Where in the World is Your Cloud? Four Compliance Best Practices

CIO — If you think the phrase "It's in the cloud" means that your data resides on the Internet and is thus accessible everywhere equally, think again. Most infrastructure-as-a-service (IaaS) cloud services share the same residence model as traditional hosting and outsourcing deployments — they live in specific data centers in specific geographies. This means that customer data is generated and most likely stored in this physical location, giving it legal and privacy implications.

Unfortunately, Forrester's conversations with end users and vendors suggest that many organizations simply aren't aware of where their cloud data centers reside. This lack of information can be quite risky when the location of the data center triggers a number of privacy and data security requirements that — if not met — may just land you in jail, facing a stiff fine, or at least navigating cumbersome compliance requirements. While cloud can be a catalyst for the IT-to-BT transformation, which I'll talk more about at next month's IT Forum, it can also be the most expensive project your company embarks on if you don't have a solid strategy in place first.

Security responsibility ultimately rests with you, the business — not the cloud provider. While most IaaS providers strive to secure their public data center cloud environment, they're not likely to take responsibility for data protection and compliance. In fact, they take no responsibility for what you do atop their virtualized infrastructures and services. Infrastructure and operations professionals should expect to have to carry this burden when partnering with a cloud provider.

The mesh of privacy laws might seem daunting, but they can be managed by realizing that they are rules of engagement rather than business prevention tactics. They don't prohibit you from using IaaS cloud computing; these laws simply require you to pay attention to where these clouds are actually located and choose providers that will help you meet your constraints.

In recent research, Forrester identified four best practices to help infrastructure and operations professionals think globally but act locally:

1. Know The Locations Of Your Cloud Provider's Data Centers

You must understand where the cloud service provider will store the personal data of your employees, clients, and other parties. Knowing this is a prerequisite to implementing the required measures that ensure compliance with the laws where you do business (meaning wherever you have clients). These laws often restrict where you store personal or financial data and cross-border flow of data. If the cloud provider conducts any off-site replication or backup of your environment, ensure that those copies also meet your privacy constraints.

Continue Reading