1. Janine Anthony Bowen, Esq., CIPP 404-527-4671 January 20, 2009 © 2010 J. A. Bowen. All Rights Reserved. Understanding, Minimizing and Mitigating Risk in Cloud Computing

4. Three Service Models SaaS (Software as a Service) The consumer uses the provider’s applications running on a cloud infrastructure. (e.g. Google Apps) PaaS (Platform as a Service) The consumer has control over the deployed applications and possibly application hosting environment configurations. (e.g. Force.com) IaaS (Infrastructure as a Service) The consumer is able to deploy and run arbitrary software. (e.g. Amazon EC3) Infrastructure As A Service Platform As A Service Software As A Service

5. Service Model Relationships Gerard Briscoe, London School of Economics and Political Science, Alexandros Marinos, Faculty of Engineering & Physical Sciences, University of Surrey, “Digital Ecosystems in the Clouds: Towards Community Cloud Computing” March 2009

6. Understanding the Differences: Cloud vs. Outsourcing vs. ASP Cloud Computing Outsourcing ASP Location of Service/Data unknown known known Owner of Technology provider company provider Contract non-negotiable highly negotiated negotiated Contract Risk company provider shared Scalability Yes No Maybe

7. Cloud Contracting Models: License vs. Service Agreement License Agreement Service Agreement Necessary in Cloud License Grant Yes. No. No. No physical transfer of SW. IP Infringement Protection Yes. No. No. No physical transfer of SW. Ownership Protection Yes. Yes. Yes. Use of cloud does not translate into ownership transfer.

8. Cloud Contracting Models: Online Contract vs. Standard Contract Online Contract Standard Contract Negotiable No. Yes, generally. Limits Placed on Provider ’ s Liability Yes. Very little or no liability to provider. Yes. Risk shared by provider and user. Risk in the Event of Problems Born by user. Born by party responsible.