Benefits and risks

Cloud computing can bring many advantages. However, it also presents some risks and challenges. It is important to understand cloud computing when determining which products are right for your organisation, and how best to implement them.

The benefits:

• cost savings – reduced upfront investment in physical products and infrastructure, such as servers and storage

• resource savings – your organisation’s IT team can be freed up to work on other projects

• ease of use – can be accessed any time and from any location (particularly beneficial with the adoption of hybrid working)

• speed of deployment – can be quicker and easier to get up and running than a solution that needs to be installed on your own systems

• efficiency/competitive edge – can bring improvements in workflow, automation and collaboration. Certain service offerings will have a higher availability offered by the supplier when deployed to the cloud rather than on-premises

• quality - systems developed by specialist cloud providers can be better than their in-house developed equivalents by an organisation with fewer resources

• future developments – cloud products are often more likely to be improved by the provider over time, implementing technical and practical enhancements that could be prohibitively expensive for a single organisation to implement

• flexibility – can often be quickly scaled up (or down) to reflect the changing needs of your organisation

• security – in the case of more sophisticated cloud products, it can be the case that the provider has greater expertise and investment in IT security than a single organisation with more limited resources – this can reduce the practical likelihood of a security breach

• accounting / tax treatment – as a ‘pay as you go’ model, cloud subscription payments may be accounted for as an operational expense rather than the capital expense incurred when making more traditional on-premise IT investments.

Potential risks or challenges include:

• cost – subscriptions and maintaining service needs to be considered across the longer term where costs could exceed a traditional on-premise setup

• increased management will be needed as cloud computing is integrated into existing services and configured to your organisation’s requirements

• staff training and education will be required and IT policies may require to be updated

• ill-suited products – a wide range of cloud products are available to meet varying needs, but they may not all be suitable for your organisation. For example, cloud document storage products will vary in terms of their cost, and (often proportionately) also their reliability, security and confidentiality assurances – using a free product to store confidential business information will likely create significant confidentiality, data protection and security risks. Cloud products require to be selected with the mitigation of these risks in mind

• technical – cloud products might create inter-operability issues. One cloud product might use a specific format for the data stored within it that is not the same as another cloud product that it needs to communicate with. It is necessary to ensure that the data format used works with your other systems both now and in the future

• downtime – using a cloud product rather than an in-house developed product will leave you relying on the supplier to fix any issues that cause downtime. You will not be in control of this and therefore there is a risk that issues are not resolved as fast as you would like or be able to do with your own product

• supplier lock-in – like any third-party relationship, you may find yourself overly dependent on one or a small number of cloud providers. You should ensure you have given thought to a fallback option so that you are not overly exposed to future cost increases or service issues

• provider failure/insolvency – if the cloud provider has financial difficulties and goes insolvent, there is a risk to continuity of the service and/or access to your/your clients’ data. This could occur, for example, if the cloud provider has its own contract with their provider of hosting services terminated for non-payment. Therefore, you should do your homework on the financial standing of the cloud provider and, where possible, monitor that on an ongoing basis. For provision of critical services, you may even wish to investigate cloud escrow services, which provides a mechanism to have another provider take over the cloud environment if your original cloud provider became insolvent.