Case Study: How Cambridge Management Consulting Helped Liberty Global with a Centralised Procurement Model

The Naze is a unique headland that extends northwards from the seaside town of Walton-on-the-Naze. Derived from the old English word ‘naes’ meaning promontory or, quite literally, nose, the Naze is the most easterly peninsula in Essex. The Naze's extensive tidal creeks, islands, and salt marshes form part of the 2000 acre Hamford Water National Nature, a wetland of international importance for migratory birds. This evocative landscape was the inspiration for Arthur Ransome's 'Secret Water’, part of the Swallows and Amazons series. The Naze cliffs are a designated a Site of Special Scientific Interest. Just a short stroll along the beach offers glimpses into its rich natural history, with sharks’ teeth, shells, and fossils scattered along the shore. The cliffs offer a fascinating strata, including London Clay formed about 50 million years ago in a subtropical sea and sands called the Red Crag from about 3 million years ago. The Naze is also home to a diverse collection of wildlife. It is home to migratory and nesting birds such as the Dark Bellied Brent Goose, Sedge Warbler, and Whitethroat. There is also a large colony of seals. They can be seen sunbathing on mudflats in the backwaters or bobbing about in the waves. Beyond its environmental significance, the Naze is vital to the local community and visitors. It attracts 200,000 visitors each year. The Hamford Water area also provides local employment with a marine industry supporting 200 jobs for Walton, light industrial sites, and farmland contributing to the local economy. Coastal landscapes like the Naze are increasingly recognised for their intangible cultural value, providing communities with wellbeing and mental health benefits. The iconic Naze Tower, a Grade 2* listed navigation mark built in 1720, is a beloved landmark offering museum exhibits, an art gallery, a cafe, and educational visits about the history, geology, and erosion of the Naze. Coast Under Threat Unfortunately, this invaluable environment is under significant threat from coastal erosion. For many years, the rate of erosion was measured at 1.5 metres per year. Yet, in the last ten years, this has accelerated to between 3-5 metres in some areas. Extreme winter weather and tidal events, often compounded by surge events, drive much of this erosion. Heavy rain saturates the cliffs, causing increased slumping, while high tides with greater wave energy claw away soft cliff sediments. Beach sands are also constantly moving along the exposed shoreline. The soft sediment layers in the cliffs become waterlogged and wash out in the winter, leading to collapse that is then swept away by the sea. Even without sea effects, the cliffs are inherently unstable due to soil behaviour and stress changes. The policy on open coasts allows erosion, and government funding for sea defence typically focuses on protecting property, which the Naze, as an open coast area, does not normally qualify for. At this accelerated rate, the north end of the Naze could be lost to the sea within ten years. This would mean the sea breaching into Hamford Water, permanently changing tidal flow and impacting the fragile salt marshes, wildlife, and all who enjoy and visit this environment. The accelerated erosion is already impacting areas near existing structures. Naze Protection Society In response to these threats, the Naze Protection Society (NPS) was established in April 1997 as a registered charity. The NPS is community-focused, representing local residents and visitors. Their task is to promote the issues, work to define solutions, attract community commitment, and guide the delivery of securing the future of the Naze. They believe proactive intervention is required. The society works through partnerships, bringing together experience, resources, and determination. From 1997 to 2010, they promoted the Crag Walk project, which was built between 2010 and 2011. This rock revetment was designed to secure the Naze Tower cliff frontage. The NPS raised £250,000 from the local community and visitors as the catalyst for the £1.2 million project, which also involved Tendring District Council (TDC), Frinton and Walton Town Council, and Essex Wildlife Trust. The NPS is now setting a new fundraising target of £25,000 a year to deliver soft-engineered structures and build resilience into the whole of the north beach area. They aim to reduce the erosion rate back to 1m/year average and provide resilience against climate change impacts between 2025-2050. Saving The Naze: The Cliffline Project To update the community on their efforts and plans, the NPS is holding the Saving The Naze: The Cliffline Project event. This community event, aligned with World Environment Day, will take place on Saturday, June 14, 2025 , from 10am to 3pm at The Columbine Centre in Walton-on-the-Naze. The event aims to set out the NPS approach to the Cliffline Project, focusing on an affordable plan to slow erosion. It involves valuing everything the Naze and Hamford Water contribute to the community, wildlife, economy, and peace, and developing a plan using science, local expertise, and passion to adapt to the challenges of climate change. To find out more, see the full agenda and reserve a space, visit the Eventbrite page: https://www.eventbrite.com/e/saving-the-naze-the-cliffline-project-tickets-1267463420209?aff=oddtdtcreator How You Can Help the Naze The Naze Protection Society relies on community support to carry out its work. You can help protect this unique environment for local people and visitors for future generations to enjoy. Join: Become a member today for only £10 per year: https://nazeprotectionsociety.org/become-a-member/ Volunteer: Contribute your time and skills to help preserve the Naze: https://nazeprotectionsociety.org/get-involved/ Donate: Make a one-off donation to support the work of the Naze Protection Society. Your donation helps raise funds to promote and develop solutions to save this environment of unique historical and environmental importance: https://nazeprotectionsociety.org/donate/ Follow: Join them on social media to keep up to date with their work. You can find them on Facebook, Instagram, and Twitter. To find out more about joining, volunteering, or donating, please visit the Naze Protection Society website: https://nazeprotectionsociety.org/ If you have any other questions, please use the form below.

Pioneering Technologies for the Future of Urban Transformation Smart cities might sound like a utopian vision from the 1950s; something that sounds already out-of-date and perhaps even naive in our current geopolitical climate. But as urban spaces gradually implement a a series of technological leaps, the smart city emerges as a potential reality, offering a new way to unite communications with infrastructure via real-time feedback. Smart cities could dramatically enhance our quality of life, efficiency, and environmental stewardship. Given that cities are significant contributors to global emissions — responsible for approximately 70% of greenhouse gases — they will play a critical role in reaching net zero. Reflecting insights from the last Smart City Expo in Barcelona (November 2024) and a range of ambitious projects across the UK, this article delves into the strategic alignment of technology, infrastructure, and sustainability shaping today's urban landscapes. What Defines a Smart City? A smart city is fundamentally ‘a municipality that uses information and communication technology to increase operational efficiency, share information with the public, and improve the quality of government services and citizen welfare.’ While definitions vary, the overarching mission is to optimise city functions, drive economic growth, and enhance the quality of life through technology and data analysis. Smart city initiatives typically require three critical components: Networks of sensors and citizen participation to collect data Connectivity linking these networks to government systems Open data sharing to make results, changes, and improvements accessible to the public Developing this underlying infrastructure is complex and expensive. Crucially, it depends on strong relationships between government, the private sector, and citizens, as most of the work to create and maintain these data-driven environments happens through collaboration and public-private partnerships.

Edge computing, 5G, IoT and AI are contributing to a paradigm shift in retail that will imagine new possibilities made commercially viable by real-time data processing. In this article, we look at the convergence of these technologies and how they will offer a radical new vision of our high street by offering customers exciting new experiences that can rejuvenate in-store shopping and retail spaces. First, in Part 1, we look briefly at each technology and discuss the technical advantages they offer and how this supports new types of customer experience. Then in Part 2 we look at industry predictions about how the retail space might evolve over the next decade. Part I Edge Computing Edge computing involves processing data near its source rather than in a centralised location. In retail, this means deploying IT infrastructure in or near store venues where consumers interact with products. This ecosystem enables real-time decision-making and personalised customer experiences by analysing data from sensors and IoT devices within the store. Edge computing is a concept that applies to an integrated network of processing units, data centres and sensors that handle data close to the user. Micro Data Centres The compute part of edge computing needs to be housed in proper data centre facilities, to ensure that the expensive server equipment, especially those used by AI systems, are kept in the optimum conditions — this helps keep maintenance and operational costs down. Even though edge compute systems can be relatively compact, retailers will mostly be unwilling to give up valuable floor space for the IT equipment and its associated infrastructure (like cooling and electrical systems), so the more likely scenario is that smaller data centres will be used that can be located close by but in back-of-house areas, such as loading bays, car parks, warehouse areas and so on. These will often be operated as cloud services so that multiple retailers can benefit from edge compute without having to bear the upfront capital cost, and, most importantly, the ongoing maintenance required to keep them operational. 5G 5G networks offer high-speed connectivity and low latency, which are crucial for supporting advanced retail technologies like augmented reality (AR) and Internet of Things (IoT) applications. The increased bandwidth allows for seamless integration of online and offline shopping experiences, enabling features like virtual try-ons and real-time product comparisons. This connectivity supports personalised marketing strategies that take place in real time and deliver targeted promotions in store. Internet of Things (IoT) The Internet of Things (IoT) refers to a network of interconnected devices, machines, and sensors that collect, store, and transfer data over the internet. These devices are embedded with sensors, software, and network connectivity, allowing them to communicate with each other and with other internet-enabled systems. IoT plays a crucial role in enhancing the retail experience by providing real-time data on customer behaviours, security risks, buying preferences, inventory supply levels and daily operations. IoT devices will principally include cameras but also a range of other sensors such as RFID tags and smart shelves.

How to Connect Rural Britain and the Hardest-to-Reach Customers The lack of rural connectivity in the UK has become a pressing issue , creating a digital divide that impacts individuals, businesses and farmers. Modern society relies on digital services, and the lack of access to reliable, high-speed internet is a pervasive social issue that results in digital exclusion for communities, depriving them of fundamental services like online banking, health care, and education. This lack of access has a further impact on social mobility, particularly when around 37% of workers in the UK spend at least one day a week working remotely. In 2021 the Public Accounts Committee published a report on improving broadband which states ‘1.6 million UK premises, mainly in rural areas, cannot yet access superfast [internet] speeds’. Since then, we are happy to report that there has been some progress. As of early 2025, approximately 98% of all UK households have access to high-speed broadband (defined as speeds of 30 Mbps or higher) . In rural areas, that figure is 89% — a decent improvement in the last few years. However, the gap is larger when we consider gigabit speeds: only 52% of rural households can connect to gigabit-capable broadband, compared to 87% in urban areas There is still a significant gap to plug, but things are moving in the right direction. This allows the focus to shift, in part, to the next phase: establishing a modern digital infrastructure which can support a digital-first strategy in public services, as well as encouraging local innovation, such as smart city programmes. The hope is that this infrastructure will drive inward investment which then create a virtuous circle, where as more infrastructure is built, more innovative businesses are attracted to the region, which in turn drives demand for more advanced infrastructure. In this article we look at the improvements in rural connectivity and the programmes and innovations which are most likely to have a social impact.

"Is it Snowing in Space?!" “Is it snowing in space?!” Asks a disgruntled Bill Murray in the film Groundhog Day when he is told that he cannot call out from the snowbound town of Punxsutawney, Pennsylvania. If there is a remake, Bill might not have to worry: signal dead zones may soon be a thing of the past due to recent advancements in satellite technology. Whereas the old picture of satellite communications was a scientist in the wilderness with a big clunky antenna, these days the technological payload is all in space. Recent advancements such as Low Earth Orbit (LEO) satellites, advanced beamforming, and the use of mobile spectrum bands means that any phone supporting 4G LTE can potentially receive satellite data directly. This integration of satellite and terrestrial networks is set to reshape the mobile industry, creating both opportunities and challenges for traditional mobile network operators (MNOs) and mobile virtual network operators (MVNOs). In this article we give an overview of the technological advancements, the major players in the market, and then consider the effects this will have on traditional wholesale mobile market structures; concluding with the emerging opportunities for new revenue and growth. The Evolution of Satellite Connectivity Historically, satellite communications operated independently from terrestrial networks, serving specialised markets with limited scalability and high entry barriers. However, recent advancements, particularly in Low Earth Orbit (LEO) satellite technology, have dramatically altered this scenario. The most well-known example is obviously SpaceX, which has played a pivotal role in democratising space: reducing barriers to entry and making satellite connectivity more scalable, performant, and accessible. SpaceX and other companies have found innovative ways to dramatically reduce costs. Since Sputnik 1 in 1957, launching payloads into space has been prohibitively expensive, with costs exceeding $100,000 per kilogram in the 1960s and averaging $16,000/kg for heavy payloads from 1970 to 2010. SpaceX’s innovations have brought these costs down through reusable rockets, vertical integration, economies of scale, and advancements in materials and manufacturing processes: leading to price points as low as $100 per kilogram in recent years. However, cost is just one of the barriers. The real gambit has been provided by Low Earth Orbit (LEO) satellites, which typically orbit at altitudes ranging from approximately 160 to 2,000 km and offer low-latency, high-speed connectivity — making them ideal for real-time applications and direct-to-device communications. The latest generation of technologies now enable LTE mobile phones to connect directly to satellites without specialised hardware, marking a significant milestone in mobile communications. The Major Satellite-to-Cell Players While SpaceX's Starlink has garnered the most attention, several other major companies are actively developing satellite-to-cell technologies and forming strategic partnerships with terrestrial mobile operators. As of April 2024, Starlink had established 15 partnerships with mobile carriers globally — including T-Mobile in the US. T-Mobile has structured its beta program to begin with text messaging capabilities, gradually expanding to include picture messages, data connectivity, and eventually voice calls. As of February 2025, it is reported that 7,086 Starlink satellites are in orbit, with 7,052 being operational. AST SpaceMobile has emerged as a significant innovator, achieving a historic milestone in April 2023 with the first-ever two-way voice call directly with an unmodified smartphone, via their BlueWalker 3 satellite. AST SpaceMobile launched its first five commercial satellites, the BlueBird 1-5 mission, on September 12, 2024, aboard a SpaceX Falcon 9 rocket. Lynk Global represents another significant player. In a recent expense report, it revealed that each satellite costs around $400,000 to build and up to $815,000 to launch into space. They hope to have up to 1000 satellites (for full continuous broadband coverage) in orbit by 2025 and 32 mobile network operator (MNO) partnerships by the end of 2025. The company has successfully demonstrated text messaging capabilities from satellites to standard cellular devices and continues to expand its constellation and service offerings. Huawei has partnered with China Telecom to demonstrate satellite-to-phone messaging capabilities, while Apple has worked with Globalstar to implement emergency satellite messaging features in recent iPhone models. Implications for Traditional Wholesale Mobile Market Structures Traditionally, the wholesale mobile market has been structured around MNOs, MVNOs, and wholesale aggregators. Revenue streams have typically included MVNO wholesale pricing, and IoT and machine-to-machine (M2M) solutions. However, the rise of satellite-to-cell technology poses potential threats to this established model. Disintermediation of MNOs and MVNOs Satellite-to-cell connectivity introduces the potential for disintermediation, where control traditionally held by MNOs could become fragmented across multiple parties in the value chain. As satellite providers increasingly offer direct-to-device services, traditional operators risk losing their central role in network management and customer relationships. Pricing Pressure on Wholesale Markets The increased availability and competition from satellite connectivity providers could exert downward pressure on wholesale pricing. As satellite services become more affordable and accessible, traditional wholesale providers may face challenges in maintaining their pricing structures and profitability. Competitive Pressure in IoT and Enterprise Applications Satellite connectivity is particularly well-suited for IoT and enterprise applications, especially in remote or challenging environments. As satellite-to-cell technology matures, traditional wholesale providers may face intensified competition in these segments, necessitating strategic adjustments to remain competitive. Emerging Opportunities in Satellite-to-Cell Connectivity Despite these challenges, the integration of satellite connectivity into mobile networks also presents substantial opportunities for innovation and growth. Forward-thinking operators can leverage satellite-to-cell technology to develop new business models and revenue streams. Hybrid Terrestrial-Satellite Subscription Models Providing Ubiquitous Connectivity Operators can offer hybrid subscription plans that seamlessly integrate terrestrial and satellite connectivity. Such models provide customers with uninterrupted coverage, enhancing user experience and creating differentiated service offerings. Wholesale Satellite Resale for MVNOs Satellite-to-cell technology opens new avenues for MVNOs to expand their service portfolios. By reselling satellite connectivity, MVNOs can offer enhanced coverage and reliability, particularly in underserved or remote regions, thereby attracting new customer segments. IoT and Enterprise-Focused Applications Satellite connectivity is a natural fit for IoT and enterprise applications, such as remote monitoring, asset tracking, and industrial automation. Mobile operators can forge strategic partnerships with satellite providers to deliver specialised solutions for these markets, tapping into new revenue opportunities. Emergency-Only and Disaster Recovery Plans Satellite-to-cell technology can play a crucial role in emergency and disaster recovery scenarios, providing a reliable backup to terrestrial networks when they are unavailable or overwhelmed. Operators can develop emergency-only plans that leverage satellite connectivity to ensure critical communications during crises. Conclusion Satellite-to-cell technology represents a convergence of space and terrestrial communications systems that promises to fundamentally alter global connectivity markets and players. The dramatic reduction in launch costs by a factor of 20 has enabled the deployment of massive satellite constellations that were previously economically unfeasible. The competitive landscape continues to evolve rapidly, with SpaceX, AST SpaceMobile, and Lynk, and traditional telecommunications companies all pursuing various technological approaches and business models. Commercial text messaging services are already becoming available through beta programs, with video calling capabilities demonstrated and voice calls progressing toward wider availability. The integration of 5G standards with satellite networks continues to advance through collaborative industry initiatives, with projections of a $50 billion market by 2032. As this technology continues to mature throughout 2025 and beyond, it promises to eliminate mobile dead zones and create new application possibilities that were previously unimaginable. The future of mobile communications is undoubtably hybrid: blending terrestrial and non-terrestrial networks into seamless connectivity solutions that follow users wherever they go. This has wide reaching implications for connectivity in remote and isolated regions, and offers perhaps the fastest and most cost-efficient route to bridging the digital divide. It will also transform how we respond in disaster zones and hazardous areas — increasing the ability to protect and save lives with faster and safer humanitarian and emergency services.

What Problem do Too Many SaaS Providers Have in Common? Many SaaS security providers have a history of treating important safety and security features as something to upsell. This raises the important question of whether a software vendor has a moral responsibility for the secure operation of their solution. In this article, we explore the implications of treating important security and safety features as an upsell, using Boeing as a test case of where this can go wrong. The Case of Boeing and the Aviation Industry The case against Boeing is emblematic of a more systemic issue across the aviation industry, and many other industries. The public became aware of this issue under tragic circumstances when the Lion Air and Ethiopian Air Boeing 737 Max airliners crashed in 2018 and 2019 respectively. According to the widely quoted New York Times article , the crash could have been avoided if the pilots had access to two safety features that were sold by Boeing as optional extras. According to the incident reports, at the root of the incident were the angle-of-attack sensors. These mechanical sensors operate in a similar fashion to a weathervane to measure whether the aircraft’s nose is pointing above or below the direction of airflow. Being mechanical, they may be prone to malfunction, perhaps jamming after having been installed incorrectly — as was believed to be the case for the Lion Air aircraft . The system that led to the aircraft’s demise, which identifies the risk of the aircraft stalling, only listened to one of the sensors. A difference in the signal being sent by the two sensors was not recognised by the anti-stall system; and the instruments that would have alerted the pilots to the conflicting signals were upsell items. This wasn’t a fancy, nice-to-have bell or whistle that makes the flight more comfortable, efficient, or profitable. It is an underlying safety feature of the aircraft. If there was no safety requirement for the redundancy of two sensors, it is difficult to see why there would ever be more than one. Boeing has now addressed the issue, and the anti-stall system listens to both sensors, responding safely in the event of conflicting signals. It should also be noted that the investigation identified pilot error and deficiencies in the training that contributed to the disasters (and this will be relevant to our points regarding many SaaS product decisions as well). The SaaS Parallels Cloud-delivered Software as a Service (SaaS) has revolutionised the tech industry, and catalysed a phenomenal level of innovation and growth. It has enabled new software capabilities to be brought to market faster than ever before, and facilitated the ability to reach a scale with costs defrayed across multiple customers that would have been unimaginable 30 years ago. However, the benefits of being able to access a service from anywhere, at any time, by anyone also presents significant risks. The ‘anyone’ can be a malicious party operating outside of the reach of law enforcement or extradition. As a result, there are clear commercial responsibilities placed on SaaS providers to secure their infrastructure from attack, and those that do not are unlikely to last long in the marketplace. But just like the aviation industry, there are different flavours of security, and different perceptions of what is considered essential. Taking due care and applying due diligence to ensure that the platform itself is adequately secured from a direct attack is clearly the vendor’s responsibility – but what about those elements of security that relate to risk owned by their customers? One key element of customer risk relates to the security of a user’s password. It is their responsibility to make sure they choose a long and random string drawn from upper case, lower case, numerical, and special characters (if allowed). It is also their responsibility to ensure that they do not ever use the same password for multiple applications or services. But, we know that compromised credentials is a common failure mode. Just because it is the user’s responsibility to mitigate this risk, this doesn’t mean that system developers do not also have some mutual responsibility to make it easier for the user to exercise that responsibility; controls have been developed specifically for that purpose. The most obvious ones are Multi Factor Authentication (MFA, or 2FA), and Single Sign On (SSO). With MFA, we improve the security of the credentials by also verifying that the user is in possession of their trusted device before we trust them at sign in. With SSO, we minimise the number of credentials and accounts to manage by federating with a single corporate account; we can then concentrate our effort to secure that corporate account rather than spreading our resources thinly. Both are relatively easily implemented these days, particularly in the case of SSO where the OAuth protocols are widely offered by Identity Providers. Once implemented, both are essentially free to operate, particularly if MFA uses an Authenticator app rather than SMS text messages. SaaS providers recognise that this security is important, and they will frequently implement MFA and SSO controls into their applications to meet that customer demand. But, too frequently, we see them only offered as part of the more expensive subscription options. This element of security is not enhancing the vendor’s core proposition; it is not making their offering more functional, better looking, or more efficient for their users. It is just making it more secure, and therefore to treat it as an item to upsell comes across as price-gouging rather than the responsible application of good security practice. It is almost as though these vendors have run out of innovative bells and whistles that their clients would value in their core product, so they have had to resort to undermining the security of their cheaper options in order to encourage their customers to pay for their more expensive ones. It is equivalent to a bank only using the CSC code on a card to secure transactions for customers who pay for their premium banking services, because, after all, it is the customer’s responsibility to protect their card details. Conclusion What we have described here is not universal, and probably is not even representative of the majority of SaaS providers. But, when you are reviewing a new service, we urge you to take a closer look at what security your provider is charging extra for. If low cost, high value security controls are being upsold, then you may want to consider what other security good practices are not being considered essential. For more information about our cyber security consulting services and Secure by Design principles in action, please contact Tom Burton, Partner for Cyber Security, using the form below.

As the UK's ageing copper landline network becomes increasingly unstable, Cambridge Management Consulting reports that BT is urging Critical National Infrastructure (CNI) providers to expedite their transition from analogue to digital voice. With the Public Switched Telephone Network (PSTN) nearing the end of its life, organisations face significant risks if they delay planning and execution for this essential upgrade. Recent data indicates that 60% of CNI providers in the UK still lack a strategic plan to migrate from the legacy analogue network. This statistic underscores an urgent need for action to safeguard essential public services, such as healthcare, water, energy, emergency services, and government operations. The transition is not merely a technological upgrade; it is a once-in-a-generation programme to future-proof communications and improve service reliability. The PSTN, our communications backbone for over a century, is becoming increasingly prone to faults and difficult to maintain, with recent reports showing a 45% increase in significant resilience incidents. The impact of this transition is wide-reaching, affecting critical systems such as telemetry monitoring sensors, emergency phone lines, telecare alarms in hospitals and care homes, CCTV, intruder and fire alarms and older EPOS machines.  As the below graphic shows, a broad spectrum of devices and services will be affected by the analogue switch off, including ISDN, ASDL and Fibre to the Cabinet (FTTC) broadband services. The majority of organisations are almost certainly in the dark when it comes to common knowledge of all of the devices affected, lacking the internal expertise and records to identify and audit complex, interrelated legacy systems.

Well Intended Guidance Leaves more Questions than Answers The UK Government Digital Services – part of the Department for Science, Innovation and Technology – has recently published guidance for how the public sector should adopt a multi-region approach to cloud technology. At first sight this appears encouraging. Any unnecessary constraints on hosting arrangements (or any other non-functional requirements) reduce the available market of providers, constrain competition, and therefore inevitably reduce value for money. If parts of Government, whether central, regional or local, have felt that everything must be hosted in the UK then it makes sense to produce guidance that clarifies this perception and helps to open their options up. But for guidance to be useful it should guide. It should make it easier for people to take actions that they previously would have discounted. The guidance in this case, which at 1420 words is almost as short as this article, probably leaves the reader with more questions than answers. It may reveal some unknowns, but without increasing certainty. The Guidance in a Nutshell A summary of the guidance is as follows: Look wider than UK: Many cloud solutions may not offer UK hosting, particularly new innovative solutions that haven’t scaled up yet. Irrespective, their staff are likely to be distributed around the world if the service is supported 24/7. There may also be other benefits in looking wider than UK hosting, such as enabling better business continuity and disaster recovery options if the vendor only has one UK site. Get legal advice: Before you even consider a non-UK option you need to seek advice from your own legal advisors and your Data Protection Officer (DPO). Ensure compliance with ICO guidance: Before you even consider a non-UK option you need to check and make sure that any international transfer of personal data will be compliant with the Information Commissioner’s Office (ICO) guidance, and you should get further guidance from your own legal advice and DPO. Do a full review of vendor security: Before you even consider a non-UK option you need to make sure the vendor and solution are compliant with your own security policies. In a nutshell, it says: 'you should consider options outside of the UK but only if you have checked everything is legal and secure'. This seems to be verging on a statement of the obvious; the real difficulty in going offshore is covering all of the legal, regulatory and security compliance aspects. Adequacy is a Moment in Time On point 3, the guidance points out data protection compliance is easier if the country in question is considered by the ICO to be adequate – having equivalent regulations for data protection to the UK. Sound advice. But even this is not that simple. For instance, the USA is not considered adequate unless it is under an extension of the EU-US Data Privacy Framework. This framework is dependent on an Executive Order that the Biden administration put in place, and it is entirely possible that it will be revoked by the current administration. If such an action was taken, or if for any other reason the EU decides that adequacy is no longer met (also not unlikely given Herr Schrems has achieved this twice already and has stated he plans to challenge the DPF), then the vendor will no longer be considered compliant. Consideration is Far Wider than Residency Security is far wider than data residency though. This is where point 4 both states the obvious and understates the complexity. Managing risk in the supply chain is inherently difficult. Cloud providers, and particularly SaaS solutions, aggravate this challenge by an order of magnitude. By their nature they are solutions designed for a broad and varied range of customers. This means they will always involve compromise. If they tried to meet the most demanding requirements, they would price themselves out of the scale marketplace. If they went for the lowest common denominator, they would be unable to meet the requirements of the majority. An individual customer can rarely dictate a specific security requirement for themselves. They are also highly opaque. The vendor presents their service as a black box. The features delivered to the customer are defined, but much of the underlying design and the means the vendor uses to manage it in operation are hidden. This makes assessing the risk far more of a judgement call than when the design and delivery is conducted under your control. Depending on the supplier, and the leverage that the customer has over them, it may be possible to get some information and assurances; but the right questions need to be asked, and the answers need to be interpreted correctly. Third party certifications and audits, such as the ISO27000 series of standards or the SOC1, SOC2 and SOC3 reports, can also provide some additional assurances. But only the customer will be able to decide the extent to which they can mitigate the risk, and the confidence they have in the supplier to manage their own. This is a business decision informed by the specifics and nuances of the risks being considered. Summary It is important to minimise the non-functional requirements and keep an open mind about potential solutions and vendors. This includes looking wider than just the UK when national security requirements are not paramount. But this is not something that can be distilled onto a single sheet of A4 in any meaningful way. Yes, there are legal and regulatory issues that need to be reviewed. And geopolitical risk needs to be factored in, considering how you would respond to future external changes that are outside of the UK’s control. But from experience, the greatest challenge is getting comfortable that the vendor’s organisation and their solution have adequate security – this applies equally whether the solution is hosted in the UK or overseas. The SaaS world is opaque, and balances priorities across a broad and varied customer base. The public sector needs to increase its adoption of cloud and SaaS solutions to remain efficient and relevant, in the same way that the private sector has had to. But the route to responsible adoption is more nuanced, requiring candid conversations with suppliers, and ultimately an informed but subjective judgement by the customer’s leadership. Sources/Links: DSIT Guidance for Multi-region cloud and software-as-a-service ↩︎ ICO Guide to International Transfers ↩︎ Executive Order (E.O.)14086 of October 7, 2022, on Enhancing Safeguards for United States Signals Intelligence Activities ↩︎ Note: This article originally appeared on Tom Burton's personal blog at https://digility.net/insights/