level of risk based on the circumstances.

The meeting closed with a roundtable discussion on who has the most insight into IT services, whether SMEs or big businesses. The meeting identified that SMEs and big businesses have different requirements in regard to cloud services, and that the SME cloud market is rapidly opening up to the employment of cloud technology, however contracts, understanding of the service and compliance still need to develop.

Please visit www.NOA.co.uk for the full set of slides from this event.