The cloud - What are the key risks and issues

Emma Bufton: Hello my name is Emma Bufton and I am a Senior Associate at Gowling WLG and I also co-chair ThinkHouse Foundations. ThinkHouse Foundations is a network for in-house lawyers at the start of their careers where we provide tailored training development and resources exclusively for paralegals, trainees and lawyers of up to five years PQE. At our most recent ThinkHouse event Senior Associate Alison Dobson from our Commercial IT & Outsourcing Team spoke about cloud and what to look out for in terms of key risks and issues when dealing with these types of arrangements.

So Alison there has been lots of talk over the years about cloud and for those of us not operating in the IT space it can be quite difficult to get our heads around it, so what is cloud?

Alison Dobson: I agree Emma it is a really difficult concept for people to get their heads around as to what it really means, it is not a tangible concept in the same way as a contract may be for a property purchase where you can imagine exactly what the asset is. I do not profess to be an expert on defining clouds and I am sure many technical experts would give a much more detailed answer but with an IT lawyer hat on the way I think of cloud is as follows.

So I essentially think about it as the delivery of competing services over the internet. So you have some servers, so your hardware, some storage, some applications and I think in a day to day context if you think about using Gmail, Hotmail, watching Netflix, storing pictures or files over the internet you are essentially using a form of cloud service.

Cloud comes in many different varieties so at a basic level you have infrastructure as a service and this is the provision of computer infrastructure, so your servers, your hardware, your general equipment. The next layer up is platform as a service and that is the provision of a platform that sits on top of that infrastructure and this is usually used by developers who want to develop the next best thing but do not want to pay for all of the underlying infrastructure so they just want to have the operating system ready to go then they can continue their development. The next layer up is software as a service so you will normally hear this referred to as a SAS and this is at the top so it is the delivery of the software application itself. So, for example, your payroll software might be done and software is the service where it is not located on any servers in your building but provided by a cloud service provider located off premise.

Emma: Wow, thanks for that overview of cloud Alison that was really helpful. So what in your experience are the key benefits and also challenges associated with cloud for businesses? Shall we start with the key benefits?

Alison: Yes that sounds good. So I think one of the main benefits is, particularly where software is the service, it is device independent so you are not tied to a specific device. So if in your organisation you happen to use Microsoft Office 365 you do not have to be on the same computer to use that application each time so you could maybe access it from your phone, your tablet or your computer at home.

I think another key advantage is around the flexibility and scalability for a business. IT needs are evolving all the time as more and more data is consumed. This needs infrastructure and servers and whilst traditionally businesses may have had their servers on premise this is expensive and there are now huge companies which specialise in the provision of this type of hardware and equipment meaning that if you are the IT director you can spend a bit less on that and maybe a bit more on the application and this ties in to Metrix so instead as I say of purchasing the hardware as a kind of capital cost you will be paying for your service on that subscription basis annually or quarterly in advance so therefore spreading the cost across the year or the quarter depending on the Metrix.

Emma: Great, so there are some of the key benefits and what about the challenges then associated with cloud for businesses?

Alison: So whilst on paper the benefits can look great particularly if you can say you are reducing your spend on IT and potentially achieving better capability but there are of course as we say some risks and challenges associated with that.

So in a traditional software licensing world it was much more common for there to be bespoke configuration of software to meet your business's needs but part of the reason cloud services are cheaper is that they predominately offer an off the shelf vanilla product with little configuration and bespoke development for you. So therefore as a business you may well just be stuck with exactly what the cloud provider is offering to you and it might not meet your exacting requirements.

I think another key challenge and risk is around data and I could talk for ages all about the risks associated with it but I think a key one is that you are losing a degree of control over exactly where your data is located. And I think the final one I would indicate right now is around service levels and do you actually have any commitment in terms of the performance that the provider is giving to you. Will there be anything you can say and point to in your contract that means yes the service has not met your requirements.

Emma: So looking at cloud contracts from a customer's perspective, are there any key issues that you think individuals working on such contracts need to look out for?

Alison: So I think there are many different issues but I am only going to just touch on a few given that we only have a short amount of time as opposed to hours and hours and hours. So I think the first one would really be around data and I touched upon that earlier in relation to the key risks that I identified and I think the main one really is around independence.

So whereas in a traditional software licensing world as I mentioned you would know exactly where your data is, with a cloud provider you are often contracting with just that one provider but essentially they have many different sub-contractors behind the scenes and so you do not know exactly who might have your data at any one time. I think another risk associated around data is security, so again what security policies are there in place, has your IT team looked at them, are they comfortable given the nature of the application that this is the right product for the business.

I think thirdly on data, who has access to it at any one time, what are the rights around disclosure and it is about looking through the proposed contract in the prism of what you are purchasing and assessing the risk and particularly if it is personal data then you obviously need to contemplate the Data Protection Act and also the new Data Protection Regulations.