There are literally scores of cloud computing vendors to choose from. Everyone from Google (Google App Engine) and Microsoft (Microsoft Azure) to Rackspace and Salesforce.com has a cloud computing service or platform. When setting out to choose a cloud provider, keep in mind that you need to analyze your choices on a few different levels.
• The product: Is the product easy to use? Does it provide your business what it needs? Will it help you better meet business goals?
• The provider: Is the provider a stable company with lots of other customers? Are those customers happy with the customer service? Is the provider well-funded and/or is it a possible acquisition target?
• The transition: Is the transition something that will be accomplished during your timetable? Do you understand what is involved and the possible interruptions to business during the transition?
Assemble a list of providers. You can gather this information from magazine and news sources. You can get referrals from other businesses or business or industry groups. You can look to IT research companies, such as Gartner, Forrester, and IDC. You can also hire outside consultants to help your company find the right fit in a cloud computing vendor. In addition, there may be providers that specialize in solutions for your industry.
Once you have a list of prospective vendors, you need to gather answers to some fundamental questions involving availability, security, performance, and customer service.
Availability
“Will the service be up and running when your business needs it most? Or will there be downtimes or unacceptable levels of application latency that may cost you customers or productivity? From an availability perspective, it’s important to understand if the service is deployed on an underlying infrastructure that is backed up with a meaningful service level agreement,” DiMemmo says. “You already have fundamental expectations of your service levels if you are managing your own IT today. When you move to the cloud, you minimally want to achieve that availability or better to ensure the performance of your infrastructure and applications.”
The level of availability you need depends on the criticality of the service to your business. If you’re looking to move your financial, CRM, or business intelligence systems to the cloud, it’s likely very important for the cloud service to be highly available. But if it’s a secondary application that is only utilized occasionally and not business critical, you may not need such high availability, and you can broaden your cloud provider landscape, DiMemmo says.
Security
“The biggest concern about cloud computing is security,” says Presciutti. That includes the physical security of the cloud environment — where is the data center that houses the vendor’s servers and what is their plan if there is a tornado or hurricane? But it also refers to the security of the information your business maintains. Given that there are a host of new laws requiring businesses to protect personal information of customers, you need assurances that your cloud provider will abide by those same laws and help you protect that data. In addition, you don’t want breaches of sensitive company information.
“Everyone’s big objection is taking corporate information outside the four walls,” Presciutti says. “The cloud environment is shared. Your data might be running on the same servers or storage media as your competitors’ or other companies’. You have to ask yourself do you really want to have your data co-located with someone else’s.” This key objection has been addressed by many vendors that include security for both “data in motion” and “data at rest,” Presciutti says. Most vendors approach cloud security through the conventional means of various levels of encryption, firewalls, etc. Other companies, such as Unisys, have a different method they call “stealth” (reportedly developed for the U.S. Department of Defense) that in addition to the widely used encryption technologies also splits the bits of data as they traverse the network and are stored on media.
If your company needs to meet Payment Card Industry (PCI) compliance or Statement on Auditing Standards No. 70 (SAS70), you need assurances that your provider complies with those standards, as well.
Performance
A few years ago, the early promoters and adopters of cloud computing were happy to see the fundamental promise of cloud services coming to market, DiMemmo says. Now that the cloud services have matured, and the adoption has progressed in the business community, the expectations are that service performance levels are critical since these services are now supporting a growing number of business-critical systems that make businesses run. “Companies are saying ‘We need it to work as well as or better than when it was in our own data center,'” DiMemmo says. “Today, the cloud provider now has to have performance metrics.”
Some of the key questions to ask when looking for a vendor include the following: How does the cloud service provider define performance? What metrics do they use? How does their definition of performance relate to end user satisfaction?
Customer Service
Ultimately, your choice may come down to a gut feeling about which cloud computing vendor you would prefer to do business with. There are a lot of questions you need to ask. How quickly does a vendor return your calls? How transparent are they in discussing what kind of technology they use or who their providers are and how often they have downtime? Do they answer your questions about the servers they use and the software they run and their disaster recovery plans?
“There are other ways to measure a vendor’s merit, as well. Ask for referrals and check up on as many as you can. If you’re thinking about moving a highly critical business application to the cloud, ask to visit their data center as it will tell you a lot about their capability. And, ultimately, you want to determine whether the vendor is willing to put their promises in writing in the form of a service level agreement (SLA). If the vendor relies on other software and hardware and infrastructure players to keep their service up and running, make sure all the promises in the underlying SLAs align properly,” DiMemmo says.
Hopefully you will never have to assess penalties for the vendor’s failure to perform as promised, but it’s a measure of the vendor’s confidence in their products and services if they are willing to include penalties in the SLA. “You really want to make sure that there is confidence in the service,” DiMemmo says. “If the underlying providers are willing to share some level of risk in delivery, it’s a good indicator those folks are confident in their infrastructure.”
