When I was studying electronics and mechanics in University during the 80’s, we talked about always having a second source for critical components.

This lesson needs to be taught again in the IT industry, as many organizations rely on only one vendor, and often a vendor located in US.

So the question is if I follow my own recommendations about second source for the cloud? This is new article in my EA study saga.

Cloud as a principle

Today most things for Artmann Media is hosted in the cloud, and we can barley run our IT without this infrastructure today.

Microsoft Office 365 including Teams & Sharepoint
Yamdu for production planning
Visma for finance, CRM and project management
Adobe for post-production
SquareSpace for webhosting
iCloud, Backblaze and LucidLink for storage
DNS and other infrastructure.

For post-production, we have perpetual licenses, and run locally for everything, except Adobe Suite that is our second source in this area.

Most computers are from Apple, so there is a long term dependence here, but we also have Windows servers for certain purposes.

We have sensitive personal data and GDPR impacts our operations, and non-EU cloud providers complicates things.

What are the options?

If we look at the options to cloud, what do we get?

Microsoft Office 365 is used in all processes, so this is probably the biggest hurdle. My plan B since several years back is to run Microsoft Office, including Sharepoint and Exchange locally on-premise in Sweden, with VPN-access and perpetual licenses.

Yamdu is a tool in the cloud for production planning, as breaking down scrips, creating short plans and call-sheets. It also contains sensitive personal data. It's possible to run on-premise, but expensive, so this not an option for us.

Yamdu is located in Germany, and the owner ARRI is a well established German company, run on infrastructure in Germany. The impact from actions related to US government are thus less, and I see the risk as much lower today than with US-based vendors.

Visma Accounting is developed in Sweden and Visma Project is developed in Finland, so I anticipate even lower risks than EU-based services. For both services, I can export general ledger, customers, suppliers and products to use something else.

Adobe Suite. If anything happens, then by by. We have other tools to use instead of their products. They will go out of business if the cloud disappears, so much bigger problem for them.

SquareSpace, same as Adobe.

iCloud, Backblaze and LucidLink are end-to-end encrypted services where sensitive personal data is managed. Worst case, if access is blocked there are other alternatives in EU.

Our DNS is Hover, with head office in Canada and European office in Germany. I also have a backup DNS and e-mail in Sweden for management of critical accounts. Consequences are dire, but risk is very low due to mitigation actions.

What is you plan B?

Disruptive architecture