What is cloud brokerage? As with cloud computing itself, the use of the term ‘cloud brokerage’, in its multiple contexts which address different types of situations, does not help you to get a clear understanding of what cloud brokerage is.

A simple explanation of a broker is that a broker acts as an intermediary in the negotiation and/or subsequent contractual relationship between a customer of a certain service and one or more providers of said service. In general, the broker enhances the base service delivery and, therewith, hopefully, service value. Enhancement may include managing easier access to the provider’s service, mitigating cloud risks by providing greater trustworthiness of the provider’s service, or even creating a completely new (integrated) service.

However, in the modern world a broker may also be a software application, a platform or a suite of technologies.

Among the many precedents for the approach of a brokerage services provider in other industries are the travel industry’s aggregation sites, such as Expedia. In the context of the Cloud, cloud brokerage is an IT role and business model in which a cloud brokerage services provider adds value to one or more (public or private) cloud services for the benefit of one or more customers of that service. This way cloud customers ensure that they receive the best value from a wide selection of offerings (advised on by the cloud brokerage services provider), while cloud providers benefit from a broader audience for their cloud services pre-approved by the same brokerage services provider.

New cloud challenges
Each cloud provider has its own approach to KPIs, usage-tracking and pricing and billing. It is hard to ensure the best commercial deal on purchasing volume. Also, the management of multiple reporting systems, financial statements and operating models that result from the use of multiple cloud providers is bringing cloud customers a throbbing headache. Notwithstanding that, the combination of multiple cloud services is proving to be too complex and untrustworthy for cloud customers to handle in terms of their integration. The general lack of standardization and subsequent risk of vendor lock-in does not help either.

Furthermore, cloud consumers keep finding it challenging to find the right match in the pool of available cloud providers. The traditional leaders in the IT industry are not necessarily the best cloud providers. And who has the courage to boldly choose an unknown cloud provider? Proven performance is key to earn the cloud customer’s trust.

The same goes for compliance concerns. How do you ascertain that your cloud provider has your best interest in mind in meeting legal and other regulatory obligations, for  example? That personal data is not transferred to a so-called third country outside of the European Economic Area (EEA) which does not ensure an adequate level of protection within the meaning of Directive 95/46/EC? The managerial challenge associated with this compliancy risk only increases (probably exponentially) in the case of multiple cloud service providers.

These challenges demand for thorough pre-contract screening and due diligence, sound contract management, (joint) customer-oriented KPIs and comparable pricing and reporting models. And exactly these challenges justify the rise of cloud brokerage.

Cloud brokerage service providers may assist cloud customers in identifying the right cloud services and providers, in ensuring similar KPIs, usage-tracking and reporting tools across the menu of executed cloud services, and in coordinating the pricing and billing for those cloud services in line with customers’ demands. These possibilities for providing added value are probably the reason for Gartner to predict, as follow-up to its 2009 prediction (the rise of cloud brokerage), that by 2015 cloud brokerage service providers will handle at least 20% of all cloud services, up from less than 5% today.

ROLES OF CLOUD BROKERAGE
Depending on the needs of the cloud customer, cloud brokerage services may be provided via three primary roles:

Intermediation
An intermediation brokerage services provider provides added value support on top of one or more existing cloud services to enhance some specific capability of ‘said’ cloud services, without actually providing any of the cloud services itself.

Intermediation services may include identity and access management, service level management and reporting, security management and incident reporting, or supervision on pricing and billing. Intermediation services providers often also provide pre-contract consultancy services such as guidance of the cloud customer through the cloud selection process. From a cloud customer perspective, the intermediation services may qualify as simple consultancy services up to a ‘managed services’/outtasking type of relationship (with representation rights).

Aggregation and customization
An aggregation brokerage services provider goes a step further and provides the intermediation services while bundling and customizing multiple cloud services into one or more customer-tailored cloud services under its own label (but “powered by …”). Aggregation services may include data integration, safeguarding process integrity, modeling data across all components of the cloud services, and ensuring data portability between the cloud customer and the various cloud services providers. These aggregation services come with a single user interface for monitoring joint KPIs, single billing and single contract management. By bundling and customizing multiple cloud services into one or more cloud services, which are contracted directly to the cloud customer, the aggregation services provider basically becomes a cloud services provider itself.

Brokerage enabling
Some cloud brokerage services providers are not directly involved in cloud customer contact, but rather enable other brokerage services providers to provide their brokerage services. Examples of these cloud brokerage enablers are providers of cloud aggregation platforms or other (software) technology that enable aggregation providers to combine various cloud services into the one or more aggregated cloud services for the cloud customer.

Brokerage enabling services are basically the other side to the coin compared to the aggregation/customization services mentioned above. The cloud brokerage enabler is merely the subcontractor to the head cloud provider, being the aggregation services provider. The cloud brokerage enabler does not have a contractual relationship with the cloud customer.

DOWNSIDES
The concept of cloud brokerage does not only have advantages. There are also some downsides.

Risk of undisclosed preferences
First, as any concept that involves an intermediary, the cloud brokerage concept replaces a full and open competitive selection and negotiation process with the cloud services providers. How do you ascertain that the cloud brokerage services provider is truly independent from the cloud services providers? The commercial risk of the brokerage services provider having undisclosed preferences is of course only relevant if and when the cloud customer has engaged the brokerage services provider for pre-contract consultancy services (pre-contract selection of the best fit for customer’s demands). Nevertheless, with current severe budgetary constraints, the focus should rather be on more commercial transparency, while cloud brokerage may result in less transparency.

Business continuity risk due to longer chain of services
Another potential downside – again not different from ‘old school’ concepts involving an intermediary – is that the cloud brokerage concept may involve the role of an integrator. The role of an integrator has great advantages in the current maze of multiple cloud services providers (with each its own approach to KPIs, usage-tracking and pricing and billing). On the other hand, an integrator also adds a link to the chain.

This additional service management layer may, for example, makes it more difficult, timely and costly to troubleshoot technical issues, which constitutes a business continuity risk.

Also for remedial action (for example damages), the brokerage services provider may also provide less possibilities of redress (including less insurance coverage).

Exercising audit rights (for example, to verify the quality of the operational processes leading to the customer service or to verify regulatory compliance) may become more complex. Whom and where do you audit in the event of bundled cloud services? See also the necessity of full transparency to ensure privacy compliance.

Risk of privacy non-compliance
As a further downside to adding a link to the services chain, is the increased risk of privacy non-compliance. Despite the acknowledged benefits of cloud computing in both economic and societal terms, the Article 29 Data Protection Working Party has outlined how the wide scale deployment of cloud services can trigger a number of data protection risks, mainly a lack of control over personal data as well as insufficient (transparent) information with regard to how, where and by whom the data is being processed/sub-processed.

The complexity concerning privacy compliance in case of cloud brokerage increases when you consider that the lawfulness of data processing depends on the adherence to one of the basic principles of EU data protection law: transparency. The cloud customer should always be made aware of all sub-contractors and sub-sub-contractors contributing to the provision of the respective cloud services as well as of the locations of all data centers personal data may be processed at. Otherwise, the cloud customer will, for example, not be able to assess whether personal data may be transferred to a so-called third country outside of the European Economic Area (EEA) which does not ensure an adequate level of protection within the meaning of Directive 95/46/EC. Transparency also sees to the implementation of adequate technical and organizational security measures to protect personal data at every level in the cloud services chain. Such transparency may prove to be quite a challenge in the context of the cloud aggregation/customization brokerage model.

Louis Jonker is a Netherland’s based lawyer specialising in IT Commercial Contracting, IT Sourcing & Cloud

Disclaimer: Views presented in the above article are those of the author and do not necessarily represent the views of DatacenterDynamics FOCUS