Cloud computing is nearly synonymous with cost and usability improvements.  But among with these benefits are the security concerns; especially if your organization is looking to adopt the cloud for business critical applications that house your sensitive data.  Let’s take a look at one of  CTI’s Top Ten considerations checklist for choosing your cloud provider.

1. Where’s the data? Different countries have different requirements and controls placed on access.

   Because your data is in the cloud. You may not realize that the data must reside in a physical location. Your cloud provider should agree in writing to provide the level of security required for your customers.

2. Who has access? Access control is a key concern, because insider attacks are a huge risk. A potential hacker is someone who has been entrusted with approved access to the cloud.  Anyone considering using the cloud needs to look at who is managing their data and what types of controls are applied to these individuals.

3. What are your regulatory requirements? Organizations operating in the US, Canada, or the European Union have many regulatory requirements that they must abide by (e.g., ISO 27002, Safe Harbor, ITIL, and COBIT). You must ensure that your cloud provider is able to meet these requirements and is willing to undergo certification, accreditation, and review.

4. Do you have the right to audit? This particular item is no small matter; the cloud provider should agree in writing to the terms of audit.

5. What type of training does the provider offer their employees? This is actually a rather important item, because people will always be the weakest link in security. Knowing how your provider trains their employees is an important item to review.

6. What type of data classification system does the provider use? Questions you should be concerned with here include: Is the data classified? How is your data separated from other users? Encryption should also be discussed. Is it being used while the data is at rest and in transit? You will also want to know what type of encryption is being used. As an example, there is a big difference between WEP and WPA2.

7. What are the service level agreement (SLA) terms? The SLA serves as a contracted level of guaranteed service between the cloud provider and the customer that specifies what level of services will be provided.

8. What is the long-term viability of the provider? How long has the cloud provider been in business and what is their track record. If they go out of business, what happens to your data? Will your data be returned, and if so, in what format?

9. What happens if there is a security breach? If a security incident occurs, what support will you receive from the cloud provider? While many providers promote their services as being unhackable, cloudbased services are an attractive target to hackers.

10. What is the disaster recovery/business continuity plan (DR/BCP)? While you may not know the physical location of your services, it is physically located somewhere. All physical locations face threats such as fire, storms, natural disasters, and loss of power. In case of any of these events, how will the cloud provider respond, and what guarantee of continued services are they promising?