Within the last year we have seen a rush of companies moving to store their corporate data in the cloud. While cloud computing promises easier data management, scalability and the potential for lower costs, organizations need to ensure that the cloud technology solution they select can also meet their information governance requirements. Here are some areas to consider:
1. Data Security: Companies should ask how data security and encryption are handled. There are specific compliance requirements governing the secure storage of sensitive information, including PII, PHI, PCI. While security is often the top concern for clouds, I believe that most major providers offer data security as good or better than that provided within most corporations’ internal systems. Still, make sure you review the cloud service provider’s security program. Also look at the level of access control—who can see whose data?
2. European Data Privacy: European Union privacy laws (especially in Germany) make it a risk to store data about its citizens outside of their geographic borders. (By the way, this is really a jobs protection issue.) You may have a requirement to segregate and store EU data in-country in clouds based within those countries.
3. Retention Periods: Does your cloud service provider allow data to be separated in to different buckets? Can an organization define its own retention periods for these buckets? Some cloud providers allow only a single retention period for all data, forcing companies to set high-water-mark retention periods saving most of the data much, much longer than needed. Can your organization live with a monolithic retention period? How much data will this force you to save? Or does your company really need variable retention buckets?
4. e-Discovery: Can legal holds be implemented within the cloud, and protect against charges of spoliation? Can the legal hold be applied narrowly to a subset of the data? Does the cloud service provider enable easy eDiscovery against the data in the cloud? Can metadata be preserved? Can data be identified and reviewed within the cloud? Can held data be easily extracted from the cloud?
5. Deprovisioning and Expiration: How is user access and deprovisioning implemented when employees are terminated? What reporting mechanisms are in place for monitoring active and inactive data usage in the cloud? Can older, unneeded data be easily deleted? If you release a legal hold, does the older, released data get expired per the policy?
6. Application Access: Will you be forced to access your data in the cloud through your service provider’s applications exclusively, or does the provider allow other applications to access through open, published interfaces (called APIs)? Will these APIs support use of your preferred e-discovery tools?
7. Data Comingling: Most cloud services achieve economy of scale by storing and com-mingling many companies’ data on the same systems, while making it look to each company like its data is on its own system. Furthermore, as this co-mingled data is backed up on the same backup tapes, some companies fear that one company’s discovery could expose another company’s data. It is not clear how much of a real risk this represents; nevertheless some companies may want to insist on complete data segregation within the cloud, including backup systems.
8. Performance: Is there acceptable, minimum network bandwidth to access the cloud? Particularly important for companies with locations in many countries, is this minimum bandwidth available for all sites. Has this bandwidth been tested? Visualize your cloud computing environment four years from now. Imagine you have two terabytes of data in the cloud and receive a discovery request. Can you get your data back quickly? How quickly? Will you be in trouble?
9. Data Classification: Most companies decide to put some, but not all of their data in the cloud. They need to implement a data classification process separating the more sensitive from less sensitive data. (Increasingly, companies are making this classification part of their record retention policy.) Have you considered how you are going to create these internal processes? Will your cloud vendor’s solution be compatible with them?
Cloud computing does offer some real advantages. Yet above the technology considerations, cloud computing has some significant information governance ramifications organizations would be well advised to consider before moving to the cloud.