Don`t Lose Control in the Cloud

Cloud computing involves giving up direct oversight of technology assets, but it shouldn’t mean losing control.

The customer must rely on the service provider to restore operations when a cloud computing service malfunctions. Before entering into a cloud transaction, a prospective customer should evaluate the service provider’s obligations to ensure the availability and utility of the service, as well as determine the incentives the service provider has to meet those obligations. Areas to consider include service levels, availability, issue resolution, measurement and reporting, and performance incentives.

Service level is the customary term for a service-delivery obligation in a cloud computing transaction. Service levels for availability, error correction and user support are found in many cloud computing contracts, and the parties to every cloud computing transaction should consider whether any or all of these service levels are appropriate.

Not all cloud-based services are mission-critical. Service levels that are appropriate for a cloud-based service that is necessary for a customer’s ability to operate its business are different from service levels, if any, that may be appropriate for a cloud-based service on which a customer’s business continuity does not depend.

Another area to consider is availability, which refers to the percentage of time a cloud-based service is available for access and use by the customer. An availability service level of 99.5 percent is customary, and mission-critical cloud comput-ing services can carry service levels as high as 99.99 percent.

The percentage is calculated by subtracting the time during the measurement period when the cloud-based service is unavailable from the total time during the measurement period, dividing the result by the total time during the measurement period, then multiplying the result by 100.

Customers should evaluate a service provider’s proposed availability calculation by identifying the proposed measurement period, measurement unit and scheduled downtime allocation. The customary measurement period is a calendar month, and the customary measurement unit is minutes.

If the technology used to provide cloud-based services requires periodic maintenance, the calculation may specify maintenance windows (periods of time during which the service provider is entitled to suspend services without consequences. Such suspensions are called “scheduled downtime.”

A description of scheduled downtime might have two components: specified days and times for maintenance windows and—if the maintenance windows are longer than two to four hours on one or two days each week—the minimum advance notice a service provider must give for times within the maintenance windows during which the service will be unavailable.

Resolution and Support

Severity-level response obligations that are customary for technologies located at a customer’s premises are equally applicable to cloud-based services. They often describe the impact of service problems on customers at a minimum of three severity levels—serious, moderate or minor impact on customer operations—and prescribe the time within which the service provider must resolve issues at each severity level.

User-support service levels can include average and/or maximum times within which users receive responses to their support requests; the percentage of support requests that are resolved by the service provider’s initial response, and the percentage of support requests that are resolved within a specified period of time after the support request.

Prospective customers should also examine the service provider’s obligations to measure achievement of service-level obligations and report the results. Many service providers allocate to their customers the obligation to identify instances in which the service fails to achieve agreed-upon service levels. However, customers may not have the necessary tools and resources to measure the service provider’s performance.

A prospective customer might reasonably expect a service provider to measure its own performance of each service level and report the results by a specified date each month.