Cloud Without Risk

Cloud sourcing contracts are not mature for all markets, warns Gartner researchers in a new report, "Four Risky Issues When Contracting for Cloud Services."

While the cloud environment is quickly maturing, cloud service contracting has structural deficits, Gartner says. Based on their research Gartner warns cloud contract terms generally favor the vendor, do not have clear service commitments, are opaque and easily changed. Gartner reports seeing many cloud-sourcing contracts that lack descriptions of cloud service providers' responsibilities and that do not meet the general legal, regulatory and commercial contracting requirements of most enterprise organizations.

Gartner recommends organizations do a cloud risk assessment. Areas such as data-handling procedures can have a negative impact on the business case, Gartner points out, potentially creating compliancy issues and cost increases. A wise approach, according to the report, is to take a different path to vendor selection, contracting and negotiation.

“Cloud sourcing often requires a more liberal legal approach that allows for the acceptance of standardized terms,” says Frank Ridder, research vice president at Gartner.

“CIOs and sourcing executives should try to negotiate protection against additional costs and incremental cost increases in the contract —even if this might result in some loss of initial discount,” advises Alexa Bona, research vice president at Gartner.

Bona advocates negotiating protections and penalties into contracts to protect current business requirements and renewal terms. Complete a competitive market analysis and switching cost analysis well in advance of a cloud service contract renewal, Bona says.

Gartner believes that over time, the combination of buyer pressure and a provider desire to reduce the length of negotiation cycles and number of customized deals will cause terms to evolve to more of a middle ground, rather than the current provider-centric contract practices.

This story was reprinted with permission from Information Management.

For reprint and licensing requests for this article, click here.
Analytics Security risk Core systems Data security Policy adminstration Data and information management Compliance
MORE FROM DIGITAL INSURANCE