Subcontracting in the Cloud

The rise of cloud computing services and the privacy/security issues involved have been much discussed (see, for example, our prior blog posts here). But when customers procure cloud-based services, a critical “behind the scenes” issue is often overlooked: is the cloud provider itself relying on third party subcontractors to perform critical functions? When these subcontractors are added to the mix, things become a bit more complicated.

Cloud computing offers a wide variety of services:

• IaaS: infrastructure as a service to replace a customer’s data center or testing environment;
• PaaS: platform as a service to replace a customer’s applications development environment; and
• SaaS: software as a service to replace a customer’s need to install and operate software.

Each of these services share the key characteristics of cloud computing (resourcing pooling, rapid deployment, location independence, high scalability) that are appealing to customers. It’s little wonder that Gartner forecasts that the public cloud computing market will grow 18.5% this year to $131 billion worldwide.

When customers think about obtaining cloud services, they should keep in mind that a number of these services can be layered on top of each other with different providers to create a cloud “supply chain”. This makes the customer-facing service more efficient and less costly.

Take, for example, an end user customer that has procured a SaaS solution. This end user customer uses the application but doesn’t control the operating system, hardware or network infrastructure on which it’s running. This is the trade-off that all end user customers make when implementing a cloud solution.

But it may be the case that the SaaS provider itself doesn’t control all of these delivery elements. The SaaS provider, in turn, could be the customer of an IaaS solution. Under this model, the SaaS provider is hosting its application on a third party’s IaaS cloud. The SaaS provider may control some of the delivery elements (e.g., the operating system and storage applications) but it would have no control over the cloud-based infrastructure that supports the application. As with the end user customer, the SaaS provider trades off operational control for scalability and efficiency. The SaaS provider’s use of an IaaS solution makes the SaaS provider’s solution ultimately more “cloudy” and therefore more appealing to the end user customer.

This is just one example of how a subcontractor could be involved. Cloud providers can subcontract a wide variety of functions to third parties (e.g., hosting, storage, processing, transmission, network security, etc.). A cloud provider’s form agreement typically will permit it to subcontract without restriction (and, in fact, its out of the box solution may already rely on subcontractors). So when end user customers consider cloud solutions and perform their due diligence, they should think about not just the main provider, but also any subcontractors that the main provider relies on (now or in the future). This is because a failure or issue at any point in the cloud “supply chain” could affect the service being provided to the end user customer and could affect its ability to access its data.

So what are some of the key questions to ask when considering a cloud provider (and its current or potential subcontractors)?

• Where is the data stored and who is storing it? It often will be stored by a subcontractor that is in a location with the lowest taxes and cheapest costs. Location may matter more for certain regulated industries and if the data is from certain jurisdictions like Europe. If the solution involves encryption (of either the data itself or the transmission of the data), location also may implicate U.S. export control issues. In certain jurisdictions, the government may have an easier time accessing data if it is stored by a third party in the cloud.
• Who has the encryption keys to secure the data? If the prime cloud provider or a subcontractor has the keys, the end user customer will not have ultimate control over who can access the data. If any of these providers goes out of business, the end user customer may be unable to get to its data.
• How are outages treated throughout the supply chain? Are there redundancies built into the system? Do availability, service response and restoration metrics apply to both the prime cloud provider and to all subcontractors? What are each party’s obligations with regard to disaster recovery? Transparency is important here. The end user customer should have as much as possible an understanding of how its solution is architected throughout the chain.

There are, of course, other “due diligence” type questions to ask. But in doing so, it’s always good to consider whether there are cloud subcontractors that are playing key supporting roles behind the scenes.