Cloud computing is exploding worldwide. Consider the following facts:
- The world’s biggest data centers occupy more than 1 million square feet, enough to house 17 football fields.
- 5.75 million new servers are installed annually just for online services.
- 36 percent of all data centers use cloud computing.
- Cloud users report saving 21percent on applications moved to the cloud.
The primary impediments to the adoption of cloud computing, in order of importance to consumers of cloud services, are: security, interoperability, vendor lock-in, regulatory compliance, reliability, complexity, privacy and pricing. These concerns raise contract drafting issues for cloud computing contracts. Part 1 will cover security, interoperability and vendor lock-in. Part 2 will address the remaining issues.
Service level agreements (SLAs) should contain provisions describing the infrastructure and security for the cloud service. The customer should define the security parameters and security monitoring promised by the service provider in the SLA in specific and measurable ways. Without these specifics, it will be hard to evaluate security and to know whether the service provider is delivering the security promised. For example, provisions commonly describe what intrusion monitoring and incident reporting the vendor will provide. The SLA may also provide the customer with the ability to periodically audit the security of the provider. The SLA may contain provisions defining load testing parameters and data portability testing.
Surveys have shown that many consumers of cloud services do not monitor security aspects of their cloud services on a continuous basis, in spite of security being a top concern for respondents. For example, availability is frequently addressed in the SLA and monitored by the customer. Other security parameters are often not well-covered in the SLA or, if covered, are not monitored sufficiently. For example, if the SLA provides for penetration tests, failover or backup testing, the customer should implement a program to make sure the testing is actually performed and the results are reported. The program should be covered in the SLA. Another issue is that data portability testing is often overlooked and not tested. In all cases, security and testing reports should be reviewed and retained in case a problem develops.
Also consider whether there should be penalties for noncompliance. Many SLAs contain detailed security definitions and monitoring, but no specific provisions addressing the consequences for failing to comply. Boilerplate provisions addressing breaches of the contract are often too general to provide meaningful remedies for breaches of the SLA. Compliance and penalty provisions should be crafted to incentivize the vendor to provide the required service levels.
Read more...Inside Counsel