Got Compliance Anxiety? Don't Just Say "No" To The Public Cloud

_Lilac Schoenbeck
_

Daniel Trevino

Cloud computing gives you the freedom to choose the right mix of internally and externally provided services that best meet your business requirements. In determining whether to send a service to a public cloud, a major factor is whether the service must maintain regulatory compliance. At first glance, it may appear that you should “just say no” to outsourcing any service that is under regulatory compliance. However, this approach limits your flexibility in creating the optimum combination of internal and external services. Keep in mind that public cloud providers are continually improving their security and compliance capabilities, making it feasible to offload more services to the public cloud. If you keep your options open, you will be able to take advantage of additional opportunities in the public cloud as they emerge.

So how do you send services to the cloud while ensuring that these services remain compliant with regulations? The answer is to use a strategy based on Business Service Management (BSM), a comprehensive approach and unified platform for running IT. You can leverage the BSM processes and solutions that you use to manage your internal infrastructure by extending them to the public cloud environment. The following tips will tell you how.

TIP 1: Categorise Services

You can choose from a variety of public cloud services. These include Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS). They also include individual business services that you can integrate with your in-house systems to support compound business processes. For example, you could integrate an external credit card processing service with your internal order-entry system or integrate an external search engine with your internally managed Web site.

Start by dividing the services you have selected for public cloud sourcing into three major categories, according to their monitoring and management requirements. The first category includes those services that do not have service quality or regulatory compliance commitments. You can offload these services to the public cloud with little or no risk to the organisation. For example, you can take advantage of PaaS offerings to obtain computing platforms for your application developers. You can consume these services quickly and on a pay-as-you-go basis, avoiding capital expenditures.

The second category includes services that have service quality commitments specified in service level agreements (SLAs). These services require monitoring and management to ensure that they meet commitments. For example, if you offload your service desk processes, you still have to ensure that they meet the availability and performance requirements specified by SLAs.

You cannot typically monitor and manage public cloud resources to the same degree as private cloud resources. Scaling up or down is typically the responsibility of the service provider, not the consumer of the service. However, you can use BSM solutions to proactively monitor and manage the availability and performance of public cloud services. And you can do so in a unified way, with the same tools you use to manage your internally provided services.

The third category consists of services that require regulatory compliance. Your first thought may be to say “no” to outsourcing any services that are under regulatory compliance for fear of introducing the risk of noncompliance. However, as mentioned, this approach limits your flexibility in creating the optimum combination of internal and external services. To offload compliance-mandated services to public cloud providers, while also minimising the risk of noncompliance, follow the rest of the tips outlined in this article.

Even if you choose to keep compliance-mandated services in house for now, keep in mind that cloud computing is evolving, and service providers are continually improving their ability to ensure and attest to regulatory compliance. So keep your options open for switching to external providers for these services in the future.

TIP 2: Develop, Document, and Enforce Internal Compliance Policies

Take a look at all of the regulations that affect IT services in your industry, and then develop and document compliance policies for managing all internally generated services, both cloud and non-cloud. Some of these are government regulations, such as the Health Insurance Portability and Accountability Act (HIPAA), the Sarbanes-Oxley Act of 2002, and the Basel Accords. Others are industry standards, such as the Payment Card Industry Data Security Standard (PCI DSS).

These regulations specify various criteria with which IT organisations must comply. They also include safeguards. HIPAA, for example, covers three types of safeguards: administrative, physical, and technical.

• Administrative safeguards deal with such areas as assigned security responsibility, information access management, and security incident procedures.

• Physical safeguards include facility access controls and workstation security.

• Technical safeguards include audit controls and person or entity authentication.

The regulation may also include implementation specifications. A HIPAA security rule, for example, outlines 18 standards for administrative, physical, and technical safeguards, plus 36 implementation specifications to protect the confidentiality, integrity, and availability of protected health information.
Establish policies that translate the relevant regulations and standards into processes and procedures to which your IT organisation must adhere, and then publicise these policies and procedures to the internal IT organisation. Here, an IT controls management solution can help you author, publish, manage, and enforce the policies.

If your IT organisation is like most, your internal IT infrastructure will be heterogeneous as you move incrementally from your current environment to the cloud environment. It might include dedicated physical systems, virtualised systems, and private cloud systems. The technology you deploy should enable you to manage the entire infrastructure in a unified manner with respect to compliance.

Here again, BSM can help. For example, data access solutions help you manage the identity and authorisation of entities or people that access data that come under the purview of the policies. As another example, change management solutions ensure that all changes made to the IT infrastructure are made in compliance with the policies.

TIP 3: Extend Internal Compliance Policies to Public Cloud Providers

Most public cloud service providers publish their compliance capabilities so customers can review them. For example, some cloud providers publish compliance with the Statement on Auditing Standards No. 70 (SAS 70), which defines the standards an auditor must employ to assess the internal controls of an outsource service provider, such as a hosted data center, insurance claim processor, or credit processing company. Outsourced providers of credit card services usually publish compliance with PCI DSS.

However, it’s up to you, the customer, to reconcile the cloud provider’s offerings with your own policies. While you can’t directly monitor, manage, and control all the aspects of the supplier’s administrative, physical, and technical safeguards, you can translate your internal compliance policies into a form that is appropriate for the external providers, and then publish these transformed policies. You can leverage the same BSM solutions that you used to create and manage your internal policies to transform, publish, and manage the supplier policies.

This transformation can be a major effort and may involve manual processes. Some enterprises have pursued a path of partnering with their service provider, encouraging them to help complete a compliance checklist. While that effort isn’t trivial, some service providers, eager to support a compliance-focused market, work collaboratively with customers.

In addition, you can request that external providers attest to their compliance with your published policies. This approach enables you to extend the rigor of your internal compliance and attestation processes to external service providers.

TIP 4: Provide Effective Supplier Management

In addition to monitoring and managing the services you send to the public cloud, be sure to monitor and manage your public cloud service providers with the same rigor that you apply to other vendors.
First, evaluate and select the highest-value vendors by enforcing best-practice vendor review and approval processes. After you select the vendors, track their performance against their commitments. For example, you can create a risk scorecard for each vendor that tracks its performance in meeting your compliance policies. Finally, you need to continually optimise and consolidate your vendor portfolio by using a fact-based, systematic program for strategic vendor management based on portfolio-level analysis and reporting.

Supplier management solutions enable you to manage the entire supplier lifecycle — from evaluation through termination. These solutions centralise vendor information and help you enforce critical processes, track financials, and track and measure performance against commitments.

Don’t Say “No” to the Public Cloud

The public cloud offers a wide variety of services that you can combine with internally provided services to meet the demands of your business. Instead of just saying “no” to public cloud services that come under regulatory control, follow the tips outlined here. You will have increased flexibility to create the best mix of internally and externally provided services to deliver maximum business value to your organisation.
_
Lilac Schoenbeck is Senior Manager, Cloud Computing Marketing, BMC Software and
Daniel Trevino is Senior Product Marketing Manager, IT Business Management, BMC Software._