Cloud Constitution from Gartner

MUMBAI, INDIA: All cloud services customers should have some basic rights to protect their interests, and Gartner, Inc.'s Global IT Council for Cloud Services has defined six rights and one responsibility of service customers that will help providers and consumers establish and maintain successful business relationships.

Gartner has established the Global IT Council for Cloud Services to facilitate successful business relationships between cloud service providers and consumers. The Council, which consists of CIOs of large enterprises that consume cloud services and Gartner analysts, has made identifying key rights of service consumers and how they might be upheld, a key priority.

"If cloud services are commoditized, providers should offer stronger customer guarantees," said Daryl Plummer, managing vice president and Gartner fellow. "However, service providers either do not offer protections or vary greatly in the protections they do offer. We believe that the Global IT Council for Cloud Services can facilitate improvements in industry practices that will benefit not only IT customers and clients, but also developers, vendors and other stakeholders."

The Gartner Global IT Council for Cloud Services is examining the most pressing issues affecting cloud computing today, and the Council has identified six rights and one responsibility of cloud computing services consumers that it believes will enable providers and consumers to work more productively together.

They include the right to retain ownership, use and control one's own data – Service consumers should retain ownership of, and the rights to use, their own data. Then there is the right to service-level agreements that address liabilities, remediation and business outcomes – All computing services – including cloud services – suffer slowdowns and failures. 

The right to notification and choice about changes that affect the service consumers' business processes, says that every service provider will need to take down its systems, interrupt its services or make other changes in order to increase capacity and otherwise ensure that its infrastructure will serve consumers adequately in the long term.

There is next the right to understand the technical limitations or requirements of the service up front – Most service providers do not fully explain their own systems, technical requirements and limitations so that after consumers have committed to a cloud service, they run the risk of not being able to adjust to major changes, at least not without a big investment. 

It also talks about the right to understand the legal requirements of jurisdictions in which the provider operates – If the cloud provider stores or transports the consumer's data in or through a foreign country, the service consumer becomes subject to laws and regulations it may not know anything about.

And finally the right to know what security processes the provider follows – With cloud computing, security breaches can happen at multiple levels of technology and use. 

The responsibility to understand and adhere to software license requirements – Providers and consumers must come to an understanding about how the proper use of software licenses will be assured. On the one hand, providers must be held harmless, if the service consumer puts the software it licenses from a third party in the cloud yet violates the licensing agreement.

On the other hand, the provider should not agree to an audit directly by the vendor, if the consumer owns the software licenses. The service consumer must take charge of the audit, because it needs to consider the whole context – both what the consumer runs in the cloud (perhaps using several service providers) and what it runs on its own infrastructure.