As soon as you contract with a
cloud provider, you should be concerned not only with your IT security but the provider’s as well. If you’re a small or medium-sized business you may assume the provider’s security is superior to your own, and you might be right, but make sure you ask the right questions first. Here are some general questions you should consider asking.
- Does the provider take responsibility for the security and integrity of your systems and data or does it consider them your responsibility? If so, what security aspects does the provider take responsibility for?
- Does the provider encrypt data in transit and at rest?
- What measures does the provider take to destroy data after it is released by customers?
- What security certifications does the provider possess: SAS 70 Type I or II. PCI-DSS? What proof can the provider offer of those certifications? Can you examine the SAS 70 report? How often are its security practices audited and by whom?
- What physical security measures, processes, and monitoring capabilities does the provider have in place to prevent unauthorized access to its data centers and infrastructure?
- How does the provider screen its employees and contractors? Do those screening procedures differ at different international locations? How?
- Who at the provider’s premises can see your data? What internal controls does the provider have in place to prevent unauthorized viewing, copying, or emailing of customer information?
- What is the provider’s backup and disaster recovery strategy? How often are incremental backups made? How many copies of your data does the provider store and where are they stored? How far back do the copies go? How often and how do they test their backup and recovery infrastructure?
- If the provider stores data in non-U.S. locations can you specify where you want your data stored? How can it ensure your data will not be stored in other locations?
- What notice will the provider offer when it changes its data center locations or security practices?
- If the provider uses multitenant server model, what measures does it take to isolate individual tenant systems and data from each other?
- What visibility will the provider offer your organization into security processes and events affecting your data?
- Does the provider have an incident response plan? Can you see it? Does it measure up to your own? Does the provider include your organization in the incident response process?
- How do the provider’s identification and authentication systems integrate with your own?
- How can the provider ensure compliance with regulations your company must comply with?
- Does the provider offer periodic reports confirming compliance with your security requirements and SLA’s? Will it provide reports of attempted or successful breaches of its systems, impacts, and actions taken?
- What is the remediation process if the provider cannot live up to its security obligations? Token compensation may not be enough, as a serious breach can damage some organizations severely or even put them out of business.
- What will happen to your applications and data if the provider goes out of business? How can the provider ensure they won’t become the property of creditors?
- How does the provider ensure that legal actions taken against other tenants will not affect access to your data?
- If you decide to switch providers or take your systems and data in house, what will it take to migrate your systems and data?
By: Leon Erlanger
