CIO Talk Radio Blog

In my previous post I shared my experience negotiating Demand Pricing and Data Ownership concepts as part of contracting with a cloud provider. Today I’ll tackle what I consider one of the most difficult components of a cloud contract, Security. I’m hoping others will share their experience in this area, because I don’t believe anyone has the final answer for how to negotiate these complicated concepts, especially when one considers the myriad of types of cloud providers and services offered.

Recently a family member experienced a very tragic event when their house burnt down.  They only had a minute to get out of the house before it was completely engulfed in flames.  Luckily everyone escaped without harm, but they lost everything they ever had.  Furniture, clothing and other household items are easily replaceable, but personal items are not.  Photos, keepsakes, and of course the data on computes hard disks are irreplaceable!

At every conference or gathering of IT executives, the topic of contracting with Cloud vendors is brought up.  It’s fairly obvious after listening to the conversations that there is little ‘real’ experience negotiating solid cloud contracts that protect our interests, but there is collective angst over contract areas like service level agreements, security, data protection, data ownership, insurance, liability, and many other topics.  I think it’s important IT professionals share their best practices from negotiating cloud contracts, so that we can all improve the overall cloud industry by ensuring the vendors are delivering solutions with contractual terms that will allow all of us to embrace the cloud for servicing our customers. Therefore, to start the sharing activity, I’ll share my experience on two contract areas.

Almost everywhere you look there is an article, interview, product release, or discussion on Cloud Computing.  It seems to be the cool thing to do these days.  The discussions are usually focused around benefits such as cost savings and simplicity of the service as compared with doing it in house.  However, while I often see security discussed, I almost never see the real show-stopper mentioned.  The lack of any real service level is a huge and important issue, and is largely ignored.

Collective intelligence enables us to access and organize unprecedented amounts of information and thereby enlarge the universe of possible solutions. Companies have sought to gather information efficiently from all manner of sources to make decisions from almost the beginning of commercial history, but there have always been forces of entropy. The systems for data collection remain in place, but the company is in fact no longer open to fresh ideas, and it becomes a collapsing world of dwindling options and antiquated approaches. The new technologies of collective intelligence, however, represent countervailing forces. Information sharing and collaboration are ceasing to exist as mere options. They are instead competitive necessities. Many companies that have not begun thinking long and hard about cloud and crowd systems and how they can be strategically integrated into extant architectures are doomed. They will not be able to compete with those who have achieved unparalleled reach and efficiency in their information-gathering, access and storage processes. Undreamed of sources for wise counsel will multiply dramatically the availability of solutions.