Here is How to Use of Your Contracts for Regulatory Compliance Purposes for Cloud Services

Once you have qualified your cloud vendors, next you have to maintain compliance to document your particular regulatory needs in a contract with the vendor in the form of SLAs or service level agreements. In many subjects, you will want to document the SLAs in the following areas, entailing what the vendor is committed to, and what happens if he fails to keep it, and who is responsible for what. Here is how to use contracts for regulatory compliance purposes.

Uptime or downtime

1. What is the minimum percentage of uptime you are expecting?
2. Are there specific times when downtime should be expected? If so, how often?
3. If the downtime goes beyond what is agreed upon, will you be compensated in some way?
4. If the system fails, how quickly will the system be back online?

Backup and recovery

1. How frequently does the vendor take backups?
2. Is it real-time mirroring or periodic snapshots?
3. How quickly can lost data be restored?
4. If any of your data is lost, will you be compensated in any way?

Security

1. What will the vendor do to proactively protect security?
2. What will it do if security is breached in any way? This entails physical security, cyber security, employee sabotage, fraud, theft of data, etc.

Data storage, location, and ownership

1. How long will your data be stored, and does that comply with the governing regulations?
2. What exactly will the storage cost?
3. Exactly where will the data be stored?
4. Will your data be separated from or mixed with other companies’ data?
5. Who owns the data (this needs to be you, in order to be regulatory compliant)?
6. Do they have the right to keep a copy of your data?

Performance monitoring

1. What performance thresholds does the vendor use?
2. What is the response time when a threshold is breached?
3. At what point capacity is added?
4. Are you receiving any kind of performance related reports?

Service termination

1. If you terminate the cloud services, are you able to do it with no penalty?
2. How will you be able to extract your data in a regulatory manner and format?

Defect management

1. What is the vendor’s escalation process for defects?
2. How quickly will the issue be resolved?
3. If another company reports a defect, will you be notified?