Originally published on CyberInquirer.
Cloud computing is the storage of data on remote computer servers and the sharing and transmittal of such information by way of the internet. Use of the cloud enables both businesses and casual users to maintain as much or as little electronic data as they wish on a third party's mainframes without the need for or the expense of having to buy and maintain their own hardware systems.
The cloud's economic benefits are clear. Still, clouds can be a legal minefield for companies and their counsel. Data breaches, hosting of illegal content and inaccessibility of critical business information are just a few examples of turbulent situations cloud users can face.
Given the risks and potential rewards of the cloud, consider the following guide before entering into a cloud provider contract:
Evaluate Your Business Needs Before Negotiating A Cloud Contract
It is critical to identify your business needs to successfully negotiate an appropriate cloud computing contract. First, consider whether the contract should be tailored, as opposed to being a standard boilerplate form. If you want to have routine, non-sensitive data serviced, it often makes sense to accept a standard, less onerous form of agreement, provided the indemnities and protections are appropriate.
Alternatively, if your business involves proprietary, confidential or regulated information or data of any sort, you must consider the potential serious legal implications of using cloud storage. You also will need to ensure that the necessary protections exist before signing on the dotted line.
As a preliminary note, negotiations may be difficult if the bargaining power skews in favor of a cloud service provider. But in most cases, it does not. Indeed, there are a myriad of cloud service providers available, affording the potential client greater leverage and bargaining power than the service provider. This advantage should not be ignored. As such, be steadfast in negotiations with respect to the storage and protection of your own (or your clients') business data and personally identifiable information.
Include Key Provisions In Your Contract To Protect Against Future Risk
Insist on a number of key contract provisions to manage the everyday risks associated with entering confidential business and personal data into the cloud.
As a threshold, you should require the service provider to maintain the utmost confidentiality of your information and be transparent with respect to its security policies and procedures in order to ensure data integrity, availability and confidentiality. In this regard, insist on the same from the service provider's subcontractors and others with access to the cloud so that you are notified if and when third parties are afforded access to your business and personal data. In addition, a provision should be included confirming that you are the sole owner of the stored data and identifying the limitations on the scope of the services to be provided under the cloud vendor agreement.
Other key terms to be considered are ones which:
(1) establish protocols dictating how and when the service provider must respond to a security breach incident, including one or more provisions requiring the service provider to immediately inform you of a breach, assist you with the investigation, containment and mitigation of the breach, and allow you to conduct your own investigation;
(2) set forth how and when the service provider must respond to legal process such as complaints, subpoenas or other requests for your clients' data, including requiring that the service provider notify the affected client(s), preferably within hours, of such developments;
(3) afford full transparency with respect to the service provider's data retention and destruction policies, coupled with a mandate enabling you to create your own data retention and preservation programs (for both data and meta-data);
(4) provide you with an efficient means of authenticating data to ensure that no information has been modified, changed or corrupted; and
(5) require limitations on the service provider's right to move data within the cloud from one jurisdiction to another to avoid application of multi-jurisdictional rules and regulations.
Finally, and perhaps just as important as the provisions governing the confidentiality and security of your data, a cloud contract should include an indemnification agreement protecting and holding you harmless if the confidentiality, security or other key provisions are breached by the service provider, its subcontractors or others. Such an indemnity agreement ensures that you are defended and compensated for any claims resulting from the provider's or its agents' acts, errors or omissions, including with respect to confidential data, intellectual property and otherwise.
For example, in the city of Los Angeles's service contract with Google, Los Angeles is entitled to a minimum of $10,000 if its data is compromised. The city also has the power to seek unlimited damages if it determines that the breach was egregious. Such monetary damages will help remediate any loss or penalties incurred by the city as a result of the breach.
Ensure Your Provider is Diligent
Identifying the threats facing cloud service providers will not only help you more successfully negotiate the contractual provisions noted above, but also enable you to make an informed decision when selecting a service provider.
Make sure that your provider has strong security procedures and controls in place to thwart daily (and oftentimes real) threats of accidental and malicious attempts to breach weak or insecure interfaces. Specifically, a cloud's registration process can allow anyone with a credit card (or technical savvy) to instantly gain cloud entry and corrupt it with viruses, Trojan horses and the like. Confirm that the cloud service provider continually enhances and upgrades its initial registration procedures system and proactively monitors the cloud to detect unauthorized and oftentimes dangerous activity.
The provider also should set-up a firewall at each network location and between each security zone within the cloud. Firewall configuration should deny access to non-trustworthy sources, avoid vendor supplied defaults for passwords, restrict access from systems that have direct external connections and those which contain confidential data, and so on. Among other tools, data protection can be provided through the use of encryption keys.
In short, a cloud computing contract must contain well-tailored provisions to protect your business, reputation and assets at all turns. Armed with an appropriately structured contract and a vigilant provider, you, as an actual or prospective cloud user, will be able to effectively benefit from the cloud's infrastructure and maximize its unrivaled and cost-effective level of efficiency.
www.cozen.comThe content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
