Michael Luckman: Hello, I'm Michael Luckman Chair of our ThinkHouse sessions and today I'm speaking with Sally Mewies who's head of our IT team about cloud computing and outsourcing.
So Sally when I was much younger a cloud was something that floated around in the sky and dropped rain, these days everybody seems to be uploading stuff to clouds. What is the difference between clouds and outsourcing?
Sally Mewies: Well I think that's one of the interesting points that we want to explore actually because I think we felt that certainly in terms of IT outsourcing we'd hit a little bit of a crossroads where we were seeing much less bigger IT outsourcing deals coming across our desk and much more people utilising cloud based services and one of the challenges for them is under understanding the risks that are associated with those cloud based services. There's certainly a perception that cloud is much cheaper than traditional IT outsourcing but there still is a fear I think it's fair to say around what will happen if I use a cloud service I don't really understand what it is.
Michael: You've raised the very question I wanted to ask. Which is you know what are cloud services?
Sally: Well cloud services are essentially IT outsourcing I think it is quite interesting to think back when I was doing some of the very first big IT outsourcing agreements which was probably around the late '80s, early '90s. It was really all about the IT staying where it was and the people going. What's really interesting about cloud is the people stay and the IT goes and I think if you think about cloud based services as being off premise. So in a funny sort of way they are like IT outsourcing, they are like outsourcing sorry but you are accessing a platform technology functionality and software but you are doing it off premise so it's located away from your main building and you access that through some kind of internet or web browser. Because you can't see it I think sometimes and because it's complex technology I think sometimes people feel a bit scared about what am I letting myself in for.
Michael: Right so you've described what cloud services are. What are the pros and cons of cloud services that is outsourcing?
Sally: Well I think it probably comes down to control actually in terms of a big pro and con. In the sense that with the traditional outsourcing model you have a lot more control how the service is delivered, what the subcontractor stack looks like under that service provider, what service levels are designed to support your business. There's a lot more control in those kinds of contract and that's of course why there's a high cost to entry and why the take longer to negotiate. Contrast that with cloud where it's much more 'buy as seen' in the sense that there is already a service constituted. It has a pre-printed specification. You're almost checking whether that's the service you want and then you will plug and play into that service. So you have much less control about how the technology that supports the service evolves, the service level regime that supports that service, all of that is kind of already there and you have to take it or leave it. Which is why of course we have much shorter contractors, much less negotiation around a cloud agreement.
There are other issues I think around risk, the risks are different again with the cloud, the traditional model, you have more control, you can manage risk, you've got more opportunity to step in if you don't like the way things are doing, you've got the opportunity to do change control through a traditional model which might alter the way the service is being delivered. Again, on a cloud based model you have less of that and of course the big issue around cloud is people being concerned about security of data because you're putting your data into a unknown environment, you don't really understand necessarily technologically how that works and therefore there is some fear that you might lose that control. You could argue it's the same in a traditional outsourcing model because you are still handing over information and data to third party and they are probably not on premise, so they are probably not sitting next to you when their using and processing that. But because you've got kind of a closer relationship I guess with a traditional outsourcing partner and more may be daily interaction it doesn't feel quite as risky.
A big issue of course around cost because on the traditional model whilst the early days of outsourcing were hailed as being this is going to deliver real cost savings, I'm not convinced that anyone ever really believed that or certainly believes it now and I don't think the rational for doing a traditional outsourcing is cost saving any more. I think it's more around I can't be bothered to do it or I think you might just do it better or it's just not core activity. Cloud is an area where we see huge cost savings because you're not having to invest in the technology and infrastructure to support it and of course you're sharing it with lots of other customers. So because you're sharing it the individual cost to you as a user is much less.
Michael: When it comes to termination are there any differences between cloud services and outsourcing?
Sally: Well I mean I think traditionally they've been dealt with differently and this is one area that we've always said to our clients you absolutely have to structure and look at exit in the same way as you would in a traditional outsourcing model. So typically you would have seen very little in a cloud contract in the early days, some of those had very little detail around exit and we always say no you must look at this in the way that you would look at it in a traditional IT outsourcing. You must have exit provisions in there, you must have detailed provisions around how you get access to your data, any obligations on the service provider to transfer it back to you. What are the costs associated with that? All of that needs is a very important part of the cloud service. To ensure that you don't find yourself locked into it and unable to move because actually you haven't got access to the data.
Michael: Well how about service levels. I remember in outsourcing the whole issue of service levels was really important. The best description of outsourcing was I'll give you my heart and ask you to pump it for me, I'm very keen how well you do that. What about cloud where does…?
Sally: Yeah I think again looking at the traditional outsourcing model you tend to see much more bespoke service levels associated with the particular service because there is much more tailoring of the service I think in a traditional outsourcing, it's not always true that but generally you see much more tailoring of the service. Of course you don't in cloud because again it's all around standardisation, this is my solution, this is my stack of technology, this is what I'm giving you, this is what you're getting, you're not getting anything else and it's the same sort of approach in service levels so it tends to be very standard around an availability measure.
At one time you didn't get anything so the first providers of cloud didn't offer anything around service levels, that's changing as people are putting more critical systems into the cloud and they are signing up to longer periods. But you still see a lot of vagueness and wooliness around the service levels and it's quite hard to understand exactly that the commitment is and I think there's lots of woolly language maybe doesn't give you quite as precise a qualitative measure around performance as you might get in a traditional deal.
Michael: So you're sitting at your desk as a General Counsel one Monday morning and your Chief Exec and Head of IT roll in and say I'm very excited I've got this fantastic, cheap, effective cloud service, we're going to sign up tomorrow. What are the key issues you're going to raise for your client there?
Sally: So I've already mentioned some of the key things thinking about what data is going into the solution making sure that you're compliant with the new data protection regulations potentially therefore doing some kind of privacy impact assessment against the use of that solution, all of those things are going to be important. Making sure that you've got adequate exit provisions, as I've just said again really focussing on all of that.
But I think the biggest thing in cloud, and this is where I think people go wrong, is understanding what the technology is. In the old world of a traditional IT outsourcing or any kind of outsourcing you would have a long convoluted service description, people would be spending a lot of time going over it, they would understand, and they would have a lot of input and control into how that service was delivered in a traditional outsourcing world. That doesn't happen in cloud and people sign up and buy these services without really understanding what the service is, how it's constituted, where the servers are, in whose data centre, what's the structure of the subcontracting supply chain model behind that service. If you don't do that you can't make any assessment about risk and like everything, cloud probably even more so, this is about managing risk and understanding the risks you are taking. If you don't understand the solution you're buying you won't be able to do that. I think there's some great things about cloud. I don't think there's anything to be too fearful of but you do have to understand what you're buying which in other commercial contracts, David Lowe will kill me, you might not need to.
Michael: Well let's all hope our clouds all have silver linings. Thank you very much Sally.
Sally: Thank you Michael.