Managing cloud responsibilities

You need to understand who is responsible for what when you use cloud to deliver a product or service.

Everyone who uses cloud needs to understand where their responsibility ends and the cloud provider’s starts. This includes:

• executives
• product owners
• multidisciplinary teams

You may not have a deep understanding at all levels, but you should understand the parts that you’re responsible for.

If you are offering shared services, this becomes even more important.

Shared services

Your agency may offer shared services to other agencies. The cloud-based services you offer may include:

• infrastructure or platform as a service
• finance
• human resources
• procurement
• customer services

There are 3 levels of shared service responsibility:

• fully open
• partially open
• mostly managed

Fully open services give your users full control and accountability for the risks of cloud. There is a single point for cost management. Your users may also get discounts for high usage.

Partially open services put some restrictions on your cloud workspace. This can make it more secure and manageable.

Mostly managed services mean your users can only perform a small number of pre-approved tasks. This can make it more secure and manageable but less usable.

When you offer shared services, make sure you:

• meet your user needs
• let them know what their responsibilities are
• remove obstacles that reduce their agility

For example, your users should know who is responsible for applying system updates. They should be able to change their cloud-based products when they need to. They shouldn’t have to wait for your approval to do this.

Service-level agreements

A service-level agreement is like a contract for the cloud service. It describes what you can expect of your cloud service provider.

Your service-level agreement could include information about:

• availability of the service
• durability of your data — how well it maintains its accuracy over time

Building reliable services

Cloud providers may offer services like building blocks. Each one of these services may have a service-level agreement.

You can put these services together to suit your needs. If you do this well, you can make your product more reliable. For example, if a cloud service goes down in one region, you can access it from another. If one part fails, the whole product doesn’t fail.