NASA's cloud audit holds value for all
The recommendations can be leveraged by any organization that wants to more effectively adopt cloud-computing services
Computerworld - NASA's Office of the Inspector General (OIG) recently audited and evaluated the efficacy of the space agency's efforts to adopt cloud-computing technologies. The resulting report, "NASA's Progress in Adopting Cloud-Computing Technologies," includes six recommendations "to strengthen NASA's IT governance practices with respect to cloud computing, mitigate business and IT security risks and improve contractor oversight." While the recommendations are specific to NASA, their underlying concepts can be leveraged by any organization that wants to more effectively adopt cloud-computing services.
RECOMMENDATION Require that NASA organizations use the WestPrime contract or a contract that helps ensure risks are mitigated and FedRAMP requirements are met when acquiring cloud-computing services.
The adoption of public cloud computing services entails a paradigm shift from a traditional, technically managed approach in which an organization builds and maintains technology solutions in-house, to a contractually managed approach where an organization pays someone else to do all that off-site. As a result, NASA OIG accurately recognizes that effective risk mitigation requires developing contracts that address the specific risks of cloud computing, including but not limited to those related to infrastructure/security, service-level agreements, data protection, access and location, and vendor relationship.
The OIG evaluated existing public cloud-computing contracts at NASA in comparison with best-practice risk-mitigation measures, particularly as recommended by the Federal CIO and Chief Acquisition Officer Councils. The OIG identified one existing contract (WestPrime) that effectively accomplished these goals, four contracts where NASA agreed to the cloud vendor's standard contract terms and conditions without negotiating any revisions, and a fifth where NASA negotiated the terms of the contract with the cloud service vendor, but with limited success.
Except for the WestPrime contract, the OIG found that:
* None of the contracts reviewed included language to effectively address the roles and responsibilities of the vendor and customer, reporting of service level metrics, e-discovery mechanisms, data retention and destruction policies, or data privacy requirements.
* Only one of the contracts included penalties for not meeting service levels.
* And only two of the contracts included a guaranteed level of service availability, defined security incident detection and handling practices, or required third-party evaluation/certification of the cloud vendor's IT infrastructure and security.
It should come as no surprise that the standard vendor contracts did not come close to best practices for meeting customer data security needs. When placing sensitive data or business-critical functions in the cloud, it is essential for customers to negotiate contract terms and conditions that effectively address their needs. Otherwise, the customer's data and access to the service could be inappropriately put at risk. To effectively do this typically requires having appropriate processes in place for a customer to understand its needs and manage these processes.
Other columns by Thomas Trappler
- NASA's cloud audit holds value for all
- Who can pry into your cloud-based data?
- Does your cloud vendor protect your rights?
- Software licensing in the cloud
- For credit card handlers, cloud computing guidelines just got clearer
- Regulations and the cloud: HIPAA modification provides clarity
- Certification programs are making it easier to know all about a cloud vendor
- The do's and don'ts of safeguarding cloud-based data with encryption
- For a good cloud contract, start with an RFP
- It takes a team to create a good cloud contract
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- ESG: The IBM FlashSystem 840: Technical Evolution to Deliver Business Value In this whitepaper, you will learn how this high-speed storage technology has tremendous potential to support I/O-intensive and/or latency-sensitive applications.
- Choosing an MDM Platform: Where to Start the Conversation If you're in the early stages of choosing an MDM solution, or you're considering switching vendors, here are seven critical questions to ask...
- Axeda Platform Technical Overview This paper summarizes the major features of an IoT platform and explains how they simplify and speed the process of developing and deploying...
- Stock Shock: The effect of project and portfolio management on share price In this independent report, you'll see the intrinsic connection between long-term capital investment and short term market performance -- and how this can...
- Live Webcast Best Practices for the Hyperconverged Enterprise Network To the Age of Constant Connectivity and Information overload
- Live Webcast Unmasking the Differences between Consumer and Enterprise File Sync & Share The consumerization of IT combined with the rapid pace of the modern mobile workplace is forcing enterprise IT teams to evaluate file sync...
- Live Webcast Government Agency Webifies Outdated COBOL Applications Let this CTO tell you how his agency converted 1980s-era green screens into an e-filing portal for the 100,000 cases handled each year...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- Cloud Knowledge Vault Learn how your organization can benefit from the scalability, flexibility, and performance that the cloud offers through the short videos and other resources... All Cloud Computing White Papers | Webcasts