Cloud software transfers operating and technical tasks to a provider. It does not remove the customer's responsibility for permissions, suitable data and secure workflows. Operations and IT should define these responsibilities together when assessing maintenance software.
What cloud operation can simplify
A central service can make information available across sites and devices. The provider may handle updates and infrastructure. The actual result depends on product scope, connectivity, devices and agreed operating conditions.
Cloud delivery does not automatically mean lower total costs or updates without interruption. Compare offers using the functions and support your organisation needs.
Which evidence should you examine?
- Permissions: how are roles assigned and former employees removed? Include access for external service providers.
- Protection and recovery: what backups exist, what can be restored and how is restoration tested? The presence of a backup alone does not demonstrate successful recovery.
- Processing: where is data processed, which subcontractors are involved and what contractual arrangements apply? Personal data requires a separate privacy assessment.
- Assurance: which reports or certificates cover the specific service and period? A data centre certificate does not automatically cover the whole application.
Germany's BSI provides guidance on secure use of cloud services. Use such material to formulate concrete questions rather than inferring security from the word “cloud”.
Test availability where work happens
Check typical work areas, including plant rooms and places with weak coverage. Establish what remains available without a connection and how later changes are reconciled. Mobile access and comprehensive offline operation are different capabilities.
Define an operational fallback for a longer outage. Critical work should not depend on an untested assumption that a service is always reachable.
Plan for a future exit
Ask to see an export of assets, orders and attachments. Check readability, relationships, retention and deletion arrangements. Agree who performs the necessary steps after a contract ends.
For ELARA, discuss the required product scope and available security evidence explicitly. Bring requirements from operations and IT into that discussion.
