Disclaimer: This booklet is intended for informational purposes only and does not constitute legal, technical, business or other advice and should not be relied on as such. Please consult a lawyer or other professional advisor if you have any questions related to the topics discussed in the booklet. The Ontario Government does not endorse any commercial product, process or service referenced in this booklet, or its producer or provider. The Ontario Government also does not make any express or implied warranties, or assumes any legal liability for the accuracy, completeness, timeliness or usefulness of any information contained in this booklet, including web-links to other servers. All URLs mentioned in this document will link to an external website.

Cloud computing

Small and medium sized enterprises are beginning to use cloud services to save money and boost business results but, as with any evolving technology, there are pros and cons to consider. This booklet describes cloud computing and explains the benefits, concerns, types of cloud computing and what to consider when moving your business to the cloud.

Key concepts

Many small business owners are surprised to learn that they have been using some form or other of cloud computing for years at least on a personal level. That includes your Hotmail, Gmail, Flickr or Skype accounts. At its simplest, cloud computing is really any form of web-based shared computing service.

Virtually all of your computing needs — from website hosting and customer relationship management through to storage and backup — can be transferred to the cloud. Your applications, files and documents will reside in an offsite data centre instead of on your computers' hard drives. You and your employees can access them through any device that connects to the Internet (desktops, laptops, tablets, smart phones, other mobile devices). A service provider manages the technology and businesses share the costs of the infrastructure.

Cloud applications

Businesses can use the cloud for a range of purposes. Some of these are illustrated in the following diagram. (See Implementing Cloud Computing Section 2 for details.)

Cloud Hosting - Collaboration, Databases, Accounting & Reporting, Customer Relationship Management, Storage & Backup, and Document Management

Figure 1 - Cloud Applications

Benefits of cloud computing for small business

Here are some reasons why small businesses should consider using cloud services:

  • Cost savings. One of the biggest advantages is eliminating the need to buy costly IT infrastructure, such as an expensive server. Cloud computing services also manage and maintain IT systems, so that you don't need to. In other words, you can rent a range of services from e-mail systems to digital storage space to office software programs instead of buying them up front.
  • Remote access. You can get remote and almost instant access to all your data on any device. This is particularly beneficial when working offsite.
  • Scalability. You can increase or decrease the amount of storage you need. This is especially advantageous to start-ups wanting to avoid buying servers that may be under-utilized early on and then overburdened when the business expands. Not only do you save money by paying for only what you use but you eliminate the potential down-time waiting for equipment and system upgrades.
  • Access to superior technology. Powerful, state-of-the-art applications and computing infrastructure that small businesses could not afford otherwise are available via the cloud (e.g. accounting and customer relationship management packages). This access helps you to respond more quickly to changes in the marketplace, enter new markets, and transform ideas into new products and services at a much faster pace.
  • Improved productivity. Using cloud computing offloads the headaches of running and maintaining certain IT services, ensuring that you and your employees can focus time on more productive tasks. And because applications, including legacy ones, tend to run more efficiently in the cloud, your staff can work faster and experience no excessive downtime.
  • Employee collaboration. Cloud computing makes life easier for staff, especially if you have mobile workers or multiple offices as it allows access to data through a connection to the web. And with services like web conferencing, employees can instantly hold internal meetings or make client presentations. Internet access also makes it easy to use mobile devices like smart phones and tablets to their full advantage.
  • Selective outsourcing. With all the cloud options that are available, small and medium-sized businesses do not have to migrate their entire IT needs at once but instead can pick and choose what services they want to outsource. It’s not an all-or-nothing business decision.
  • Better security. Many small business owners cite security as a top concern when considering moving to cloud computing but, ironically, good cloud service providers maintain better data privacy and security practices than most small businesses have internally. In addition to automated policy enforcement that protects sensitive information, good providers have 24/7 technicians monitoring their services.
  • Disaster recovery. Data stored in a cloud is not likely to suffer fire damage or theft. Cloud computing allows you and your employees to work offsite or at home in case of disaster, simplifying disaster recovery should your premises become unusable.

Risks associated with cloud computing

While there are many benefits to moving to the cloud, as with any new technology, there are caveats.

  • Data security and privacy. This includes the risk of criminals or fame seekers hacking into your sensitive business information. You also have to take into account the risk of compromising your customers' private information, which has become an increasingly serious and widespread issue.
  • Jurisdictional issues. The risk here is twofold. If a Canadian company hosts its data on a server in another country, it is possible that that country’s government can use local law to access the information. Or, if you deal with sensitive data, you may be required by policy or law to store that data on servers that are physically located in certain jurisdictions.
  • Compliance requirements. For some activities, like processing financial transactions online, you must have certain certifications and compliances. Many service providers are already compliant so you may not need to become certified yourself. It’s best to check.
  • Vendor reliability. What happens if your service provider goes out of business? In addition, if your service provider does not live up to its promises, you can experience downtime and service disruptions. If data is lost through human error on the part of a service provider, the cloud cannot recover it. It’s critical to deal with a reputable firm.

Adopting cloud computing to grow your business

1. Research and planning

Moving your operations to the cloud requires that you look at your business needs and IT requirements and the options for cloud computing available to you in order to formulate a cloud strategy. You may need guidance and input from an IT expert and may have to source that help externally if you or your staff do not have the expertise. A good cloud services provider should be able to assist with your planning.

Research and planning questions to ask yourself or your IT expertFactors to consider
What do I expect from cloud computing?Examine the impact that moving applications to the cloud will have on your business—from a cost, administrative, productivity and staffing standpoint. Look at issues you face today and how the cloud might impact them. For example, do you have mobile workers who need better access to data? Do you experience bandwidth issues? Does the amount of data and usage tend to fluctuate? Could you benefit from applications you currently can't afford?
Which applications are movable and which are not?This involves examining whether you have sensitive data, whether the applications that you use in your business have been created or adapted specifically for your company and whether or not they can be virtualized.
How do I maintain control of my data and operational policies?It’s not just a matter of your comfort level with the security of your cloud service provider; you also need to look at how your internal security policies will remain compliant in a cloud atmosphere. In other words, examine any changes you need to make to employee policies in order to keep control over your business.
Are your current applications in your legacy system able to integrate seamlessly to the cloud?Make sure your decision to change from existing systems to the cloud is viable. Considerations include the size, complexity and number of applications you currently use and how obsolete your current platforms are. With highly entrenched legacy applications, equipment and computing processes it may take a long time to migrate to the cloud.
What kind of cloud model is best for my business?
  1. Private, public or hybrid cloud?
  2. Infrastructure as a Service (IaaS), Software as a Service (SaaS) or Platform as a Service (PaaS)?
(See Choosing a Service Model below.)
What are my service level requirements?Understand your existing IT needs and inquire about the related service costs involved.
How do I make sure I'm using the most cost-effective solution?Examine your business "wish list" and compare it to the cost savings associated with cloud computing. You may find there are more productivity advantages to adopting cloud services than you originally thought.

Setting objectives and goals

Now that you have reviewed your business needs and looked at the cloud as a potential productivity and money-saving choice, it is time to set objectives and goals:

  • Decide what you want to use cloud computing for (e.g. all or part of your business processes).
  • Choose cloud services that best meet those needs.
  • Set a budget. You may find that preparing existing or legacy systems for the virtual world is cost-prohibitive and that you may not be able to move as much to the cloud as you would like.
  • Create a timetable (some companies prefer to move to the cloud in stages).
  • Be sure you build in performance measurements so that you can constantly evaluate your needs against cloud service offerings.


Cloud service providers charge clients either per user or for usage. If you opt for pay-per-user, consider giving access only to those in your business who absolutely need it to save on costs. The usage option makes sense if you only require the cloud services periodically (e.g. seasonal businesses) rather than daily. Bear in mind that customization is expensive and could erode any cloud savings.

Here are some things to consider when doing a cost-benefit analysis to determine if you want to move to the cloud:

  1. If you don't use the cloud
    • Equipment purchase, upgrade and maintenance costs
    • Software upgrade costs
    • Staff utilization (amount of time spent maintaining infrastructure, system administration, security upgrading)
    • Efficiency and productivity
    • Disaster and backup recovery speed
    • Power usage
  2. If you do move to the cloud
    • Amount of bandwidth needed
    • Upfront cost of migrating data over to the cloud
    • Vendor cost and reliability
    • Paying as you go for the capacity you need
    • Efficiency and productivity (reduced travel time, access to data and up-to-date software, collaboration over multiple offices, system downtime)
    • Speed at which IT changes can be adopted
    • Disaster and backup recovery speed
    • But remember there is more to consider than pure financial figures. Think about how your business would evolve in the cloud when everything is accessible to you 24/7 from wherever you are.

Matching computing resources to computing needs

Keeping server capacity in alignment with business needs can be a continuous challenge. You may either lack enough capacity when you need it and slice into your profits, or also slice into profits if you are over capacity. Cloud services allow you to scale capacity to meet demand, and to move at the pace of your business growth instead of at the pace your infrastructure imposes. This results in improved time to market, simplifies delivery of applications and ensures cost control over capital or operating costs.

2. Choosing a service model

There are several cloud computing models from which to select, depending on your business and technical needs.

Types of cloud service models

  • Infrastructure as a Service (IaaS). Offsite storage or processing resources (like data storage, disaster recovery and servers) that you access via the Internet. You do not manage or control the infrastructure, but you do have control over your operating systems, applications, and programming frameworks.
  • Platform as a Service (PaaS). Lets you deploy applications that your company has developed onto the cloud infrastructure. Basically, businesses use virtualized servers and associated services for running existing applications or developing and testing new ones. You do not manage or control the underlying infrastructure, but have control over applications that are deployed.
  • Software as a Service (SaaS). Applications or programs (like email and document creation) that are accessed via the web through various devices including computers and mobile phones. You do not manage or control the cloud infrastructure or application capabilities.

You have the option of hosting these services either internally, externally through a cloud provider, or using a hybrid approach. The deployment models include:

  • Public clouds. A completely outsourced service, not tailored specifically to any one company that is owned and managed by a cloud service provider. Good for small businesses with limited budgets.
  • Private clouds. Generally refers to IT infrastructure that is operated for a single organization. It can be owned and managed by that company, or by a third party, and may exist on or off premises. In either instance, the enterprise is in control of the infrastructure and data. Used mostly by large companies.
  • Hybrid clouds. A combination of two or more clouds (private or public) that remain unique entities but in which a company provides and manages some resources in-house and has others provided externally. Good for companies that want to keep data in house but also want instant ability to expand. Also suitable for businesses that have applications that cannot be readily transferred to cloud computing.

Choosing which of these is best for your company will depend on your specific needs (such as how much control you want) and your budget and most likely will require guidance from an IT expert.

3. Choosing a cloud service provider

It’s important when moving to cloud services that you select a reputable provider and one who can help guide you through the decisions you need to make. Since cloud computing is an evolving technology with new players in the field, make sure you do your due diligence. You can find providers by contacting a cloud services management consultant, by asking other business owners or by researching online and comparing different offerings, for example: Compare Cloud Computing Providers; 90 Cloud Computing Companies to Watch in 2011.

Tips for choosing a cloud service provider

Service provider attributesConsiderations
Knowledge and guidanceIs the vendor able and willing to educate you on cloud computing and help you choose the best options for your business?
Onsite security measuresAre there good security measures at the physical location where your data will be stored (e.g. more than one layer of physical security and features like biometric iris scanners). The service provider should also have disaster systems in place (e.g. multiple facilities, geographic diversity).
System security measuresWhat are the cloud access and identity protocols used? Are hacking attempts monitored and documented? Are systems run separately so they do not interfere with each other or cannot be hacked simultaneously? Good reporting, transparent and accessible.
Help when you need itDoes the provider offer good customer service, especially from an IT standpoint? Does it provide a 24/7 network operating centre for its customers?
System availability and performanceIs the provider able to handle fluctuations in demand? Most providers offer uptime statistics or even give uptime guarantees. As well, providers should have a multi-homed Internet infrastructure and layers of redundancy.
Compliance capabilitiesIf you need to be compliant with any regulations, make sure the provider is compliant too.
Financial strengthCheck how long the provider has been in business as well as its financial standing.
Breadth of capabilitiesFind a vendor that is able to provide all types of cloud services, even if you do not plan to move all your operations to the cloud initially. Select one adept at all offerings so that you can expand in the future if you so choose.

Implementing cloud computing

1. Characteristics

Cloud has several characteristics:

  • Everything from infrastructure, such as servers, to applications, such as communication and collaboration as well as utilities like accounting, word processing and customer relationship management (CRM) can be delivered as a service over the Internet.
  • Service speeds are consistent, regardless of the systems in use.
  • Applications, services, and data can be accessed through a wide range of connected devices (e.g. smart phones, laptops, and other mobile Internet devices).
  • Services are on-demand, with users able to provision, monitor and manage computing resources as needed without internal IT help.
  • Providers pool resources, serving multiple consumers using a multi-tenant model. If one client doesn't need as much of a particular resource (e.g. storage, processing, memory, network bandwidth, or virtual machines) at a given time as another client, the cloud can shift and reallocate resources to provide cost savings.
  • Rapid elasticity is built in, with the ability to quickly scale up or down to match customer usage.
  • IT resource utilization is tracked for each application and customer for billing purposes.

2. Leveraging the cloud: best functions

Let’s look at some of the functions that work well for businesses in the cloud:

Document management: The cloud provides great opportunities for increased efficiencies, especially for document-intensive professions like finance, accounting, HR, and legal. Cloud technology lets users co-author documents online without the confusion of which version of the document is the most recent. Cloud-based document management tools allow businesses to control the life cycle of a document by establishing workflows that documents can follow from creation to completion. Documents can be automatically entered into a system where all approvals are controlled (e.g. Google Docs, Zoho).

Databases: Some cloud platforms offer options for using a database as a service. Instead of installing and maintaining databases on your own, the cloud service provider takes responsibility and you pay only for usage (e.g. Amazon Web Services, Rackspace, Windows Azure).

Customer relationship management (CRM): A wide range of applications that track and record relationships and interactions with customers and suppliers are available via the cloud. Examples of popular ones are salesforce and sugarcrm. Many are inexpensive and easy to use and customize and can import data from other CRM systems. And, like other cloud applications, they are automatically updated and secure.

Storage and backup: Huge amounts of data, including text, photos, videos, music files, etc., can be stored, or at least backed up, over the cloud. Cloud storage alleviates headaches associated with managing the location of data if you run more than one office. And offsite back-ups save your data and make it instantly accessible in the case of a disaster. JustCloud, MyPCBackup and LiveDrive, for example, are providers that automatically store data (music, apps, email, etc.) for retrieval from any mobile device, Mac or PC. In addition, data is updated across all devices regardless of which device you use.

Accounting and reporting: More businesses are adopting cloud-based services that offer features like general ledger, financial reporting, tax compliance, accounts receivable and payable, and electronic payments processing. Electronic payments, as opposed to paper-based processes, help small businesses reduce transaction fees and are more accurate. Examples of cloud accounting services are NetSuite, and FinancialForce.

Presentations/Web conferencing: The cloud makes it easy for employees, partners and suppliers to collaborate without having to incur any travel expenses. Files can be shared and updated in real time and voice and visual elements can make web conferencing even more like a face-to-face meeting. Web conferencing technology also allows for sophisticated presentations to prospects and clients (e.g. Cisco Web Ex, GoToMeeting, Knoodle, SlideRocket, Prezi).

3. Sector specific applications

There are also sector specific cloud-based applications. Here are some examples:

Entertainment/Music: Cloud streaming capabilities and unlimited inventories of music stored in the cloud allow musicians who own their labels to showcase themselves and sell at a lower cost than through traditional sales of CDs. Aggregators like tunecore will distribute recordings to Apple iTunes and spotify.

Design: iCloud storage opens up opportunities for graphic and interior designers to collaborate and share works.

Retail: Retailers can use Google Apps in the cloud as their major platform to utilize all of its software applications. Benefits include scalability, security, accessibility from anywhere, pay for use, consistency and up-to-date software. For retailers specifically, Google Apps can be used for sales collaboration among all staff and dissemination of up-to-date product specs, which can help with training staff and customer service support. And the calendar can assist in shift scheduling.

Manufacturing: Cloud computing is ideal for manufacturers, particularly if you have suppliers and operations in different locations, since multiple users in the various locations can access the cloud. Usages include scheduling, order management, monitoring cost of production and predicting bottleneck issues—all of which involves real time data collection and analysis through Software as a Service (SaaS) in the cloud.

HR: Rypple, a human resources management cloud, is changing how HR is evolving in the performance review arena. It allows staff to set and manage goals and management to provide real-time coaching and feedback. The objective is to move performance measurement and training to an ongoing, rather than periodic, function of any sized company.

Here is a quick summary of reasons why you might benefit from choosing cloud computing:

Data loss preventionIt is a good idea to back up data via cloud computing in case of internal computing crashes or disaster even if you decide not to use any other cloud computing services.
Access to up-to-date softwareRenting software through cloud services rather than purchasing it allows businesses to access the latest version.
Cost advantages for web-based businessesHosting websites on the cloud saves the cost of purchasing and upgrading equipment like a server. In addition, cloud services are scalable to instantly meet growing demand. This is especially advantageous for start-ups that cannot reliably predict space needs.
Staff managementThere are numerous tools that monitor employee performance regardless of where employees are located. In addition, many small companies use cloud computing for payroll and accounting.
CollaborationEmployees, partners and suppliers can meet online often as effectively as if they were in the same room. They can share files over the network and update in real time. Web conferencing technology also allows employees to make sophisticated presentations to prospects and clients without incurring travel costs and needing face to face time.

4. Legal concerns

There are legal and privacy laws that apply to e-business. Depending on your industry and what activities you conduct online, there are various certifications you must acquire and compliances you must adhere to. You are also at risk for legal recourse if, for whatever reason, your customers' private information becomes compromised. Ensure that you safeguard it by understanding how your cloud provider maintains confidential customer information. Here are additional legal considerations:

  • Data security. In a legal context, if you have sensitive data, you need to know exactly where it is stored. If your data is stored in another country, for instance, that country might have the legal right to access it.
  • Jurisdictional issues. Some types of sensitive data are required by law to be physically stored on servers located in certain jurisdictions.

5. Security and privacy: cloud vs. on-site hosting

Regardless of where it is housed there are risks associated with storing data. If your infrastructure and data are onsite, these risks include:

  • Failure to back up regularly
  • Theft of data or hacking
  • Equipment failure
  • Disaster (fire, flood, or other damage)
  • Inadequate security practices

Cloud security concerns include:

  • Theft of data or hacking
  • Legal (i.e. if data is housed in another country, different government access laws may apply)
  • Vendor reliability (competence/accountability, security measures) and solvency
  • Access to data by authorized personnel only
  • Perception that privacy could be compromised

Cloud service providers actually have better data security than most small businesses do internally. If you are moving to the cloud but are worried about cloud security, one way to ensure that you have the highest level of security available is to select a dedicated cloud (private) rather than a shared cloud service (public). With a private cloud, you do not share servers or software applications with other cloud users so there are no issues surrounding segregating your data. While they are more secure, private cloud options are, however, more expensive than public ones. Whichever you choose be sure to go with a reliable vendor that has stringent security mechanisms in place.

Another precaution before moving to the cloud is to think carefully about what data will reside there. For example, you may not want to migrate confidential HR information to the cloud.

In terms of privacy considerations, make sure the cloud service providers you are using (including any of their third party providers) have a privacy policy in place. Ensure you understand how your users' information will be collected and used. When collecting personal information, you have legal obligations to protect it. In Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to e-business, so you should be familiar with what is required, visit the Personal Information Protection and Electronic Documents Act (PIPEDA). See The Legal and Privacy Issues of Doing E-Business booklet for more information.

Future of cloud computing

There are many possibilities with this relatively new technology. Watch for these trends:

  • Increased use of mobile devices will fuel demand for cloud services. New technology will emerge to assist mobile device users to access the cloud and mobile, cloud and social media will converge.
  • Web conferencing will become more sophisticated, as integration of audio-visual, verbal and instant exchanges become increasingly available. This will decrease the need for face-to-face meetings, allowing the workforce to become even more mobile.
  • Business decisions around converting to cloud solutions will become increasingly focused on enhanced agility, shorter time to deployment and better efficiency.
  • Cloud service brokers will become more popular, helping businesses adopt cloud technology, manage services and reduce costs. Niche cloud service providers will proliferate and grow as will cloud computing consulting and professional services firms.
  • Costs will be driven down as cloud usage increases.
  • Security fears surrounding the cloud will lessen as companies (especially small ones) realize that data can be more secure in the cloud than in their office.

Related topics covered in other booklets

  • How you can profit from e-business
  • Integrating mobile with your marketing strategy
  • E-commerce: purchasing and selling online
  • The legal and privacy issues of doing e-business

Glossary of terms

Applications (Apps)
Programmed software that can be integrated with other core functionality to enhance or enable a particular operation feature.
Data transfer rate supported by a network connection or interface, or the amount of data that can be carried from one point to another in a given time period, usually expressed as bits (of data) per second (bps). Bandwidth represents the capacity of the connection. The greater the capacity, the greater the performance.
Cloud computing
A method of delivering information technology services in which resources are sourced from the Internet through web-based tools and applications rather than through a direct connection to a server. This type of system allows employees to work remotely.
Infrastructure as a Service (IaaS)
A type of cloud computing service whereby storage or processing resources (like data storage, disaster recovery and servers) are offsite and accessed via the Internet.
Legacy system
While not necessarily defined by age, legacy tends to refer to outdated computer systems, programming languages or application software that is used instead of available upgraded versions. A legacy system may still be in use because its data cannot be changed to newer or standard formats, its apps cannot be upgraded, or its functions are too essential to be disrupted by upgrading or integration with another system.
A group of interconnected (via cable and/or wireless) computers and peripherals that is capable of sharing files and information and software and hardware resources between many users.
Platform as a Service (PaaS)
A type of cloud computing service that lets you deploy applications that your company has developed onto the cloud infrastructure by using virtualized servers and associated services for running existing applications or developing and testing new ones.
Private, public or hybrid cloud
The different types of cloud computing services available, defined by the level of control a company using the service has over its infrastructure and data.
Computer or network system components (e.g. fans, hard disk drives, servers, operating systems) that are installed to back up primary resources in case of failure. Also describes writing data to two or more locations for backup and data recovery.
A physical computer (a computer hardware system) or device that manages network resources (as a host) that serves the needs of users connected to a network. Types of servers include database server, file server, mail server, print server, web server, or other.
Software as a Service (SaaS)
A type of cloud computing service offering applications or programs (like email and document creation) that are accessed via the web through various devices including computers and mobile phones.
The time during which a device, such as a computer, is functioning or available for use.
The creation of a simulated rather than actual version of a device or resource such as an operating system, a server, a storage device or network resources.
Web conferencing
A form of real-time communications in which multiple computer users, all connected to the Internet, see the same screen at all times on their Web browsers. Used to conduct live meetings, training, presentations, or direct customer support.
Web hosting
The business of housing, serving, and maintaining files for one or more websites for other firms or persons whereby the hosting service provider rents disk or storage space on its server(s).

This publication is part of an e-Business Toolkit which includes a series of booklets on advanced e-business topics and an introductory handbook How You Can Profit from E-Business. The entire Toolkit is available at ontario.ca/ebusiness.