While cloud-based services can provide flexible, cost-effective technology solutions that can be quickly and easily implemented, moving into the cloud comes with significant risks, including the loss of control over sensitive data and critical information systems. Before jumping into the cloud, it is important to understand some of the most significant risks, along with ways companies can mitigate and manage them.
Why move to the cloud?
While the term "cloud computing" broadly encompasses the provision of software, storage, data access and other computational services on demand over any computer network, it is most commonly used to refer to a public cloud in which a customer has the ability to access online resources on demand, from a third-party provider over the Internet.
Because the cloud is actually a hybrid technology solution combining software, hardware and services, the terms and conditions governing the customer-provider relationship are a mixture of legal and commercial terms and conditions from license agreements and technology services agreements. These complex agreements must be crafted carefully in order to avoid or mitigate the risks inherent therein.
Data privacy and security risks and regulations
Using cloud services often requires a company to disclose sensitive information, such as the personal information of its customers or personnel, to the cloud provider for storage or processing. The unauthorized disclosure, loss or destruction of sensitive data can have particularly severe consequences, including the significant costs of recovering that data and notifying affected individuals of the breach.
In fact, a recent SEC Division of Corporate Finance Disclosure Guidance (Oct. 23, 2011) describes one SEC division's views on the adverse consequences and related disclosure obligations relating to cybersecurity risks and incidents. Before providing any information to a cloud provider, in-house counsel should conduct due diligence to ensure that the provider is capable of safeguarding the information and put the related contractual provisions in place.
Contractual mechanisms for managing risk
There are a variety of contractual protections that in-house counsel can use to manage data privacy and security risks, and to stipulate the responses required if a breach occurs. These measures are important not only as a good business practice, but also to comply with an ever-growing body of federal and state laws regulating the privacy and security of certain types of information.
A contract that involves the transfer of sensitive data to a cloud provider should require the provider to comply not only with all applicable laws, but also with any industry and/or state law standards for data security. Contracts also should stipulate that the provider maintain appropriate protections against the loss or destruction of data and identify the party who will bear the costs of remedying a data breach. Unless these issues are addressed clearly in the contract, it may be difficult to be made whole in the event of a breach.
Counsel also should consider contractually requiring cloud providers to supply an annual Type II audit report under the new Statement on Standards for Attestation Engagements No. 16. These audit standards address the adequacy of a service provider's internal controls, including whether the controls are suitably designed to protect an organization and its data.
Availability and performance
In moving to a cloud solution, a company may virtually hand over control of its critical IT functions to the provider. As a result, the provider is responsible for keeping the cloud solution up and running, and the availability of the solution is largely outside of the customer’s control. Except in unusual circumstances, agreements should include an availability commitment by the provider describing when the cloud service will be available for use.
Termination and suspension rights
In the event of a dispute between the company and the provider, the company's most valuable asset, its data, is at the mercy of the provider. If the provider pulls the plug on the services or refuses to allow access to data, a company may not be able to run its business. Some important protections to incorporate into a cloud agreement include:
- Rights to terminate for cause and convenience
- Cure periods to allow breaches to be cured before services may be terminated
- Rights to access and retrieve data at any time during and after the agreement
The bottom line is that a company should be able to continue to run its business while a dispute is being resolved, and obtain the assistance it needs to move to another provider if necessary.
Using insurance to manage risk
Insurance, including cyber-liability coverage, presents yet another opportunity for companies to manage privacy and data security risks. A company and its cloud providers should maintain appropriate insurance to cover:
- Losses from a data security breach
- Costs to change account numbers
- Lost business income
- Data restoration expenses
- Payments to third parties that are required as a result of a breach
Such insurance should also address potential costs and liabilities related to lawsuits from customers, employees, banks, retail stores and other third parties, or expenses related to investigations brought by regulatory agencies.
Looking before leaping
Moving to the cloud may raise new issues for companies accustomed to traditional software licensing. It pays to give careful consideration to all the issues before moving into the cloud. By understanding of the nature of cloud solutions, the risks they pose and the ways to mitigate these risks, in-house counsel can help their companies sensibly take advantage of all that the cloud has to offer.
