In highly regulated industries such as banking, hesitancy towards moving to a cloud environment stems from concerns about service providers’ ability to meet stringent business and compliance requirements. This means careful scrutiny to ensure a service provider is flexible enough to provide the necessary privacy and security: adhering to strict compliance enforced through regular audits.
Enter managed private cloud services—a growing segment that addresses these concerns and provides customized IT environments that foster agility.
Some small to mid-size banks still use on-premise data centers to deliver their IT, often citing security and performance as primary reasons. But this model means high capital expenditure and labor costs. Plus, most banks already juggle creaky mainframe and other legacy technologies. Even as they work to overcome innovation-stifling bureaucracy, they struggle to embrace new technologies.
Many of these institutions would like to migrate to a cloud-based operating expense model. But it must offer the security and control they have in their private data center environment.
How Managed Private Cloud Bridges the Gap Between Public Cloud and On-Premise Data Centers
Today, managed private cloud offerings are becoming the preferred choice for small to mid-size banks as they move to next-generation architecture that frees up capital. Managed private clouds offer dedicated and isolated environments for each customer, even as they provide complete visibility and remote control over the environment. They deliver the benefits of the public cloud with the security and flexibility of a private data center.
For example: If a bank has a customized security requirement, such as a dedicated virtual firewall, a private cloud provider can accommodate this request. Compare that to a public cloud environment, where customized services and accommodations are limited because the provider must keep in mind the other tenants on its platform.
What’s more, banks face increased scrutiny and auditing requirements and must ensure they can be met in a cloud environment, too. With a private cloud, specific reports and visibility can be built in to satisfy compliance requirements—which may not be the case in a public cloud environment.
In the past, small to mid-size banks and financial institutions had difficulty justifying the costs of moving to a private cloud; the return on investment just wasn’t there. But in recent years, the hyperconvergence of storage and networks in virtual server setting has dramatically reduced network infrastructure costs. Resilient, secure networking environments can now be delivered via private cloud at a favorable rate—meaning that even the smallest financial institutions can take advantage of all the cloud’s benefits and still meet the stringent regulations that govern the banking and financial industry.
Choose Your Private Cloud Provider Wisely
Many governing bodies such as the Federal Financial Institutions Examination Council (FFIEC) have issued statements on cloud computing, citing the need for diligence during the provider selection process. Specifically, the FFIEC advises financial institutions to pay close attention to: data classification, data segregation and recoverability.
The FFIEC and the FDIC (Federal Deposit Insurance Corporation) have recently focused on cyber security as well. The FDIC in particular imposes more stringent requirements — called the Proposed Standards — across several categories. These include cyber risk governance; cyber risk management; internal dependency management; external dependency management and incident response; cyber resilience; and situational awareness.
Regulatory bodies are embracing cloud solutions while also ensuring that they are “locked down” like an on-premise solution. Private cloud providers at similar price points to those offering public cloud solutions will gain a strong competitive spot.
If not planned well, migrating to a private cloud environment can be fraught with risk. However, banks should seriously consider the option as the advantages far outweigh the risks. As you explore private cloud options, be sure to keep the following tips and best practices in mind:
- Know Which Workloads Should Remain On Premise (For Now). Assess your current environment and build a cloud migration strategy to determine which workloads would be best served in a managed private cloud. This is often a paid engagement, but typically results in lower monthly costs down the road, plus fewer business disruptions during each phase of the transition.
- Security and Privacy. Begin your evaluation here so you can quickly eliminate providers that don’t meet your needs. Some questions to keep in mind include: Can the provider deliver a dedicated storage environment with full encryption? Does the provider have a disaster recovery site that can deliver a full business continuity that meets specific customer needs? Here, think RPO (recovery point objective) and RTO (recovery time objective).
- FFIEC and FDIC Familiarity. Ensure the private cloud provider can support your business and compliance requirements. If you’re their first banking client, for example, they may not know the latest FFIEC and FDIC regulations.
- SSAE 16 Compliance. To meet your compliance requirements, look for a provider that can meet SSAE No. 16 (Statement on Standards for Attestation), a well-recognized compliance control standard.
- Don’t Overlook Complementary Services. You may have one or two specific features or benefits in mind that would make your initial cloud move worthwhile. But don’t overlook additional benefits to your organization, now or in the future, such as VDI (virtual desktop infrastructure), Find Me/Follow Me and other management capabilities that can lower the burden on your labor resources and increase productivity.
Choosing the right private cloud offering can give banks a distinct competitive speed advantage in addressing scenarios hard to achieve on-premises. Two examples include addressing new industry regulations and changing the networking environment following a merger or acquisition. Now, the game changing technology can help small to mid-size banks deliver next-generation services. And that’s an absolute must for meeting the demands of today’s tech-savvy customers.
Source: Jeff Kaplan, Breakthrough Technology Group
