Computerworld - Using the cloud for data processing and storage may have its advantages in terms of simplicity and cost, but ensuring regulatory compliance will not be nearly so simple.
What it all comes down to, ultimately, is that the user organization is responsible for figuring out who is doing what to its data and requiring assurances about the data staying in compliance.
"In certain cases, compliance will be impossible," predicted Jim Haskin, senior vice president at Websense Inc., a security services vendor in San Diego. "It is difficult to take full responsibility for who can access data, who sees it and how it is stored, since the premise of the cloud is that customers don't necessarily need to know or care where their data is," he added.
"As enterprises start to run their entire networks on the cloud, existing certifications [such as Gramm-Leach-Bliley, etc.] start to break down," added Jonathan Bryce, co-founder of Mosso, the cloud division of Rackspace Inc., a hosting firm in San Antonio. "The certifications assume that the enterprise controls everything, and it's all located within their office building."
But some observers make the point that the cloud doesn't necessarily complicate compliance issues. "The concept of auditing is to track everything that goes on, whether it's across the cloud or across multiple data centers of the same firm -- tracking is no different no matter where the various components are," said Mike Karp, senior analyst at Enterprise Management Associates Inc., an enterprise IT consultancy based in Boulder, Colo.
In fact, various sources agreed that regulatory compliance is often possible with cloud computing, although it takes special effort. As noted by Chris Day, senior vice president at Terremark Worldwide Inc., a cloud service in Miami that offers what it claims is a fully compliant cloud, "There is no magic solution." The basis of Terremark's compliance is that Terremark claims to know where the client's data is and what parts of the network it passes through, even if that complexity is invisible to the client.
That said, each separate compliance environment requires specific attention, Day added.
Compliance environments that experts cite as important for cloud computing included auditing-related standard SAS 70, Payment Card Industry Data Security Standards (PCI DSS) and the Health Insurance Portability and Accountability Act (HIPAA.)
SAS 70 refers to "Statement on Auditing Standards 70: Service Organizations," issued by the Auditing Standards Board of the American Institute of Certified Public Accountants (AICPA). According to Judith Sherinsky, manager of audit and test standards at the AICPA in New York, "SAS 70 applies when an audited entity sends data to a service organization, which does something to that data and sends it back to the user, who uses that data in its financial statements." An example is if corporate inventory data is sent to a cloud-based data center where a total valuation will be assigned to it -- a valuation that will later show up in the corporation's annual report.
- Troubleshooting Common Issues in VoIP Learn more about Voice over Internet Protocol (VoIP), including common VoIP metrics used, best practices in VoIP management and tips and tricks for...
- IDG Research Survey: Are you Paying Too Much for Your NMS? Feel like you're paying too much for network monitoring? You're not alone. This survey brief summarizes findings from research recently fielded by IDG...
- 2013 Network Management Software (NMS) Buyers Guide This white paper contains an independent comparison study of six different network management solutions and provides guidance on how you can choose the...
- Rightsizing Your Network Performance Management Solution: 4 Case Studies This white paper discusses challenges encountered as organizations search for the most cost-effective network performance management solution.
- Tips to Simplify Database Administration and Development Make your job easier while getting the most from the leading productivity tool for database professionals. Learn tips from Dell Software's Oracle® ACE,...
- E-Signature RFP Checklist Webcast If your organization is looking to adopt e-signatures, you may be overwhelmed by the number of providers that offer seemingly similar solutions. How... All Data Center White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!