The Cloud Challenge: understanding what is "market"?

Transcription

1 The Cloud Challenge: understanding what is "market"? ANDREW JOINT ED BAKER 05 / 03 / 2014

2 Now this is not the end. It is not even the beginning of the end. But it is, perhaps, the end of the beginning

3 Helpful Links Wifi: KEMP_GUESTWIFI Wifi Password: K3MPL1TTL3 #KLCLOUD 3

4 Agenda Developing offerings/models and their impact Evolving legal issues The evolution of third party involvement/impact What is market for cloud Ts&Cs Coffee Break Panel discussion _4

5 Previously, in KL Cloud CCFs 5

6 Last months _6

7 I am growing losing some illusions perhaps to acquire others.

8 In the beginning _8

9 And now Bassetts computing SaaS PaaS IaaS _9

10 A maturing market-place of who Model Made up of Examples SaaS Apps PaaS APIs, Apps, Servers IaaS Servers, Networks BPaaS Processes, Iaas, PaaS, Saas _10

11 Development of the how Closed Private Open Public Custom Managed Virtual Community Public Cloud Private Cloud Private Cloud Private Cloud Private Cloud Owner Customer Customer Provider Provider Provider Operator Customer Provider Provider Provider Provider Service Access Closed Closed Closed Limited group Open Level of Control Full High High Low None Security / Location As selected by Customer As selected by Customer As selected by Customer As described by Provider As described by Provider Legal Terms Negotiable Negotiable Negotiable but clear impact on price for changes Limited outside of standard agreed terms Standard terms only - nonnegotiable _11

12 What does this mean in 2014? Choice Rise of bundled hybrid solutions e.g.: Custom Private Cloud for sensitive customer database info Virtual Private Cloud for cloud bursting transactions in peak Public Cloud for non-sensitive / confidential data Knock-on impact on complexity of terms Rise of 3 rd P impact where multiple service sources Potential lack of clarity for customers on the who / what / where Challenge to the legal / regulatory obligations requiring certainty / detail _12

13 I know it's not much, but it's ok, keep on moving on anyway.

14 Evolving Legal Issues We still have very little cloud specific legislation, but Where are we with the UK/EU Legislation? Standards Terms EU Parliament offers a resolution Net neutrality _14

15 Data Issues in the Cloud Where are we on Data: Security Protection Ownership _15

16 Cloud and the Internet of Things Cloud makes IoT possible The legal nexus around the cloud and machine made decisions Fairly clear? Does that make it right? What are the next key legal issues? _16

17 there were three of us in this marriage, so it was a bit crowded

18 Cloud supply chain - involvement of third parties Increasing in cloud contract value is not simply to do with volume of consumption, but is also arising as a result of cloud services being packaged together: Digital advertising & agencies SaaS SaaS SaaS IaaS PaaS IaaS _18

19 Cloud supply chain - involvement of third parties Does the contract match the solution? 1 contract or multiple? SaaS Digital advertising & agencies Contract with Supplier 1 PaaS IaaS Contract with Supplier 2 Contract with Supplier 3 Customer _19

20 Cloud supply chain - involvement of third parties Does the contract match the solution? 1 contract or multiple? SaaS PaaS Prime Contract with Supplier 1 Customer IaaS _20

21 Cloud supply chain - involvement of third parties Key point as to whether the Supplier is contractually accepting responsibility for the rest of the cloud layer/stack - there is not a uniform approach here! From the Supplier perspective, it does not want to be contractually responsible for areas of cloud delivery chain that (i) are not under its control; and (ii) that it is unable to negotiate and contractually back-off end user risk with. From the Customer perspective, where a customer is being sold a cloud solution, it expects a single prime contract with items not provided by the supplier to be a subcontract issue of the supplier. Increasing trend of major suppliers to disclaim all liability and contractual scope for third party aspects of services and require customer to contract direct with rest of cloud supply chain. _21

22 88.2% of statistics are made up

23 Market positions Fast moving nature and rapid evolution of cloud services has resulted in divergent approaches in contractual positions. Some attempt to analyse the market: - Cloud Industry Forum (CIF) white paper Contracting Cloud Services, a Guide to Best Practice (2011) - Cloud Legal Project, Queen Mary, University of London (2010, updated 2013) _23

24 Market positions Two broad categories of cloud services: 1. Lower value, less complex, single service solution (e.g. cloud storage IaaS) supplier standard terms, little scope for negotiation. 2. Higher value, more complex, cloud solutions leveraging multiple cloud services, more business critical in nature (e.g. combination of IaaS, PaaS and SaaS) supplier standard terms, but more scope for negotiation in certain areas _24

25 Market positions (lower value/less complex) Area Applicable Law Market Position Determined by location of supplier Contract variations Unilaterally by supplier by posting updates on website Location of data Divergent approach between EU/US based suppliers. Service warranties as is / as available. SLAs a minority offering. Recoverable losses No indirect losses recoverable. Broad direct heads of loss excluded. Loss of or corruption to data often excluded! Limitation of liability All supplier liability capped, linked to fees paid in 12 months _25 or low monetary caps. No limit for Customer.

26 Market positions (higher value/more complex) Even negotiated contracts are almost always a variation of the Supplier s standard terms. Increasing public sector use of cloud services are forcing providers to contract on more customer friendly terms. Movement by some suppliers are forcing others to follow suit and remain competitive. Extreme supplier positions are also becoming increasingly challenged by high value enterprise deals. _26

27 Market positions (higher value/more complex) Top 7 types of negotiated terms: 1. Limitation of liability 2. Service levels 3. Security and data privacy 4. Termination rights 5. Exit assistance 6. Unilateral change of service features 7. IPR ownership/licensing _27

28 Market positions (higher value/more complex) Limitation of liability _28

29 Market positions (higher value/more complex) Limitation of liability what's market? Driven by combination of price and solution type % of fees over 6-12months is typical In SaaS/PaaS, particularly where large amounts of personal data involved, unlimited liability or high caps for IPR and DP Indirect losses are rarely accepted Data loss/corruption liability very varied Q of who should be backing up (distinction between IaaS and SaaS/PaaS). _29

30 Market positions (higher value/more complex) Service Levels: _30

31 Market positions (higher value/more complex) Service Levels what's market? Many suppliers don't offer up front, and readily acknowledge a minority of customer base requests this Typically cover availability/up time, but some providers offer more metrics such as support break/fix and response performance Users typically required to monitor SLA performance, sometimes published on website Service Credits typically the remedy for SLA breach, requiring the Customer to notify its intention to claim this remedy - NB this is often an exclusive remedy _31

32 Market positions (higher value/more complex) Exit: _32

33 Market positions (higher value/more complex) Exit what's market? Most providers agree to return data upon termination in a pre-agreed format, CSV being the most popular. Post termination period where customer and access data varies between 0-90 days. Some providers reserve the right to not provide this in a termination for breach scenario is that reasonable? Most providers do not offer any form of migration assistance to an alternative cloud service. _33

34 _34 COFFEE

35 The Panel Chris Macfarlane Managing Counsel at VCE Technology Solutions Limited Marcus Hughes - Executive Director in the Legal and Compliance Division at Morgan Stanley Nicola Fulford Data Protection Partner at Kemp Little Jim Odell Partner and Cloud/IT sourcing specialist at Kemp Little Consulting _35

36 Contact Us Andrew Joint Commercial Technology Partner Ed Baker Senior Associate, Commercial Technology Nicola Fulford Data Protection Partner Jim Odell Kemp Little Consulting Partner _36