At the end of my Cloud Expo West presentation last week, I was asked, "How can we verify that a cloud provider actually has all of these infrastructure and security mechanisms in place?" It's a great question, one that deserves a fuller answer than I was able to give in the time available. So here's a more detailed version of my response.
The primary options -- certifications and inspections -- could be added as a requirement in your contract with the cloud provider. Currently, there isn't one formal standard for cloud computing certification, but the following are increasingly being used:
FIPS 200/SP 800-53
As a result of the Federal Information Security Management Act (FISMA), the National Institute of Standards and Technology (NIST) developed the Federal Information Processing Standards 200 (FIPS 200), Minimum Security Requirements for Federal Information and Information Systems, and the Special Publication (SP) 800-53, Recommended Security Controls for Federal Information Systems and Organizations. (You can see why the acronyms are preferred.)
To continue reading, [[xref:http://reg.idgenterprise.com/insider.html?url=http://www.computerworld.com/s/article/9222057/Making_sure_your_cloud_provider_can_protect_your_data_as_promised to become an Insider|Insider registration page]]. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more [[xref:http://www.computerworld.com/s/insiders|Insider Index - Computerworld]] or [[xref:http://reg.idgenterprise.com/insider.html?url=http://www.computerworld.com/s/article/9222057/Making_sure_your_cloud_provider_can_protect_your_data_as_promised|Insider registration page]].
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.