Hybrid cloud

NIST (National Institute of Standards and Technology), in 2011, defines hybrid cloud as the composition of two or more distinct infrastructures, private, community or public, bound together by technology that allows data and applications to move. At a manufacturer or a bank, that means a server estate in its own halls or in colocation, an Active Directory synchronized with Entra ID, backups sent to a hyperscaler and a handful of SaaS (Software as a Service) applications. The underwriter's problem is knowing where the "insured's computer system" ends. Many wordings include the hardware the insured owns, leases or operates, and some add hardware a provider operates on its behalf under a written contract. With that extension, an outage at the host of part of the estate can fall under direct business interruption, at full limit. Without it, the same event falls under dependent business interruption, often sublimited, or under nothing at all if the policy only covers malicious acts at the third party. Hybrid makes the boundary move: a virtual machine shifted on a Tuesday from one of the insured's halls to a cloud region changes regime without anyone rereading the policy. The difficulty comes back at the adjusting stage. After ransomware that encrypted both on-site servers and leased instances, the forensic accountant has to separate the hours lost restoring the insured's own estate from those attributable to the provider. The shared responsibility of each service, for its part, does not always follow the line the policy draws.