So if you want to use five different cloud vendors, for instance, you need to be sure beforehand that you can apply those customizations to all five platforms.
Creating these types of policies is not something many companies are doing yet, "because use of the cloud right now is a bit like the Wild West," Staten says.
However, Staten points out that security customization is yet another way to get locked into a particular vendor, because if you wanted to move to a different provider, you would need to unwind and then redo all that work.
Maturity takes time
Over time, standards will develop, Staten says, most likely driven by customer demand. This won't happen without tension, he says, because customer demand will be offset by the advantages that vendors see in lock-in. For that reason, users need to be adamant about which standards they desire and where they're most important. One crucial area is in using open Web services in application-to-application communication, Staten says.
Gartner analyst Richard Ni contends that IT leaders can encourage standards development by ensuring that their teams consider a wide range of vendors and technologies beyond the obvious leaders. "We will encourage lock-in if we close our eyes to other vendors in the industry," he says. "The CIO has a role to play in ensuring several vendors are involved in the assessment, selection and due diligence process."
As the hype about cloud computing begins to settle down, the hope is that lock-in concerns will grow more rational and less emotional. That will be a welcome development to Bonvanie, who sees just as much risk with traditional computing systems. In fact, his use of NetSuite's Web-based business software and IntAcct's Web-based ERP software has convinced him that they have easier interfaces and procedures to retrieve and unload data than SAP does.
"What gets me nuts is that the same people who are concerned about lock-in in the cloud are not concerned about it behind the firewall or on-premise systems, where people normally run mixtures of three or four different breeds of Unix," Willis agrees. "It's much harder to move from AIX to Sun than to move from Amazon to FlexiScale," he says.
Willis looks forward to the day when people stop asking whether the cloud causes lock-in. "It's the wrong question," he says. "The cloud is just the furniture." Instead, Willis says, remove the word cloud altogether and ask, "Is there lock-in in the choices I'm considering?"