c9daa7e8_s_in_Cloud_Computing_Contracts__Comments
[Issue] Data security [Comments] 
If they address the issue at all, vendor form contracts are likely to promise to provide only "reasonable" security for your data, or perhaps to adhere to “industry standard” security practices. While such promises sound good in the abstract, they are open to considerable interpretation and argument. It is preferable to specify an actual, specific, independent security standard and require that it be updated, and perhaps audited, regularly. In addition, for certain kinds of data (e.g., data subject to HIPAA, Gramm-Leach-Bliley, PCI-DSS, or the Massachusetts Standards for the Protection of Personal Information of Residents of the Commonwealth), there may be specific security requirements that must be included in any vendor contracts. Ideally, the contract should also provide for regular SAS 70, Type II audits, with customer access to the results. Finally, the contract should require the vendor to give us notice of any security/data breaches, and, to the extent that user notification is legally required, such notice should preferably be in advance of user notification (which should be the vendor's responsibility).
IT: Legal and Quasi-Legal Issues in Cloud Computing Contracts
Comments