As you draft the questions that make up the RFP, your cloud-computing contract will be shaping up as well. Every issue that's important to consider when developing a cloud-computing contract should also be addressed in the RFP. And by asking multiple vendors how they propose to fulfill your needs, you not only obtain a firm understanding of the relative benefits provided by each vendor, but you also gain insight into where additional negotiations may be needed and what each vendor's starting point in those negotiable areas may be.

If you have to address risk-mitigation issues, it can play a key role on the RFP team by developing RFP questions and evaluating vendors' responses in relation to their particular areas of expertise and responsibility.

Some companies won't bother with an RFP for cloud services because they believe that all cloud vendors, especially infrastructure-as-a-service (IaaS) vendors, provide essentially the same functionality. But not all cloud vendors are created equal, and as the cloud market continues to evolve, vendors will attempt to distinguish their services from the competition.

As an example of the sorts of differences you can expect an RFP to uncover, a (SLA) guaranteeing "four nines" (99.99%) availability can be a big differentiator compared with a "three nines" (99.9%) SLA. (Do the math. With three-nines availability, the expectation is for close to nine hours of downtime per year. With four nines, it's less than one hour.) Then there's the very definition of "uptime." Some cloud providers may consider scheduled maintenance to be uptime, while others don't. An RFP, properly formulated, can help you find that out. And what does the vendor offer in the way of guarantees that it will meet the SLAs it commits to?

There are many elements of a cloud vendor's infrastructure and to evaluate, and vendors vary widely in this regard as well. By including an in the RFP, you can gain valuable insight into whether or not a particular cloud vendor runs a sufficiently tight ship to meet your needs. You'll also want to ascertain what the vendor may have to validate its infrastructure/security claims. If you find that a given vendor's response in this area meets your needs, then you should spell out its current infrastructure/security mechanisms and certifications as minimum requirements in the contract.