Cloud-related issues raised in conference discussions and various publications focus on concerns such as:
- Data ownership and what the service provider is or is not allowed to do with this data
- The use of encryption and management of the encryption keys and digital certificates
- Identity and access management
- Compliance with data protection legislation, particularly about the location of the data
- Compliance with privacy protection legislation
- Terms of contract, including the right to audit the service provider
- Confidentiality and nondisclosures by the service provider
- Access rights to data by the personnel of the service providers and its suppliers or service providers
- Guarantees that in the case of termination of a contract there will be no copies of data left with the service provider
- The impact on the data owners if the service provider goes out of business or is the target for an acquisition by a third party
- The feasibility of terminating a contract and migrating the data (and related services) to another service provider
The real issue may be one of timing—the cloud is likely to be part of the service portfolio offered by third parties for many years to come. Optimists and risk takers will no doubt gain the benefits of cloud computing sooner and gain valuable experience in doing so. Those whose risk appetite is limited and deal with custom, critical applications may choose to wait until the issues discussed in ourJournal article have been addressed and resolved appropriately.
Read Eduardo Gelbstein and Viktor Polic’s recent Journal article:
“Data Owners’ Responsibilities When Migrating to the Cloud,” ISACA Journal, volume 6, 2014.