Study details challenges in government cloud contracting

What: An IBM Center for the Business of Government study released Nov. 18 titled "Cloudy with a Chance of Success: Contracting for the Cloud in Government," by Shannon Howle Tufts and Meredith Leigh Weiss of the University of North Carolina at Chapel Hill.

Why: The report explains 12 major issues that should be addressed in all cloud computing contracts based on detailed analysis of five public-sector contracts for cloud services. Issues discussed range from traditional mainstays such as pricing to newer issues, including data ownership, access to data, confidentiality, network security, privacy, disposition of data, data or security breaches, and data storage location.

Cloud contracts are growing in popularity in the public sector because they often offer increased capabilities and efficiencies and -- potentially -- lower costs. However, this study also highlights risks and challenges involved in implementing cloud contracts. The report culminates in a series of recommendations regarding each case study and a list of best practices in negotiating cloud computing contracts.

Verbatim: Best practices in cloud computing:

• Best Practice One: Government managers should not simply sign vendor-supplied master agreements, service-level agreements, acceptable-use policies, and/or contract terms.
• Best Practice Two: Government managers should carefully review, negotiate, and modify the terms and conditions of the contract to meet the subscribing organization's needs and legal requirements.
• Best Practice Three: Government agencies should employ a collaborative contract negotiation team consisting of experienced information technology, legal, procurement, and business professionals.
• Best Practice Four: Government managers should identify which contract provisions are must-haves versus nice-to-haves.
• Best Practice Five: Government managers must be willing to seek alternative providers or solutions in the event that the government's contract terms cannot or will not be met.
• Best Practice Six: Government agencies should improve legal education for IT professionals, and hire legal professionals with technical expertise. There are a myriad of issues to consider and discuss with legal counsel prior to and during cloud services negotiations. Johndavid Kerr and Kwok Teng sum it up succinctly by saying that "each organization must conduct a thorough and diligent risk assessment of the potential threats of low to high risk inherent in cloud computing environments, and must ensure that all management and operational strategies and initiatives incorporate an optimal mix of cost-efficient processes, policies, and controls to mitigate against these risks. Each entity must determine which issues are of greatest concern and react accordingly in the hopes of minimizing the potential negative impact of a problem."

Full report: businessofgovernment.org.