Cloud Computing & Its Impact on Software Licensing 1 Cloud Computing and its Impact on Software Licensing Presented By Tom Crawford & Gretchen Kwashnik

Cloud Computing & Its Impact on Software Licensing 1

Cloud Computing and its Impact on Software Licensing

Presented By

Tom Crawford & Gretchen KwashnikMay 15, 2012


What You Will LearnWhat You Will Learn

• Evolution & Characteristics of Cloud Computing

• Cloud / Virtualization Models• Cloud Deployment Models• Key Considerations & Agreements

When Moving to the Cloud


What is Cloud Computing?What is Cloud Computing?

• Model for enabling:

– On-demand network access

– A shared pool of configurable computing resourcese.g., networks, servers, storage, applications, and services

– Rapid provisioning

– Less management or service provider interaction

Source: National Institute of Standards and Technology (NIST)


DiscussionDiscussion

• Additional definitions?


Evolution of Cloud ComputingEvolution of Cloud Computing


Changing CharacteristicsChanging Characteristics

Need collaboration for service

Some network access

Multiple resources

Broader scalability

Optimization tools

CloudCloud

On-demand self-service

Broad network access

Resource pooling

Rapid elasticity

Automatic optimization

MainframeMainframe Client ServerClient Server


Cloud / Virtualization ModelsCloud / Virtualization Models

Packaged Packaged SoftwareSoftware

Applications

Data

Runtime

Middleware

O/S

Virtualization

Servers

Storage

Networking

Infrastructure Infrastructure (as a Service)(as a Service)

Applications

Data

Runtime

Middleware

O/S

Virtualization

Servers

Storage

Networking

Platform Platform (as a Service)(as a Service)

Applications

Data

Runtime

Middleware

O/S

Virtualization

Servers

Storage

Networking

SoftwareSoftware(as a Service)(as a Service)

Applications

Data

Runtime

Middleware

O/S

Virtualization

Servers

Storage

Networking

You

Man

age

You

Man

age Yo

u M

anag

eM

anaged By Vendor

Managed By Vendor

Managed By Vendor


Cloud Deployment ModelsCloud Deployment Models

PublicPublic

Off premiseat provider

General public

Users’ concernsand purposes vary

CommunityCommunity

On or off premise

Multiple, related organizations

Users share the same concerns

PrivatePrivate

On or off premise

Limited to asingle organization

Used by variousbusiness units

HybridHybrid

On or off premise

Determined byeach cloud

Users’ concernsand purposes vary



• Who has participated in procuringor deploying applications to a cloud?

• What level (IaaS, PaaS or SaaS) andtype (public, private, community or hybrid)of deployment models were utilized?


ForecastForecast

Approx. 1/3 of U.S. organizations are using cloud computing

21% avg. annual savings for applications moved to the cloud

It was predicted that 20% of businesses would not own IT assets by 2012, a trend driven by cloud computingNo hardware. No licenses. No networks. No security software.Just a browser with an internet connection


Why Move to the Cloud?


1. Cost Reduction 1. Cost Reduction | Why Move to the Cloud?| Why Move to the Cloud?

• Reduced cost of building andmaintaining IT infrastructure

• Specific use scenario should be analyzedto determine whether or not a cloud deliverymodel may result in greater cost avoidance


2. Speed & Flexibility 2. Speed & Flexibility | Why Move to the Cloud?| Why Move to the Cloud?

• Reduction of complex procurementand deployment cycles

• Self-service provisioning for addingfunctionality and new users

• Ability to scale up and down as needed


3. Greater Mobility 3. Greater Mobility | Why Move to the Cloud?| Why Move to the Cloud?

• Access your software and inherent data fromany device that has access to the Internet


4. Easier Collaboration 4. Easier Collaboration | Why Move to the Cloud?| Why Move to the Cloud?

• Pre-established application programminginterfaces (APIs)

• Integrates popular applications for sharing of information to drive results


5. Heightened Security 5. Heightened Security | Why Move to the Cloud?| Why Move to the Cloud?

• Provider’s often have cutting-edge,secure, and traceable data access trails

• Most cloud servers will be hosted in physically secure data centers with strict access control for their own staff and no access for unauthorized personnel

• Some question the heightened security



• Explain your experience with deploying applications results in a cloud:

– Cost savings

– Speed and flexibility

– Greater collaboration across entities

– Security


Key Considerations


Traditional Licensing vs SaaSTraditional Licensing vs SaaS

TraditionalTraditional

One-time upfront payment

License to use inperpetuity (no term)

Customizations maybe supported

Ability to have custom code

More influence to ask for a specialorder from their menu items

Normally hostedon-premise by organization

SaaSSaaS

Subscription-based pricing

License to use only whilesubscription is current (term)

Customizations normallynot acceptable

Focus on standard offering

Little to no influence to order items noton the menu (only their standard items)

Normally hostedoff-premise by provider


Example: MusicExample: Music

Hosted: iTunes®Hosted: iTunes®

Off premise

Use provider’s portal to play music

Accessed from anywhere there is internet access

License to listen in perpetuity

SaaS: Pandora®SaaS: Pandora®

Off premise

Use provider’s portalto play music

Accessed from anywhere there is internet access

License to listen only while subscription is current

Traditional: CDTraditional: CD

On premise

Need your ownequipment to play music

Accessed only if in possession of CD and onsite

License to listen in perpetuity


Rights to Use the Service Rights to Use the Service

• Subscription-based

– Normally includes the right to use the service plus support and maintenance, hosting and storage fees

• Extend the “internal use only” definition

– Ensure third party contractors can use the service

– Contract example: Users may include but are not limited to employees, consultants, contractors and agents of Organization,or third parties with which Organization transacts.

• No hidden fees


Payment TermsPayment Terms

• Monthly or annual payment schedule• Locked in for an extended term

– Achieve greater discount by locking in longer

• Minimum number of user commitments– Payment usually starts upon contract signing even for a

sandbox or other non-production use

– Negotiate 2+ user types: read only and full

– Ensure you have the administrative ability to add and remove users without provider’s assistance

– Fees are not based on actual usage


Future FeesFuture Fees

• More users– Volume tiered pricing

• Pure tiers and not step-through

• More storage– Per user or instance

• “New” functionality – Substantially similar or enhancement– Part of core product or provider’s original intent

• Energy surcharge



• Who has entered into a SaaS or other subscription-based license agreement?

• Were the applications hosted by thePublisher or a third party?

• Were the applications deployed in acloud with virtualization or a traditionalhosting environment?


Application Capabilities MatrixApplication Capabilities Matrix

Contract example:

1. Standard: Included in current version or a configuration

2. Custom: Needs to be developed

3. Future: On current 1-2 year roadmap

4. NA: No plans to develop

In the “3rd Party” column, please designate whether or not such IP for the functionality is owned/controlled by a third party.


Application Capabilities MatrixApplication Capabilities Matrix


Key Agreements

Establishing the Groundworkfor Moving Forward


Underlying SaaS AgreementUnderlying SaaS Agreement

• Information Security & Confidentiality

– Multi-tenant vs. single tenant environments

– Perform an onsite risk assessment upfront

– Secure code development standards—ability to test

– Who can access your data—user permission roles



• Data Rights & Responsibilities

– Data at rest and data in transit (Government data always belongs to the government)

– Obtain data flow diagram and levelsof encryption upfront

– Destruction and return of data requirements

– Data will be in usable format



• Intellectual property indemnification

• Rights to request software customizations:Cost and ownership of any such software customizations (work product)

• Disaster recovery and business continuity

• Termination conditions and cooperation


Addendums: Master AgreementAddendums: Master Agreement

• Support & Maintenance Agreement– Levels of support available and severity of issues – Response and resolution times – Remedies

• Service Level Agreement– Uptime and performance levels– Remedies

• Professional Services Agreement– Terms & Conditions for engagements with provider– Training options


Support & Maintenance: ProductSupport & Maintenance: Product

• Identify:– Severity levels– Response and resolution times – Provider’s escalation process and contacts

• Notice period before all releases or ability to “opt-out”

• Ensure support for third party integrations are included

• Define remedies for failed turnaround times– How to submit a claim for a refund or credit– Ability to terminate the entire agreement without further

liability under certain circumstances


Examples: Response Time for Support CallsExamples: Response Time for Support Calls

Issue SeverityIssue Severity Response Time toResponse Time toAcknowledge IssueAcknowledge Issue

Response TimeResponse Timeto Fix Issueto Fix Issue

Level 1 (LOW) Does not have significant

impact on users

Return call or email within 8 hours

Provide fix within 30 days

Level 2 (MODERATE)Causes some user issues,

but most processes are functional

Return call or email within 4 hours

Provide fix within 5 days

Level 3 (HIGH)Significant impact

on system use

Return call or email within 1 hour

Provide fix ASAP(24 hours or less)


Service Level Agreements: HostingService Level Agreements: Hosting

• Define uptime calculation and planned maintenance– Identify the provider’s standard maintenance window– Request at least 48 hours’ notice

• Define performance level and testing mechanism– Content load ping test– Third party tools

• Confirm what monitoring and alerts are available

• Define remedies for failed uptime or performance– How to submit a claim for a refund or credit– Ensure refund or credit for every hour or day of delay– Ability to terminate the entire agreement without further liability

under certain circumstances


Measuring the SLA for MaintenanceMeasuring the SLA for Maintenance

Criteria Measurement Comments

Minutes in a 90 day period 129,600 minutes

Planned down time (assume 18 hours) 1080 minutes This is a standard amount of time

for system maintenance

Remaining minutes forscheduled up-time 128,520 minutes.

SLA 99.9% This is a moderate standard;5 nines (99.999%) is very high

Minutes of expected up time 128,391.5 minutes.

Allowable minutes ofunplanned downtime

128.52 minutes ~ 2.1 hours over 90 days!

Little time for unplanneddown time

Penalties Varies Usually a credit is given for missing the SLA

System Availability Example – 99.9%


Importance of Uptime PercentageImportance of Uptime Percentage

95.00% =

98.00% =

99.00% =

99.90% =

99.96% =

107 hours of downtime



2 hours of downtime

51 minutes of downtime


Example: Termination LanguageExample: Termination Language

• If Customer experiences:

– More than 6 unexpected downtime hours resulting from 3 or more non-consecutive service interruption events during any rolling 30 calendar day period

OR – More than 24 consecutive unexpected downtime

hours due to any single event

Customer shall be allowed to immediately terminate the Agreement and any Order Forms with Provider, and shall not be liable for any future committed fees beyond the termination date.



• Who has experience managingresponse time and uptime SLAs?

• Discuss variations you have seen onSLAs, penalties, termination rights, etc.


Wrap-UpWrap-Up

Cloud computing is a broad and evolving term

Each software application and use has different contractual concerns, including data risks and ownership rights

Include a Applications Capabilities Matrix as part of your selection process and final contract

Ensure the Service Level Agreement has teeth

Document escalation process with the provider

Plan for the worst—ensure cooperation during a data breach or termination


ResourcesResources

• DoD ESI SaaS Toolkit– www.esi.mil/saas_toolkit

• DoD ESI White Paper: Best Practices for Negotiating Cloud-Based Software Contracts

– http://www.esi.mil/contentview.aspx?preview=true&id=273&type=1

• CIO Council Guide: Creating Effective Cloud Computing Contracts for the Federal Government: Best Practices for Acquiring IT as a Service


Questions

Tom CrawfordIT Contracting SpecialistBUYSIDE PARTNERSEmail: [email protected] Phone: 484-832-2037

Gretchen KwashnikIT Supplier Management Team Leader ING DIRECT, USAEmail: [email protected] Phone: 302-650-3932

Documents

Cloud Computing & Its Impact on Software Licensing 1 Cloud Computing and its Impact on Software Licensing Presented By Tom Crawford & Gretchen Kwashnik