A Fistfight in the Cloud: Can't We All Just Get Along?

Big-name cloud services providers are, in fact, some of the worst offenders: Slippery service-level agreements. Cagey compliance credentials. Self-serving metrics. These were the findings of a spring 2010 Yankee Group report that analyzed the terms of service, SLAs and privacy policies of more than 40 cloud services providers, including Amazon, Google and Microsoft. (For more, see Cloud-Computing Services: "Fine Print" Disappointment Forecasted.)

"Cloud service providers better clean up their act fast because major investment decisions hang in the balance," noted Yankee Group's senior research fellow, Camille Mendler. "Enterprises need transparency, professionalism and certainty to invest in cloud services—few providers are stepping up."

So in response to the absence of transparency and certainty to which Mendler alludes, Gartner and its Global IT Council have created a list of "Six Rights and One Responsibility" that "will enable providers and consumers to work more productively together," notes a Gartner press release.

While the "rights list" might come off as more of a "wish list," it does have immediate value for CIOs as a negotiation tick-list when a cloud RFP comes around. And ultimately, the list is a solid first step in establishing ground rules for the relationship between customer and provider in the cloud-computing arena.

Here's a shortened version of the list (you can register and get a copy here):

• The right to retain ownership, use and control one's own data: The provider must specify what it can do with the consumer's data. Lack of clarity on this point can lead to costly legal battles.
• The right to service-level agreements that address liabilities, remediation and business outcomes: To make service-level agreements relevant to the business, providers do not have to customize them for every consumer; rather, the agreements should comprehensively address the business issues implied in the type of service offered.
• The right to notification and choice about changes that affect the service consumers' business processes: Protecting the consumer's business processes entails providing advanced notification of major upgrades or system changes, and granting the consumer some control over when it makes the switch.
• The right to understand the technical limitations or requirements of the service up front: Most service providers do not fully explain their own systems, technical requirements and limitations so that after consumers have committed to a cloud service, they run the risk of not being able to adjust to major changes, at least not without a big investment.
• The right to understand the legal requirements of jurisdictions in which the provider operates: Service providers have not done a good job of explaining which jurisdictions they put data in and what legal requirements the service consumer must, therefore, meet.
• The right to know what security processes the provider follows: Service consumers must understand the processes a provider uses, so that security at one level (such as the server) does not subvert security at another level (such as the network). Without this knowledge, service consumers risk security violations caused solely by the provider not accounting for the ways in which consumers might use a service.
• The responsibility to understand and adhere to software license requirements: Providers and consumers must come to an understanding about how the proper use of software licenses will be assured.

So as not to offend cloud vendors everywhere, Daryl Plummer, a Gartner fellow, notes in the press release that the rights list can help both customers and service providers.

Continue Reading