Lightning Strikes the Clouds
With cloud services, customers first need to decide what business critical activity can be 'cloud dependent' bearing in mind the risks. They then need to consider the extent to which they mitigate the risk of a single point of failure at the supplier end by keeping some disaster recovery and back-up in house. Arguably the more they keep in-house, the less financial benefits they will get from cloud services. In some cases though, it will be a price worth paying.
When lightning strikes, two key issues arise:
(a) business continuity - what is the supplier obliged to do to avoid business interruption to the customer? and
(b) data risk - if systems are down, can data be lost forever or simply rendered unavailable but always restorable and how is related liability and financial risk shared between supplier and customer?
To offer real benefits, the contract should have sufficient remedies, built into the agreed price, which mean that termination, supplier switching and in the worst case, threats of legal claims (all of which can involve major business interruption) are options of the very last resort. One example is service credits. But be alert to the steps required in order to qualify for credits and whether credits are in effect the only financial remedy. Another is a clear obligation to implement a disaster plan and data retrieval services, including in particular for force majeure events. But be alert to confirming that these are in scope and their associated cost.
Contract discussions should analyse exactly how the service will operate and work through the practical consequences of unforeseen events such as a lightning strike.
Often the obligation to meet a particular service level (and liability to pay credits) will not apply where the unavailability is caused due to force majeure events such as lightning strikes. But query whether the contract effectively suspends any obligation to provide any service, including disaster related service.
Many buildings (even domestic dwellings) are designed to include lightning protection systems. Asking a cloud provider if it has such physical protections in place is good due diligence.
On the face of it, a force majeure clause ensures a party is not liable for its resulting failure to perform the contract. With business critical IT contracts, that is where the discussion should start, not finish.
