Why the need for recognised Cloud certification?

CLOUD SOLUTIONS represent the most significant development in the delivery of IT in a generation, offering end users the three-fold benefits of reduced costs, enhanced operational availability and on-demand scalability.

Furthermore, Cloud technology levels the playing field for all IT consumers enabling them to participate regardless of size due to the unique pay-as-you-consume financial model, thus enabling small and medium-sized enterprises (SMEs) to access the same technology and gain the technical agility that has previously been the reserve of large enterprises.

According to the Cloud Industry Forum’s fifth annual Cloud adoption survey, 84 per cent of UK businesses have formally adopted Cloud services within their organisation. Moreover, Cloud is helping organisations meet their business objectives: three quarters (76%) of those that sought to reduce their capital expenditure have managed to do so; 83% have improved uptime/reliability of their IT; and 74% have successfully reduced the risk of data loss by using Cloud services.

But while the overall adoption rate increases year-on-year, end users (and notably SMEs) consistently identify three barriers to adoption of Cloud solutions. Two are technical (relating to data security in the Cloud and portability of data) and are the subject of significant technical developments and standards work. The third barrier relates to the issue of trust. In a market of online delivery models with many new vendors, how does a potential customer know that the company with which they wish to work will provide a secure, stable, and effective solution that enables them to retain control of their data throughout the contract and after it expires?

Plainly, greater clarity about data protection, privacy and sovereignty is needed. Standards setting organisations and certification bodies certainly have a role to play in this by defining, encouraging and validating best practice for Cloud Service Providers (CSP) and improving end user education.

However, Cloud is still a relatively young technology and very few clear Cloud standards have thus far emerged. The most promising work in standards development is the ISO/IEC SC83 working group, which aims to introduce a universal best practice standard for Cloud Computing; however, as is the case with all ISO standards, they take time to materialise due to the level of consultation required.

One standard that is rapidly gaining ground in the UK is the Cloud Industry Forum’s Code of Practice (CoP), which aims to ensure that end users have enough information available to make an informed decision about their migration to the Cloud. This information relates to three areas of concern: transparency, capability and accountability. Equipping end users with this information is the first step towards trust. The use of the CIF Certification Mark on a vendor’s website serves two clear purposes: it makes a public declaration of professional and commercial intent on the part of the Cloud Service Provider and it provides a visual mark of recognition that engenders confidence in the end user that the organisation is open and professional in its commercial activities.

CSPs need to ensure they operate their businesses and services in a fully open and transparent manner where it is clear to their customers – existing and new – that they are trustworthy and capable of offering the services they claim to be able to offer. The CIF CoP is one of very few schemes which offers this much needed reassurance to end users regarding the organisations they choose to work with.

After all, let’s not forget whom certification is ultimately for: the end user. In this relatively young industry, in which it’s easy to seduce customers with false claims over security and data protection, certification provides much-needed independent endorsement of providers’ promises. As in any market, independent validations that allow customers to make more educated buying decisions have to be of value. The Cloud Industry Forum has taken important steps in providing this foundation in what is a fast changing and, to many, a new technology sector.

Quite simply, certification schemes, such as CIF’s CoP, enable professional Cloud Service Providers to demonstrate with clarity their ethics, practices and processes through an independently recognised and credible body in order to build trust with prospective customers.