Managing the cloud service depends upon the terms of the contract between the cloud customer and the CSP. A recent article on negotiating cloud contracts published in the Stanford Technology Law Review provides a comprehensive list of the concerns of organizations adopting the cloud and a detailed analysis of cloud contract terms. According to this article, many of the contracts studied provided very limited liability, inappropriate SLAs, and a risk of contractual lock in. Beware of standard terms and conditions set by the CSP and consider carefully when to accept them. If the CSP won’t negotiate, try going via an integrator.
7. Ensure clear division of responsibilities
You can outsource the processing, but you can’t outsource responsibility – make sure that you understand how responsibilities are divided between your organization and the CSP. For example, under the UK Data Protection Act, the cloud processor is usually the “data processor” and the cloud customer is the “data controller”. The “data controller” can be held responsible for breaches of privacy by a “data processor”.
8. Require independent certification of your CSP
Independent certification is the best way to assure the claims made by a CSP. However, it is important to properly understand that what is certified is relevant to your needs. ISO/IEC 27001:2005 remains a key information security standard (although a new standard for cloud services is being developed). Although they are not specifically focussed on cloud, the recent standards for SOC reports (service organization control reports) are very relevant.
9. Trust but verify
Using the cloud inherently involves an element of trust between the consumer and the provider of the cloud service. However, this trust must not be unconditional and it is vital to ensure that the trust can be verified.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.