Before You Choose a Cloud Computing Vendor: 8 Questions
Other vendors don’t offer the right kind of security — the kind a CIO gets from knowing that new cloud provider is a partner to be relied on, not one that will disappear or fail after the CIO talked a large portion of the company into relying on it.
Faced with a project list greater than his budget, MoMA’s Peltzman looked into various cloud services as ways to extend MoMA’s capacity in specific ways at specific times. Broad-spectrum IaaS services such as Amazon’s EC3 had plenty of capacity, but the startup took too long, he says. SaaS providers such as Salesforce.com’s online ERP were too function-specific, he adds. Instead, he picked a service from Cloudshare that allowed him to create virtual workgroup environments at will, on Cloudshare’s network.
How to Negotiate a Better Cloud Computing Contract
How do you find the right cloud provider? There’s not a consistent checklist either small or large companies can go through to make the selection, according to Bernard Golden, CEO of cloud consulting firm HyperStratus and CIO.com blogger.
“A manufacturing company isn’t going to have the same checklist as a service company or retailer,” Golden says. “They’re too different. But there is a consistent set of things to look at. Some of them are specific to cloud providers; a lot of them are the same kinds of things you had to look at in outsourcing or any other service provider contract.”
1. How responsive is the cloud company?
“How fast do they call you back?” asks James McKee, president of United Resource Systems, medical-debt collection company based in Lakewood, Colo. “It doesn’t tell you everything, but I like to know how important I am to them and how responsive they are. My clients demand that responsiveness from me; I demand it from my providers.”
Some providers may be more responsive at the beginning of a relationship than later, so checking with other customers on that point is important as well, Golden says.
CIO — There are few ways a CIO can look better than by walking in to the CEO’s office to offer a sophisticated technology service that answers a desperate business need without requiring large capital expenses or delays before implementation.
“Flip the switch and there’s the extra capacity. Pay for what you use and shut it off again,” says Steven Peltzman, CIO of the Museum of Modern Art (MoMA) in New York.
Not every cloud provider can do that, of course. Some don’t offer the right kind of service. Infrastructure as a service providers such as Amazon Web Services require too much work up front to suit a relatively small IT project.
2. How transparent is the cloud service?
“There’s a lot of mystery in clouds,” according to Chris Wolf, analyst with the Burton Group. There’s no need to understand the underlying infrastructure and the company’s plans to upgrade or reinforce it if you’re just using Google (GOOG) for Gmail. But any company hiring a provider for important business functions deserves to know what kind of technology — and secondary or tertiary service providers — actually makes up the cloud and how reliable it is.
3. How prepared is the cloud provider to answer due-diligence questions?
Some of the most critical questions are the most basic: what does the company do to ensure physical security; what servers and software does it run and what are its arrangements for disaster recovery; are its employees all well trained, background-checked, bonded and secured?
“All the basic stuff is pretty important, but you have to verify that,” Wolf says. “You have to know they’re relatively stable and reliable in hiring and you have to check on things like making sure they have redundant telecom arrangements and high availability/DR options so you don’t go down for three days when they have a power outage.”
4. How much access does the cloud provider offer?
“You should be able to go through your list of criteria with the vendor and get answers to your questions and have them revisit that periodically to demonstrate how they’re living up to your expectations,” Golden says. “If it’s a big contract, you’re going to want to do audits periodically to verify SLA and compliance and security issues.”
