2. Track the fast-changing standards landscape.
Like it or not, you're an early adopter. Your decisions about what applications to move to the cloud and when to move them will benefit from an understanding of new and/or modified standards that are now evolving for cloud computing.
Today you can look for SAS 70 Type II and ISO 27001 certifications for general compliance with controls for financial and information security typically required by government and industry regulations, but these don't guarantee that your company's processes will comply.
"Standards like ISO 27001 and SAS 70 are helpful but they're point-in-time," says Jonathan Penn, VP and principle analyst for Forrester Research. "And they aren't very specific when it comes to data security, identity management, administrator controls - things like that. What we need is more visibility to the users about what's going on. Right now it's basically a big black box."
Bringing visibility to users is a major goal of the Cloud Security Alliance, a three-year-old organization fast gaining popularity among users, auditors and service providers. A major goal of the CSA is development of standardized auditing frameworks to facilitate communication between users and cloud vendors.
Well underway, for example, is a governance, risk and compliance (GRC) standards suite, or stack, with four main elements: the Cloud Trust Protocol, Cloud Audit, Consensus Assessments Initiative and the Cloud Controls Matrix. The Cloud Controls Matrix includes a spreadsheet that maps basic requirements for major standards to their IT control areas, such as "Human Resources - Employment Termination," while the Consensus Assessments Initiative offers a detailed questionnaire that maps those control areas to specific questions that users and auditors can ask cloud vendors.
Efforts of the CSA and other alliances, plus those of industry groups and government agencies, are bound to produce a wealth of standards in the next several years. The CSA has formal alliances with ISO, ITU and NIST, so that its developments can be used by those groups as contributions to standards they're working on. And a 2010 Forrester Research report counted 48 industry groups working on security-related standards in late 2010.
3. Take care with the SLA.
Regardless of your company's size or status, don't assume your cloud vendor's standard terms and conditions will fit your requirements. Start your due diligence by examining the vendor's contract.
That's the advice of Michael Larner, an attorney with Hogan Lovells, an international law firm with experience in cloud compliance and security issues. Larner, who often helps clients negotiate service level agreements, says to start with your own risk-benefit analysis to see if the vendor's standard contract is sufficient for your compliance needs. If not, determine what you need to negotiate to increase your comfort level.
Your company's size can give you leverage to negotiate, but a smaller business can find leverage, too, if it represents a new industry for a cloud vendor that wants to expand its market. In any case, don't be afraid to negotiate.
"With too many companies there's an assumption if you're dealing with a large vendor that the vendor won't negotiate. In fact, you might find that the vendor is willing to make some exceptions to raise your comfort level," Larner says.
If you're new to the cloud, you may find that starting out on a pilot basis, or with non-critical data, is a good way to build confidence, he says.