The real benefits of the cloud

This brings us to the nub of the matter: the real benefits of cloud computing come not from using it in isolation, but from combining it with other pieces of the digital transformation puzzle such as analytics, mobile workforce solutions and social media.

Once you put the pieces together you start to realise the full implications of the cloud. Extrapolating to the future, the scale benefits of the cloud mean it will ultimately make no sense for organisations to have their own IT infrastructure unless they’re very big indeed. A good analogy is the evolution of electricity: just as power from the grid means it’s no longer necessary for each factory to have its own generation facility, the cloud now makes computing services available universally.

What this ultimately means is that organisations can dynamically reconfigure their value chain to make it more agile, transforming the way they deliver value. You look at what value you provide and how you provide it, and then ‘plug and play’ the required software, services and infrastructure from cloud-based providers. If you don’t like a particular provider, you can switch them out with a different provider without having ‘stranded’ infrastructure assets or people.

The implications are huge, but the changes require a different mindset. Instead of thinking that you have to own or control your own supply chain, you have to start thinking in terms of an ecosystem that delivers value, and configure your supply chain accordingly using the most appropriate specialists in each area. Success in the world of digital business is going to be much more about managing information and getting the most out of it without actually owning or controlling the physical supply chain. The winners will be the organisations that have the clearest view of their end-to-end value chain and make the most effective use of this information, rather than necessarily those that have physical control.

What about the risks?

The upside of the cloud is immense. But what about the downside? Ironically, perhaps, many of people’s most pressing concerns about cloud computing – crucial issues such as data sovereignty, privacy and security – are already well understood, and good advice is available. International bodies such as the Cloud Security Alliance (see box) have been in existence for a number of years already, and have done a good job of clarifying best practices and issuing guidance on how to manage the cloud and the risks it entails.

Naturally, organisations entering the cloud have to work through the regulatory requirements as well – but again, these are well understood and guidance is available. For example, the Federal Data Protection and Information Commissioner (FDPIC; see box) has issued a guide to cloud computing from the standpoint of Swiss data privacy.

What many newcomers to the cloud tend to underestimate, however, is a whole range of less well understood risks.

Many of these are contractual in nature. A key question to ask is whether there’s any scope to negotiate the terms and conditions of your contract. If you’re dealing with a large cloud provider, you might not have any scope at all. For example, you might want to agree guaranteed service levels. If you can’t, where does that leave you in the event of an outage if the contract doesn’t provide for any remedies? Termination arrangements might also be difficult. What do you do if something happens to your cloud provider, they terminate at short notice, and you no longer have access to your data or have too little time to move it to a new provider? This is one aspect of a bigger risk that often gets overlooked: the long-term viability of your cloud provider. Small providers (and large ones) can go out of business, and it can be difficult to recover your data if your provider goes down or is taken over.

Another potential pitfall is e-discovery. In the event of legal issues, you might not have the right to access data – or have the right for only a limited time – for e-discovery. It’s crucial to look at your data retention and archiving requirements and consider how they’re met by your cloud provider. If you’re required to keep data for seven years and your provider only keeps it for one, you have a problem.

Another risk is a failure to get an adequate picture of the costs. Often, when initially assessing a cloud computing business case, organisations forget to consider or underestimate the expense involved in data obfuscation: the range of technologies, including encryption and tokenisation, designed to hide data or otherwise protect it from prying eyes. This can be a costly process, so it’s important to have a realistic idea of what’s involved.

The cloud can also entail tax risks, with different implications depending on where the service is provided from, that also have to be monitored. But the flipside is the potential tax opportunities: the cloud can make it possible to move parts of your supply chain to more tax-advantageous jurisdictions. For example, an organisation might choose to relocate its research and development people to a jurisdiction with advantages for R&D; thanks to the cloud, it can now do so without having to have massive infrastructure in place locally to support them.

Another cloud-related challenge, especially for large organisations and their IT people, is ‘shadow IT’. The fact that everyone within the organisation can potentially get computing services from the cloud, without involving the IT department, can lead to a situation where the costs and procurement are virtually unmanaged. Smart organisations implement cloud computing policies to make sure the risks are properly assessed and the relevant requirements (regulatory and so on) are met.

Help is at hand!

The important thing to remember about these risks is that they’re all manageable, and none of them will necessarily stop you going down the cloud path to reap the immense benefits it offers.

As already mentioned (more details in the box), there are global and national bodies and frameworks devoted to providing guidance on how to negotiate the cloud.

Professional services firms with specialists in cyber-business and digital transformation also offer extensive support, ranging from digital strategy formulation to actual migration services enabling organisations to get from their current environment to the cloud. A lot of this work involves regulatory and risk assessments, and helping organisations demonstrate to the regulatory authorities that they are meeting requirements (for example by producing independent reports to the regulator). It also often includes support with business cases, tax, etc. Professional services firms can also help clients get the bigger picture, enabling them to harness cloud computing and understand how to integrate various cloud services in their supply chain. Many large organisations are finding it useful to set up their own internal function to orchestrate all these building blocks to build the wall, and there are many cloud brokering technologies (used to integrate cloud services and manage their performance and resilience) evolving to facilitate this.

Professional services firms also support cloud providers by providing third-party controls assurance: evidence a provider can publish on its website that its services meet well-developed global professional standards. They also help create and evolve a reliable global framework for digital transformation and cloud computing through their active involvement in standards bodies, industry bodies and best practice organisations such as the Cloud Security Alliance.

Article overview