Stormy weather? Cloud Computing caveats

The concept of "cloud computing" suddenly seems to be going mainstream - as well as receiving several emails advertising Sitepoint's latest book "Host Your Website in the Cloud" (about how to use Amazon's cloud computing platform AWS), I've seen a whole bunch of articles and events about various aspects of the Cloud - not all of them uncritical (for example Dai Davis' BCS talk I previously reported).

Today I came across another article, "Cloud Computing caveats" by James Hayes (on the IET website) which draws attention to some of the issues that businesses should perhaps be considering before rushing to use cloud-based services. Ignoring the first cavaet ("Is it new?"), which really just gives a brief history of how today's cloud evolved from what went before (summary: internet connections have only recently achieved the capacity and resilience required to make them possible), the remaining concerns are much the same as those expressed in Dai's talk:

1. Data ownership: once you put your data into the cloud, you've given up a degree of control. Do you understand the implications, and are they acceptable both legally and operationally?
   
2. Service level agreements: if the service becomes unavailable for some reason, what reassurances do you have from your cloud provider about how long it will take to put it right? What would the impact of downtime be on your business?
   
3. Risk appraisal: cloud services might have a low up-front cost that is particularly attractive to smaller enterprises, but have they properly assessed the risks (and potential costs - not just financial) if the service encounters problems?
   
4. "Cloud governance": in the traditional model of enterprise software procurement, a company's IT department could exercise a high degree of control over what software was used there. The ease of access to cloud computing services offering equivalent functionality threatens to bypass these controls (including assessments of longer term costs and risks).
   

The software geek inside me finds the technical aspects of cloud computing technology absolutely fascinating (which is why I want to get the Sitepoint book, even though I don't really need it), and as a consumer I'm using all kinds of cloud-based services. But my internal project manager recognises that it's also vital important to understand any wider implications of a particular technology used in a specific context - best summed up by a quote from one of the people interviewed in James's article: "None of the risks associated with Cloud are 'showstoppers' for all enterprises and for all specific use cases within any single enterprise ... but they will be for some."