What should third sector organisations be thinking about with regard to cloud?
By Morgan Killick
In the second of a series of two articles on cloud computing Morgan Killick of ESP Projects and Stony Grunow of Third Sector IT look at how third sector organisations should evaluate cloud tools, provide some tips and recommendations, and signpost to more resources.
How Should Organisations Be Evaluating Cloud Tools?
The security of stored data is a major concern, as confidential data on or about individuals (often ‘at risk’ individuals) is often held by third sector organisations. With many – but by no means all – cloud based services, your data is just a username and password away. Anyone in the world can ‘have a go’ at guessing this combination, and such an attack is much easier to launch and far less susceptible to detection than a full frontal assault on your office comms room.
The argument that this has become an ‘acceptable risk’ is largely predicated on the analogy with online shopping, where we again entrust our security to third parties. Yet this is a false analogy. Identity theft and ‘cardholder not present’ card fraud – apart from the fact that they are now massively widespread as a result of these habits - are typically crimes against your bank, and you can get your money back if it happens to you.
But data – particularly sensitive data - is different. It is the storing organisation themselves that is directly responsible for its security. It would be your organisation that would be liable for any breach of confidential data if someone worked out a GoogleDocs security question after looking at a LinkedIn profile; or if a home-workers’ PC was accessed by another member of their family. It is particularly important to consider this security angle –many web browsers can be set to remember passwords or ‘keep me logged in’ – when considering any project for flexible/home/remote working, whether cloud-based or not, but cloud does specifically raise the stakes here.
Additionally, many cloud providers – and Microsoft is a prime example here – do not store your data in the UK. This could be a problem in terms of legal compliance for some organisations and is worth knowing.
The flexibility of an ‘any document, anywhere’ system though is undoubtedly hugely attractive to the sector – it allows organisations to respond and adapt to changing funding streams and gain more geographical proximity to clients and beneficiaries. Just don’t forget that ‘remote access’ is not only possible without the cloud, but is typically more secure and doesn’t necessarily carry those transition costs.
Lastly, do consider those costs very carefully – cloud is often about making the change from capital expenditure to revenue expenditure. It’s often the same money - but many funders prefer the former!
Cloud computing is a tool, not a solution. If you have business process problems, communication issues, HR concerns, or anything like that in your organisation, cloud computing (like any new system) will likely only exacerbate them.
If your yard is overgrown with trees, a chainsaw is a tool, not a solution, and you might cut your arm off if you don’t know how to use it. Cloud computing is a bit like this.
As this article will be read by people evaluating cloud for smaller organisations, I’ll tailor my comments to that.
Cloud solutions are particularly suitable if your organisation:
- Has limited capital and might appreciate a low, fixed cost for IT needs.
- Has multiple offices or people who work from outside the office, as cloud computing usually accommodates that out of the box.
- Has significant numbers of volunteers or staff working from home where configuration of their home computers represents a major hurdle, and supplying them with computers is cost prohibitive.
You know you need to move beyond your current system to a new solution (cloud or not) if:
- Your IT system is seen as a constant obstacle rather than an enabler.
- Your organisation struggles to get it’s hands on relevant internal information
- You can’t record or control communication with donors/clients/beneficiaries.
- Staff members do the same thing over and over again, or have to ‘walk’ business processes through your organisation.
- Your entire organisation’s data is strewn over a bunch of unwieldy excel spreadsheets.
Online backup may apparently cost more than an external hard drive, but when thieves break in and take your computer and your external hard drive, as happened to a friend, you suddenly realize the difference between on-site and off-site backup. Online backup may in fact be far cheaper than the cost of two hard drives or the hassle of lugging your hard drive home at the end of every day. This apples-for-oranges comparison is difficult to asses using traditional costing.
Remote access can be more secure in the cloud. Let’s compare two realistic possibilities:
1. A Software as a Service (SaaS) Customer Relationship Management (CRM) database with two factor login authentication, plus login restricted to certain hours and a limited range of IP addresses
2. A CRM running on a server stored in an office physically accessible by the entire staff, the cleaning service & building maintenance, the landlord, and quite likely former employees and even former tenants who still have the keys. This server is also accessible over the internet through a method that is not actively monitored or receives regular security audits.
Cloud / SaaS security is not perfect, there are risks with everything. But far too many organisations live in Scenario 2.
While funders may prefer capital expenditure rather than revenue expenditure, even capital expenditure-purchased servers need maintenance and repair, and cloud computing often needs up-front consulting services that have a similar payment structure as capital expenditure. In the end, everything costs the most the first month and has some ongoing costs going forward.
Firstly, don’t get hung up on a particular system or service simply because ‘it is cloud’ or because ‘it is the future’. Every part of a computer system needs to be considered on its merit, not because it falls into an appealing category, or represents part of a wider philosophy of change and transition. Choose a database or CRM system because you have seen the detail and like what it does for you. Choose an email system because it suits the way you work. Fashionable jargon shouldn’t obscure these fundamental requirements.
Secondly, seek out the other side of the argument before you dismiss your current IT provision as ‘old hat’. Remember that cloud enthusiasts are salesmen too! Recently I have seen a spate of organisations trying to adopt cloud services without considering that they might already have tools available that can achieve the same thing without the extra hassle, cost and disruption.
More worryingly, those advising them – often coming from outside the ‘traditional’ IT support sector - appear not to know what those existing systems are doing, or are capable of, or indeed what that organisation will lose as a result or removing or ceasing them. Sure, change is inevitable, but every IT system can be adapted, modified or updated. Change doesn't necessarily imply ditching everything that has gone before!
Finally, do your own, independent research and testing. What is Google Docs actually like to share files in practise? Just how easy is Salesforce to use? Does it meet your needs? Is Exchange Online actually reliable? Be prepared to spend some time at this, because – unlike desktop and server applications – this software is still in its infancy and the people advocating it thus far may not be using IT like you do!
Prioritise outcomes, not methodology (my fancy way of saying, ‘prioritise on what you want, not how you want to get there’). Methodology is important, but it is subservient to outcome. All too often, people hold onto methodology far too tightly. It may be comforting, but it has to change in the face of new circumstances.
You probably learned your current methodology because it was the best way to achieve an outcome given your old system, which was the ultimate goal. With a new system, using the same methodology will result in the wrong outcomes.
For conclusive proof of my claim, try driving to Paris from the UK. After driving off the ferry, you either have to change your methodology (and drive on the right) or give up your objective (of driving to Paris). Pretending that this isn’t the case will have a predictable and unfortunate outcome.
There are hundreds of cloud offerings available and it’s not possible to list them all in this article. However, here’s a brief overview of what Morgan and Stony consider the most likely candidates to consider when evaluating cloud computing. This list largely focuses on SaaS cloud offerings.
All organisations need email. At the most basic level, this is often free with your web-hosting account, but has minimal features. Other organisations might have Microsoft Exchange / Small Business Server. The most viable cloud options are Google Apps and Microsoft’s BPOS. Minimal to no discounts exist for charities.
- Google Apps includes Gmail, Calendar, Docs (document collaboration), Sites (web sites), and forms/surveys.
- Microsoft Business Productivity Online Suite (BPOS) includes Exchange, Sharepoint, Office Communications Online and Office Live. These services can be bought either as a package or individually
In the Customer Relationship Management (CRM) / Data Resource Management (DRM) field, organisations start with anything from a homegrown excel structure to customised MS Access databases or purchase Raiser’s Edge / ProgresCRM / thankQ and many more.
The most prominent Software as a Service (SaaS) player is Salesforce.com, which offers their product either donated or heavily discounted, depending on the size of your organisation. Raiser’s Edge is also planning a SaaS offering of their product. Also see HighRise, Sugar CRMr.
Eventbrite online event registration and ticket sales - free if your event is free
Doodle free meeting and appointment scheduler
While not SaaS, these Cloud based solutions are also worth looking at.
- Dropbox provides shared document storage across Windows / Mac / Linux.
- iDrive provides online, off-site backup, free for the first 2 GB, paid after that, on Windows and Mac.
Accounting packages are difficult to move away from. Quickbooks and Sage are firmly entrenched and at the time of writing have no cloud offering. This may change in future. Accounting software in the cloud is an evolving area and there are SaaS accounting options such as Xero available. However keep in mind that charity accounting is generally more complex than for commercial organisations because of the demands of SORP (Statement of Recommended Practice) and the need to account to Funders.
Charities in the Cloud
- Cloud Computing 101
- Web Based Services - Tales of the Unexpected
- Web Office Tools - The Virtual Office
- What Does Cloud Computing Mean to You? - An Interview from Two Perspectives
- Work smarter, quicker and cheaper with online tools
Published: 29th November 2010 Reviewed: 23rd February 2011
Copyright © 2010 Morgan Killick