The word governance derives from the Greek verb κυβερνάω [kubernáo], which means to steer, and was used for the first time in a metaphorical sense by Plato (according to Wikipedia). Wikipedia further expands on the term, rightly calling it “the act of governing”. Governance relates to decisions that define expectations, grant power, or verify performance.
Governance is about consistent management, cohesive policies, guidance, processes and decision-rights for a given area of responsibility. For the purpose of this discussion we will use it for the management, use and adoption of Cloud Services. The adoption of Cloud Services is challenging, those involved often concentrate on the security of data assets and any legislative implications that an organisation might be subjected to in the event of data assets being compromised. We discussed the concept of cloud security and its implications in an earlier article “To Cloud or Not to Cloud”
Speaking with a number of industry people about peoples’ appetite for cloud adoption made me wonder if cloud is no different to outsourcing or offshoring. We explored this idea last month when we discussed “Embracing the Cloud – A Decision Framework” where a 4-step approach was outlined, enabling your organisation to begin to adopt cloud services. This is really no different to the activities involved in procurement of business and IT services, and facilitating a quick turn-around time. In the end, it’s all about mitigating the risk associated with suppliers—onsite, offsite, outsourced, offshored or in the new lingo, Infrastructure-As-A-Service (IAAS), Platform-As-A-Service (PAAS), Software-As-A-Service (SAAS). Add an ‘AAS’ after any capability, and it’s a cloud service.
Obviously, as the take up of this new model increases, the challenge for executives is to ensure that controls are in place around the availability and viability of the cloud service offering—ensuring a service is fit for purpose and use, without neglecting data security and integrity.
Whilst business adoption of cloud services will not decrease, understanding that it is just another services model to be managed and governed is required. Governance will ensure that the value of business decisions can be tracked, and impacts to service level agreements for availability of the service, incident management, and growth on demand including the security and protection of the organisation’s data assets can be understood and improved over time.
To assist with the management of the cloud challenge a list of 25 considerations, dubbed “CloudAdopt25”, has been compiled to assist with establishing governance of cloud services. The 25 considerations have been split into 4 areas: Contract Management, Services Reporting, Services Management and Data Security.
Contract Management
1. Ensure that the lawyers of your organisation have adequate time to review the contract of services, specifically for any grey areas in which the vendor can change the terms of contracted services at their discretion.
2. Ensure the choice of jurisdiction is documented and agreed. An approach may be to agree that the contract between the parties be filed in the jurisdiction of the defendant.
3. The cloud services contract is required to document the actions that will take place at the start and end of the agreement to ensure appropriate establishment and closure of contracted services.
4. Ensure SLA’s are in place for e-discovery requests in the event of a litigation response, further understand the liability implication of actions by your employees when using cloud services.
Services Reporting
5. Provide the cloud services provider with a definition and understanding of the organisation’s control requirements.
6. Document current state controls posture of the cloud services provider against organisational requirements.
7. Establish reporting against the organisation’s compliance requirements.
8. Ensure organisational structures are in place to provide continuous real-time reporting for services being consumed.
9. Ensure independent verification of detective and preventative technology controls are in place to validate confidentiality, integrity and the availability of cloud sourced data and information assets.
Service Management
10. Establish clearly documented roles and responsibilities for service provisioning including access and identity services.
11. Establish and agree on change management procedures to ensure that critical dependencies on the cloud providers’ systems are understood such that they do not impact the overall service.
12. Establish and agree on incident management and response procedures that will be enacted in the event of a breach.
13. Ensure service availability parameters and thresholds are appropriately defined and agreed.
14. Ensure the cloud service provider understands their data lifecycle management obligations including backup, recovery, storage and archive.
15. Ensure request fulfilment procedures and associated processes are in place for access to the organisation’s data assets in non-proprietary format and the length of the transition period at the end of the contract.
Data Security
16. Ensure that the cloud services model you chose aligns with your risk tolerance and acceptance thresholds, and that the cloud services model is commensurate with the sensitivity and/or classification of the data being stored/processed in the cloud.
17. Understand and document clear data ownership obligations and accountability of actions in the event of a breach.
18. Ensure your legislative obligations for data protection and management are addressed.
19. Understand where your data is being hosted and any impact the host country’s privacy laws will have on your data.
20. Understand the legislative obligations that foreign owned vendors may be subject to (with regard to their local country’s laws) whilst operating within your country.
21. Understand the architecture of the cloud service and the proposed solution to ensure the isolation of tenant applications is appropriate and in line with your policies and data security standards.
22. Ensure the cloud services provider has a secure gateway environment that is certified by an authoritative third party and the infrastructure is using validated products meeting federal or national standards.
23. Ensure there is strong encryption at the gateway, further supported by robust threat monitoring and secure logging of all access to applications and infrastructure instances hosting your data assets.
24. Ensure and validate the cloud service provider’s police check and employee vetting procedures.
25. Ensure the cloud services provider has robust incident response and breach notification processes in place that are in-line with your own security incident response processes, and that they will support forensic investigation if required.
Follow @CSO_Australia and sign up to the CSO Australia newsletter.