Enter the Cloud with Caution

Here are nine questions to ask before trusting your company's data or computing tasks to an outside provider

Managing computer systems distracts attention from your real business. Computers crash, and you fume helplessly as the IT staff restores your ordinary workflow. Just when everything seems to be stable, your software needs to change, or your systems are too small or too slow. You upgrade, but that only leads to more disruptions. The Internet brings you attacks as well as connectivity. You worry about backing up your data, but you also worry about copies in laptops that can be stolen from employees' cars.

Especially for a small business, the overhead can be crushing. You can't afford to hire expert staff, so you contract out some of the work. But now you are losing control. More than one "computer consultant" has upgraded computer systems, swapping old disk drives for new ones—and has then made a few extra bucks by selling the used drives on eBay (EBAY). With the disks went e-mails from lawyers, company financial data, and clients' credit-card numbers.

No wonder the idea of computing in "the cloud" is so appealing. Why maintain computer systems in-house when, as Scott McNealy of Sun Microsystems (JAVA) put it more than a decade ago, "the network is the computer." Use a service to store and crunch your data. All you need are personal computers and a fast network connection.

Google (GOOG) energized the cloud craze in 2004 by offering free e-mail service with a gigabyte of storage. Advertising attached to incoming mail pays the bills. The service is reliable, simple, ubiquitous, capacious, and free.

Today, all the major players are in the game, and many minor players too. Google added Google Docs so a company's dispersed offices can share memos and databases without e-mailing them. You need never again wonder who has the latest version. Microsoft (MSFT) joined the fray with Office Live. IBM's (IBM) Blue Cloud and Amazon's (AMZN) "Simple Storage Service" and "Elastic Compute Cloud" offer massive computing capabilities to small and large customers alike. Prices are low, and you pay only for what you use. Sun has partnered with Amazon to offer its database systems as a cloud service. Let others worry about projecting demand and acquiring systems that may be obsolete almost as soon as they are delivered; you focus on your widget business. What's not to like about these deals?

For Your Consideration

In fact, the deals are great—sometimes. But a lot depends on the details. To ensure you don't regret your company's ascent into the clouds, here are some key questions to bear in mind.

• Who else might see the data? You may have a collective bargaining agreement assuring your employees that their e-mail won't be read, even by software. Certain industries fall under data privacy regulations that may make the cloud inappropriate.

• What if you don't pay the bill? Might all your data get deleted abruptly if the check gets lost in the mail?

• Does the cloud back up your data? A typical contract stipulates that you bear "sole responsibility for adequate security, protection, and backup."

• What if your service provider enters your business? The information giants are always investigating new business lines. Are you providing a potential competitor access to your data?

• What if you do business abroad? Your memos and e-mail are subject to USA Patriot Act searches when they cross the border if the "cloud" is actually located in the U.S. You may never know they have been searched. The U.S. government has clandestinely searched domestic electronic communications, too—perhaps improperly, perhaps not.

• What does the cloud expect of you? Are any of your documents "discriminatory based on race, sex, religion, nationality, disability, sexual orientation, or age?" Then you can't store them at Amazon. Might some of them infringe copyrights? Then Google might terminate your service. You can hope the provider would exercise good judgment before deleting your data, but you shouldn't stake your business on it.

• What's the access control? Does a single password provide access to everything, so that an intruder could delete your entire business? Is password strength industry-standard? Can you turn off access when you terminate an employee?

• Do you want your employees getting advertising (perhaps from competitors, or for naughty products) along with their e-mail? Consider paying a little to be advertising-free.

• What is your exit strategy? If you aren't satisfied with the cloud, how much will the migration in both directions have cost, and will you still have employees with the skills needed to manage your data?

Triage, Secure, Back Up

So what should you do? Compare vendors, read the fine print, involve your lawyers and best technical minds, and think ahead. Three useful principles:

Triage. Databases are not all the same. Manage more tightly the stuff your business could not afford to lose.

Secure. Especially if your sensitive information is in the cloud, learn and exploit the encryption and password features built into all professional office software.

Back Up. Don't leave the only copy with a single cloud provider. Make periodic backup copies in another place.

Cloud computing is a fine thing. Just don't put your head in the clouds along with your data.

    Before it's here, it's on the Bloomberg Terminal.