Blog: What the SSP outage teaches brokers

Many brokers will be painfully aware of the power outage suffered by SSP Worldwide's data centre, which left its Pure Broking platform out of action for two weeks in August 2016. Some 40% of UK brokers rely on the platform to trade, so plenty of workplaces suffered a frustrating and costly fortnight during which they were unable to operate. 

To add insult to injury, some brokers are reportedly concerned that they will face disciplinary action from the Financial Conduct Authority for not carrying out their compliance work during this time. 

This may sound unfair, but FCA guidelines on outsourcing to the cloud place the responsibility for ensuring that outsourced services are continuously available with the subscriber. Organisations are now responsible for legal considerations, risk management, data security and adhering to international standards when outsourcing to a third party.

Insurers and brokers therefore need to ensure that software providers have adequate measures in place to meet guidelines such as the Data Protection Act, and are able to continuously monitor and identify risks to data.

Numerous risks
There are many benefits that come with the adoption of software-as-a-service applications, but there are also numerous risks. Subscribing to third-party services often means placing sensitive and business-critical data in the hands of another company. This could put insurance companies and their business operations at risk if the service provider goes out of business, falls victim to a cyber attack, or experiences an outage.

However, this risk is often justified by the value of outsourcing to third-party applications. Software such as the Pure Broking platform increases efficiency, can streamline operations and helps to cut costs. It can be argued that investing in technology is increasingly necessary for businesses within the insurance sector that often face emerging competition from insurtech companies.

The FCA guidelines put in place rigorous standards to protect organisations. But navigating the finer points can be difficult, especially because third-party service providers often rely on external data centres for storage and software hosting, and have links to other companies. This can make tracking the safe handling and storage of data difficult, as well as complicating the ability of businesses to ensure that software is always available.

Often, it's easier to enlist a third party to monitor the relationships between the SaaS provider and its cloud service provider or data centres. Not only does this mean that the customer can be aware of any issues regarding its sensitive data, but it can be pre-warned if the SaaS provider isn't making payments - potentially a sign of financial issues.

In case the worst does happen, businesses need to ensure that they are still able to access their business-critical applications and have a plan to rebuild the application if necessary. For example, having a copy of the software or application source code means that these programs can quickly be rebuilt if necessary and making regular backups of important data will ensure that it is always accessible.

In order to ensure continuous access to their business-critical data, brokers should also have agreements in place with any associated data centres, independent of their software provider. This means that even if the provider unexpectedly goes out of business, brokers will be able to retrieve their data with little or no disruption to their day-to-day operations.

These steps may sound lengthy, but if brokers are to learn anything from SSP's outage, it should be to prepare for the worst. Outsourcing to third-party software is a great way for insurance services companies to stay competitive, but they should maintain a degree of caution if they want to avoid any nasty surprises. The FCA guidelines provide a good starting point for insurers and brokers alike.