Cloud computing

Cloud computing provides a way of managing your IT resources online. Instead of buying IT resources from a hardware or a software shop, with cloud computing you are renting them from a cloud service provider, paying only for what you use.

Cloud computing is made up of four key elements:

• large-scale data centres hosted on remote servers
• services - eg software and hardware resources provided over the internet
• computers and other web-enabled devices, eg laptops, netbooks and smartphones
• broadband or 3G internet connection

Documents, emails, customer details and applications can all be stored remotely - ie 'in the cloud' - and accessed virtually and on-demand over the internet through a web browser.

Cloud deployment models

Cloud computing has four main models in terms of access and security options:

• public cloud - where services and infrastructure are available to the general public and provided off-site over the internet via a third-party provider
• private cloud - where services and infrastructure are available to a private customer and maintained on a private network either in-house or at the provider's data centre
• community cloud - where a group of customers access the resources of the same cloud service, usually sharing the same specific requirements that the service provides (eg high security or need for legal compliance)
• hybrid cloud - where you can mix and match public, community and private cloud resources based on your technical and business requirements

To work out which cloud model is best for your business, you should consider:

• how you currently use your IT systems and applications
• services which you would like to move to the cloud
• levels of service and support you will likely need
• your budget
• regulatory, governance or data protection issues related to those services

Read more about cloud service models.

There are three main cloud computing service models available. Depending on your needs, your business can use one of these, or a mixture of two or even all three.

Software as a Service (SaaS)

SaaS is the most common form of cloud computing used by small businesses and involves using software hosted on remote servers. It allows you to run applications through your web browser and save, retrieve or share files that are stored 'outside' your business.

Examples of SaaS include services such as:

• web-based email
• office software
• customer relationship management systems
• tools that support collaborative working

SaaS provides greater flexibility when compared to conventional IT systems, allowing you to scale your IT requirements quickly and easily to meet the changing needs of your business. See more on the advantages of SaaS for business.

Infrastructure as a Service (IaaS)

IaaS allows businesses to use virtual hardware resources to build their IT infrastructure. This includes:

• server space
• data storage facilities
• networking hardware

As with SaaS, you can modify or expand capacity as required. Other benefits include a reduction in your IT costs - by outsourcing your hardware requirements you no longer need to buy it or have the internal expertise to maintain it. 

Platform as a Service (PaaS)

PaaS involves using online application development capabilities to build and adapt applications to suit your business needs. The software development tools and hardware you need to do this - known as 'cloudware' - are all located remotely and accessed through the web.

Cloud computing can offer your business several advantages. It allows you to set up a virtual office with access to your tools and services anywhere and anytime, through a web-enabled device.

It can also help you:

• reduce hardware and software costs
• support more flexible working practices
• scale your IT systems
• reduce the need for in-house IT support
• access reliable and secure backup for your business data

Lower IT costs

Cloud computing can be a very cost-efficient method to use, maintain and upgrade your IT systems and applications. For example:

• having your business applications provided over the internet means you would no longer need to install and set up that software across your business yourself
• maintenance and other upgrades can be managed off-site by your cloud service provider
• operational cost savings can be achieved by reducing the levels of in-house technical expertise you require - allowing you to focus more on your core business

Greater scalability

Cloud computing allows your business to easily upscale or downscale your IT requirements as and when required. For example, most cloud service providers will allow you to upgrade your existing package to accommodate business needs or changes to market conditions. This would support your business growth without needing expensive changes to your existing IT systems.

Access to new technologies

Cloud computing can help ensure that you always have access to the latest technology. You would no longer need to worry about updating your software or investing in new back-end technology - as your service provider could manage this on your behalf. This can also give you access to software, hardware and IT functionality that would be too expensive to buy outright.

More flexibility

Cloud computing allows your employees to be more flexible - both in and out of the workplace. Employees can access files using web-enabled devices such as smartphones, laptops and netbooks. The ability to simultaneously share documents and other files over the internet can also help support both internal and external collaboration.

Enterprise-level backup

Cloud services can provide your business with enterprise-level backup. While there are some concerns around data protection, cloud computing can give your business access to professionally managed backup for all of your business information.

While cloud computing can greatly benefit many businesses, it is not without its downsides. Read about the disadvantages of cloud computing.

Despite its many advantages, cloud computing is not without its issues. You should be aware of these if you're considering moving your business into the cloud.

Cloud security and data

Most cloud service providers implement relevant security standards and industry certifications to ensure that their cloud environment remains safe. However, storing data and business-critical files in virtual data centres can potentially open you up to risks.

Common risks are:

• data loss or theft
• data leakage
• account or service hijacking
• insecure interfaces and APIs
• denial of service attacks
• technology vulnerabilities, especially in shared environments

The levels of data protection and security achieved and maintained by different cloud providers can vary. Choose your provider carefully and make sure that the provider is stable, reliable, reputable and offers reasonable terms and conditions of service. 

Cloud downtime

The cloud, like any other IT set-up, can experience technical problems such as reboots, network outages and downtime. These events can incapacitate business operations and processes, and can be damaging to business.

You should plan for cloud downtime and business continuity. Try to minimise the impact and the number of outages and ensure the maximum level of service availability for your customers and staff. 

Limited control

The cloud service provider owns, manages and monitors the cloud infrastructure. You, as the customer, will have minimal control over it. You will be able to manage the applications, data and services operated on the cloud, but you won't normally have access to key administrative tasks, such as updating and managing firmware or accessing server shell.

In order to mitigate risks, it may help to carry out a risk assessment before you hand over any control to a service provider. Once you have a clear idea of the risks, you will be able to weigh them against the advantages of cloud computing.

Data protection and privacy are often considered key risks when storing personal data in a cloud. The risks to your data in the cloud include:

• loss or damage by your service provider and their staff
• unauthorised disclosure or access
• malicious activities targeting your service provider - eg hacking or viruses
• poor security practices compromising data protection

Before choosing a cloud computing service, you should carry out a risk assessment of these hazards and their potential impact on your business.

Cloud and data protection laws

If you store or process personal data in the cloud, you will most likely have the overall responsibility for complying with the UK General Data Protection Regulation (UK GDPR).

Under the data protection laws, a cloud customer is usually viewed as a data controller if they determine the purposes for which and the manner in which the data is being processed. You are therefore likely to have the responsibility for how the data is handled, even if you don't have full control over the cloud.

As a data controller, you must ensure that:

• any processing of personal data is secure, even if this processing is being carried out on your behalf by a cloud provider
• data isn't transferred outside of the European Economic Area area, unless the destination country and the circumstances of transfer provide adequate level of protection
• you have a written contract in place with your provider and their agreement to apply a high level of security to the data and only process this data in accordance with your instructions (eg delete it on request)

You will also want to establish:

• what level of responsibility the provider will assume for the security, functionality and continuity of service
• whether there are any provisions for compensation in the event of a security breach

If a cloud provider doesn't offer you assurances regarding the security or location of their service, it may indicate that they don't put enough onus on data protection and the risk of falling foul of data protection legislation may be higher than necessary.

Levels of data protection

Service providers operate - and usually host - all the server requirements for a cloud computing system. These can include database management systems for data-intensive applications, such as those required for e-commerce or customer relationship management.

High levels of data protection are necessary for such applications, and you should check your contract or service level agreement carefully to find out what security measures your provider takes to protect your data.

See more on cloud security.

In case of critical systems failure, business continuity planning can help ensure the survival of your business.

Cloud as a business continuity solution

Cloud computing can form a part of your business continuity plan.

Cloud computing service providers back up and protect your data by holding it on servers remote from your physical premises and your own hardware. So if, for example, employees are unable to work in their normal building due to fire or flood, they could still access files and information over the internet and continue working.

Continuity of cloud services

It is possible for cloud service providers to lose data, suffer denial of service attacks, or go out of business. These possibilities should be factored into your risk assessments, especially if all your IT resources are hosted in the cloud.

To ensure business continuity and effectively plan for a loss of your cloud services, you should:

• conduct a business impact analysis or vulnerability assessment to identify critical services
• select an appropriate recovery strategy, eg back up data or replicate servers to another remote site
• test your recovery strategy and tools regularly
• consider your cloud provider's resiliency and standard compliance
• review your service level agreements

Cloud service level agreement (SLA)

An SLA is a binding agreement between a cloud storage or service provider and you, the customer. It establishes important criteria regarding the service, including:

• availability - ie minimum levels of uptime
• performance - eg maximum response times
• security and privacy of data - eg encryption of all stored and transmitted data
• access to data on the service provider's systems
• system infrastructure and security standards the provider is expected to maintain

Individually negotiated SLAs with your cloud service provider should include availability guarantees and penalties if the service is interrupted. However, many consumer services - eg free applications where you accept the provider's terms and conditions rather than negotiate a contract - specifically exclude these provisions from service agreements.

Contracts should also take into account sector-specific legal requirements - eg the UK money laundering regulations for businesses working in financial services.

To guard against the possibility of complete loss of data from a remote provider, you should consider backing up all data using servers that are under your physical control, or using a backup cloud storage provider - although this will involve additional expense.

Cloud computing applications useful to small businesses include:

• sales tools
• office software
• customer relationship management (CRM) software
• human resources software
• payroll software
• collaborative working tools

Many such applications are available on a software as a service basis - where the software is maintained and upgraded by the provider and accessed through the customer's web browser. See more on cloud service models.

Cloud CRM and e-commerce

Online sales and CRM applications can help you target new business, and service the needs of existing customers more effectively. Sales teams, for example, can use web-enabled devices such as smartphones to access and update customer information whilst on the move. For more information, see customer relationship management.

Cloud HR

Most cloud human resource (HR) systems can be used for the entire recruitment process - from tracking applicants to comparing salaries and testing performance. They can help you to automate tasks, keep records and stay compliant with employment legislation. These systems are generally easy to use and they remove the need for infrastructure, maintenance and storage space.

Cloud collaboration and virtual offices

Office software and collaborative working tools available through 'the cloud' allow employees to work anywhere using web-enabled devices - exchanging emails and sharing information as needed. This supports more flexible working practices and allows employees to collaborate with colleagues, clients and customers.

Choosing a cloud service

There is a wide range of providers that offer cloud services to businesses.

When selecting a service provider it is important to know how easy it would be for you to change the level of service you are receiving, or - if necessary - end the contract or service level agreement and move to another provider. To avoid being 'locked in' to a service, you should carefully consider your contractual obligations and how technically viable it would be for you to change service providers in the future.

As with all suppliers, you should do your research to find the provider most suited to your business requirements. Ask other businesses and carry out research online to ensure that the provider you choose is reputable. See how to choose an IT supplier for your business.

When thinking about using cloud services, you should first consider trialling it with non-critical applications or business processes. This may help you to see how cloud computing works, if it will suit your business and what benefits it may bring.

Assess cloud service providers

Before implementing cloud computing in your business, you need to consider the following issues:

Data protection

How will you protect your data, and what measures has the service provider put in place to ensure your data is secure? What level of responsibility will the service provider take for any data loss and what are your legal obligations for your data? If the provider's servers are located outside the European Economic Area, what data processing rules and jurisdiction will apply? See more on data protection and cloud computing.

Business continuity

In the event of service downtime, a security breach or loss of data, how will your business continue to operate? What back-up systems do you have in place? What service availability guarantees can the provider give? See more on cloud downtime and business continuity.

Service level

What level and types of support will your provider offer? What financial compensation will they give you if their service becomes unavailable?

Pricing

How much will the service cost?

Flexibility

What are your options for upgrading or downgrading service requirements in the future?

Contract terms

What are your legal obligations if you want to end the contract early - eg to change providers?

Cloud and internet speed

To be able to work effectively 'in the cloud' your business needs a fast internet connection. Cloud computing works most effectively when you can upload data to the provider's servers as fast as you can download from them. Leased line or super fast broadband internet connections are preferable to standard ADSLs (asymmetric digital subscriber lines) as they support faster upload speeds.

You should also check whether your business shares its internet connection with other businesses, as this will reduce upload speeds. Your choice of internet service provider and the support they offer is a key consideration too - because fast internet access is fundamental to cloud services.

See more on choosing broadband connection for your business.