Cloud Software

What is cloud software?

Many of the online applications we use on a daily basis involve cloud software for storing and accessing information. To the user it’s unnoticeable whether a service is provided using cloud or a traditional on premises solution, where organizations run software on their own servers. Choosing between the two options and which option is most suitable for your business requires careful consideration to avoid potential legal, financial, security or reputational impacts.

What are the advantages of cloud software?

Depending on your business need, cloud software can offer a variety of advantages over on premises solutions, including;

  • faster initial rollout of service to users
  • reduced maintenance costs and downtime
  • upgrades and new features can be in users' hands quickly
  • vendors often introduce new features first in their cloud applications
  • less commitment of resources for a trial rollout
  • it can be very cost effective if:
    • customization is not required, or
    • the intended user base is small

What are some of the challenges of using cloud software?

Regardless of whether organizations use on premises or cloud solutions, the organization is ultimately responsible for securing, protecting, and honouring all data that is in provided and entrusted. Cloud services can create unique challenges to meeting business requirements and responsibilities:

  • integrating and sharing data with other systems may be too costly or impossible
  • some vendors do not guarantee a timely notification of data breaches.
  • may have hidden or additional usage costs,
  • process for accessing data after the completion of the contract or in the event of the vendor going out of business needs to be defined at the beginning
  • our lack of oversight and control of the environment where our data resides makes it difficult to confirm our data is protected
  • vendors are often acquired or merge which may result in a less-attractive service offering

How can you assess whether cloud is best for you?

When a considering adopting a new service or moving an existing service to a cloud solution, the business owner works with the university's Technology Assesment Team. This team consists of domain experts that can assist you in evaluating proposals and has initiated a cloud software assessment process that can quickly and efficiently review proposals. For more information about finding the right solution or to begin an assessment contact

What is included in our cloud software assessment?

Each assessment may include different considerations depending on the type of technology or the specific use case for the technology. In general, the assessment will include components from each of the following categories:

General information gathering

  • What problem or opportunity has arisen that lead you to look at a software solution?
  • Is there a similar service already available at the university?
  • What processes, data or systems does this software need to interact with?
  • Will this system be authoritative for university data or specific business processes?
  • Will the service be processing, transferring or storing financial information, such as credit cards?
  • Are there other Canadian universities using this service?


  • Is the service mandatory for members of the university community to use?
  • Is any data or personal information used by the vendor for secondary purposes?
  • Does the vendor have rights or obligations to disclose information, if there is an unauthorized use or disclosure of personal? Is notice provided to the university?
  • Is the service provider able to restrict the jurisdiction where university data is stored?
  • How long will data be retained after a contract expires?

Data Storage and Security

  • Where is the data centre(s) located?
  • What university data will be entered, used, processed and stored by the service (personal information of staff, students or other users of the service)?
  • Are the data centre(s) owned by the service provider or by a third-party vendor?
  • Does the service allow for customers to perform penetration testing/security scans?
  • Has the service undergone any recent audits, third-party assessments or certifications?
  • How will access be controlled?


  • Is data backup part of the core service offered by the service provider?
  • If a failure occurs are there limits to what is recoverable?

Business Continuity

  • What alternative solutions exist, if this service is unavailable during U of S business hours?
  • Can deleted data be retrieved/recovered by the end user?
  • What is the vendor's financial standing?
  • What are the performance or service limits set by the service provider?
  • Are response time and performance activity actively monitored? 

If you are looking to purchase a software solution or have Questions about the Cloud Assessment process please contact the Technology Assessment Group at

Related Resources and Policies 

Last modified on