Launch of “Code of Practice” by Cloud Industry Forum

10 years ago I started using what is now termed a cloud system. This was to sell, amongst other things, tickets for 30 events in the Internet Business Forum series that I organised and chaired.

At these events, we looked at how the internet could be used for business purposes. A wide variety of applications (apps) and facilities were appearing, leveraging the rapid improvements that had just been made in datacomms speeds with the availability of "broadband".

Given the cost, remote access and other benefits of cloud computing, it might have been predicted that cloud services would have become the norm by now. But they haven’t. Why?

Internet Access Speeds

Back then, internet access by larger organisations was already well established, using dedicated datacomms lines. The advent of “broadband” had made internet access by consumers, homeworkers, satellite premises and smaller businesses practical and affordable. Access speeds have since improved, which has tended to overcome “world wide wait” that is due in part to the shared (“contented”) nature of both consumer and the better business broadband offerings.

“Mobile broadband” appeared with 3G services running only slightly slower than fixed line broadband. Speeds too have improved dramatically with the introduction of newer 3G technologies, comparable with many people's fixed line broadband, but still slower than the best fixed line options. Nonetheless these are fast enough to run a whole range of apps now becoming available on the latest smartphones.

In many places, the availability of broadband based on BT’s infrastructure, Virgin’s cable network and 3G services means it is now possible to have at least two alternative means of fast internet access at each location. As this is essential for business reliance, business use has recently become more practical.

The problem remains that some rural areas either have slower offerings or are without some or all of these services. Even so, the vast majority of businesses do have at least two forms of adequately fast internet at all key locations. 

So businesses are now poised to take much more advantage of cloud computing in 2011. But will they?

Trust and Other Concerns

Smaller businesses and apps like CRM (customer relationship management) have become very popular. This is because the benefits vastly outweigh any concerns, especially when the users are not aware of the pitfalls and risks.

Larger businesses take a more balanced view, and have often remained unconvinced for anything that can be regarded as business critical. Concerns about security of operation, reliability of operations, capability and processes, transparency of vendor identity and financial strength, and service level reporting need to be addressed by cloud service providers. The delegates at the recent ICAEW seminar placed “loss of control” as the number one concern after all the talks and discussions.

It all actually comes down to one thing - can the provider be trusted? Whilst many in-house systems do not have adequate backup and disaster recovery arrangements, over which cloud computing should be a distinct improvement, many systems in larger businesses do. Is the provider providing adequate facilities for access control, backup and resilience? How well are they going to sustain them? And there’s a whole host of other questions.

The cloud is effectively “outsourcing for all”. Traditional outsourcing involves the customer and provider in detailed talks, up-front audits and negotiated service agreements that are closely monitored. Conversely many cloud services are bought off the page on a “take it or leave it” basis, or otherwise via a reseller of some kind. What does a buyer need to know before committing to a provider?

Overcoming These Concerns - the Launch of the "Code of Practice"

In the absence of any existing standards for cloud computing, the Cloud Industry Forum has been formed to champion the use of cloud services. This is initially by defining the type of information that providers ought to disclose to potential buyers in a Code of Practice. Advice for providers on best practice within each category will also develop, as will best practice of what end-users need to do in addition.

The Code was officially launched yesterday, Monday 22 November. Providers can now download the Assessment Pack and register to certify they are complying with the Code. This is either on a self-certified basis, subject to audit, or certified by an independent body. Two different styles of logo can then be displayed by the provider on their website and other materials.

The Code of Practice is in three main parts:

A)   TRANSPARENCY

• A1: Information for Public Disclosure on website, such as identity, company details and any existing certifications such as ISO9001
• A2: Information for Disclosure in connection with Proposals/Contracts, possibly under non-disclosure agreement, such as security and continuity provisions, and what happens on renewal and termination

B)   CAPABILITY
Availability of auditable documented management systems, similar to ISO9001, for aspects such as Information Security Management and Service Continuity Management

C)   ACCOUNTABILITY

• C1: Agreement to CIF withdrawing Certification if appropriate, subject to a defined process
• C2: Procedures for complaint resolution, internally and via arbitration

A reasonable number of providers have already committed to becoming certified. Over the next few weeks we should see these names appearing in a certified list.

This should certainly make it easier for buyers to assess providers. It should also drive up standards across the industry, especially for the use of business-critical apps.

In support of these aims, I have agreed to join the 12-person Governance Board for the Cloud Industry Forum. I look forward to helping to develop the Code and accompanying best practice.

The combination of improved datacomms with improved provider offerings should then unlock the benefits of cloud computing for organisations large and small, across a wider range of apps.

.

Cloud Computing – Is the Big Issue “Control” or “Trust”?

What is the big issue in using cloud computing? “Control” or “Trust”?

At the ICAEW IT Faculty’s seminar on Cloud Computing last Friday, several questions were voted on at the end by the delegates. Having listened to various presentations, their main concern about using cloud computing was “loss of control”.

The industry itself, through the “Cloud Industry Forum” (CIF) is launching a Code of Practice on 18th October. This seeks to provide advice to buyers so they can make an informed choice on what they call “Cloud Service Providers”. This includes certification of specific providers against agreed criteria and information. CIF says it’s about “trust”.

Trust and control go hand in hand. If you cannot control the systems directly, who can you trust to do it?

One of the speakers at the ICAEW seminar usefully compared traditional outsourcing with SaaS Cloud (Software as A Service). There are several similarities, such as buying in specialist expertise. and moving from up-front capital to monthly expense.

But there are also substantial differences. The key one is that outsourcing agreements are typically negotiated one-to-one, whereas most SaaS services only offer standard terms. Take it or leave it.

So if you are going to outsource running any of your business applications (apps) to a SaaS cloud provider, especially business-critical apps, who are you going to choose? Who are you going to trust?

As I’ve said before I am “positive but cautious” about using SaaS cloud, and therefore about recommending clients to do so. There are substantial benefits possible, such as remote access worldwide, improved disaster recovery and typically lower costs. But there are some key risks and pitfalls that need to be managed by the provider and/or user.

My discussions with leading members of the cloud provider community have concluded that, in general, industry “best practice” is not yet good enough for business-critical apps such as accounting and ERP. There are however some providers with first rate offerings.

The CIF initiative is effectively a good first step in defining “best practice” for the industry. The Code of Practice  is asking providers to set out aspects such as how they provide “Provisions for Service Continuity”, the exit paths available, and the level of liability insurance carried. It also asks for background information about the provider.

Let’s see how this develops. In particular let’s see whether it adequately defines “best practice” and engenders trust. Then let’s see whether more people are prepared to cede control and grasp the benefits of the cloud.