Cloud computing should pave the way for greater enterprise IT outsourcing. Yet, for all its well-documented economic, competitive and productivity benefits, many organizations have so far held back from jumping on the bandwagon, especially in deploying mission-critical applications.

 

Concerns around security as well as regulatory compliance have been major hurdles. The existence of standards like the ISO 27002, SAS 70 and SSAE 16 Type I have not given end-user organizations a high level of assurance or confidence in the service that they are buying. Yet, the perception that cloud computing is less mission-critical may be unfounded.

 

“It is increasingly difficult for IT organizations to support effectively the demands of business in an agile and cost-effective way on a global basis,” said Mark Smith, managing director for Asia at Savvis, a CenturyLink company and provider of enterprise cloud services. “The technologies of the cloud and [our] ability to support mission-critical enterprise applications in the cloud have really improved in terms of security and reliability and quality of SLAs.

 

“There’s been a lot of discussion around the ability of enterprise-grade cloud, to support mission-critical applications. Typically, we don’t see a lot of migration. It’s new applications that enterprises bring on board. That’s a very interesting more recent trend.”

 

Indeed, Savvis is supporting mission-critical applications like payroll and procurement systems, Web services such as online storefronts, and e-ticketing systems in the cloud for many airlines and blue-chip companies.

 

“Companies are now consuming Infrastructure-as-a-Service,” said Ben Williams, regional lead solutions architect for Asia at Savvis. “That offers a lot more flexibility, agility and scalability than three or four years ago. That’s partly driven by the financial climate, pushing companies to [outsource their infrastructure to a company like Savvis instead of building their own].”

 

Savvis recently completed its annual Statement on Standards for Attestation Engagements (SSAE) No. 16 and International Standard on Assurance Engagements (ISAE) 3402 combined examination.

 

The SSAE 16 Type II examination means that an independent service auditor has formally evaluated and issued an opinion on the description of selected Savvis systems and the suitability of the design and operating effectiveness of applicable controls.

 

The SOC 1 examination assesses controls at service organizations that are relevant to user entities' internal controls over their financial reporting. The SSAEs or attest standards enable Savvis to report on subject matter other than financial statements such as controls related to managed security services, change management, service delivery, support services, environmental services, logical and physical security, managed hosting services and managed storage and backup services.

 

SLAs and certifications aside, organizations get more out of their cloud service providers by allowing them to be an extension of the organization rather than just a supplier or vendor. “One important step in the process of delivering services is the whole design process for implementation,” Smith said. “We work closely with the organization to work through the design of what [the cloud service should be].