Managing Cloud Service Provider Risk
Assessing the risk cloud third parties bring
Contracting a cloud service provider means depending on the security of a third party over which the organization has limited control, and managing that risk requires assessing it as rigorously as any other critical vendor, reviewing its security certifications, its incident history, its service level agreements for breach notification, and the contractual terms on data ownership and portability. This assessment should be repeated periodically and not limited to the initial contracting, because a provider's security posture can change, as can the scope of the services the organization uses from it over time. This matters because a breach at the provider can expose the organization's data without any direct failure in its own controls. A relevant example is contractually requiring the provider to report any security incident within a specific time frame, avoiding learning from the press about a breach that affects your own data.