| | October 20149CIOReviewdatabase? If so, then it must be CJIS compliant. Is it an educational institution handling student records? If yes, the Family Education Rights and Privacy Act (FERPA) will apply. Working with the legal team to understand these broad regulatory requirements will go a long way in helping to effectively deploy and leverage the power and flexibility of cloud services.All Clouds Aren't Created Equally EitherHow a cloud vendor approaches regulatory issues is also important. Does a vendor offer a Business Associate Agreement for HIPAA? Does your vendor offer EU Model Clauses? If so, have European Data Protection Authorities reviewed and approved of the contractual commitments? If CJIS is a concern, check to ensure the provider has implemented CJIS compliance by design in its processes and procedures (for example, employee background checks), or are they taking a different approach? Most importantly, a vendor should have a track record of working with customers to address specific regulatory concerns. Equally important is that a cloud service provider be on top of internationally recognized standards, they hold key certifications and attestations, and have a history of working with regulatory bodies not only to meet these today and anticipate future regulations-- which is less a question of "if" than "when."Evaluating how a vendor addresses regulatory changes and engages with regulators is a crucial step that will minimize the risk of eventual vendor replacement because one vendor's regulatory compliance approach isn't evolving as is needed.Size Doesn't MatterOne of the most common misperceptions among organizations is that regulations are only for big customers or vendors. Nothing could be further from the truth, as the investigation by the U.S. Department of Health and Human Services (HHS) of Phoenix Cardiac Surgery, P.C. proved. While there are not a lot of cloud specific regulations yet, existing regulations are being enforced and should be taken seriously. In the Phoenix Cardiac Surgery case, a small professional corporation was fined $100,000 for failing to adequately meet HIPAA regulations relating to their use of a public cloud calendaring system. ConclusionRegulators are taking a cautious approach to Cloud Computing, as are many organizations in highly regulated industries. However, some cloud providers have a long track record of working with customers to provide traditional on-premises solutions for healthcare, financial services, education and other industries where regulatory compliance is tantamount. This foundation will help ensure a stronger cloud offering. Many times, regulators are simply transferring existing regulations applicable to outsourcing to the cloud, some of which are not applicable in the context of a broad public cloud solution. At Microsoft, we have seen this most frequently with Financial Services Industry (FSI) regulators.Over the last two years we have worked with customers around the world to address this particular issue, and to help customers successfully move to the cloud. Most regulators want assurance that a customer has been thoughtful about the need for strong contractual mechanisms to better ensure security of systems and data privacy in the cloud. They also want to see that the vendor is open to engagement and evolution as regulators evolve their approach. Being open to their concerns and transparent about our approach to these issues has led to many successful engagements getting our FSI customers into the cloud.By talking a thoughtful approach and working with a vendor that understands its responsibility to help customers meet their regulatory obligations, regulated industries can better maximize their ability to move to the cloud. Working with the legal team to understand broad regulatory requirements will go a long way in helping to effectively deploy and leverage the power and flexibility of cloud services
< Page 8 | Page 10 >