Cloud computing differs from traditional outsourcing in that the latter model is still very much about standalone computing — either you take your server and put it in someone else's data center or you have a service provider managing your devices. You know exactly where your data/host is and what resources, if any, you share with others. Cloud computing decouples data from infrastructure and obscures low-level operational details, such as where your data is and how it's replicated. While rarely used in traditional IT outsourcing, multitenancy is almost a given in cloud computing services. These differences give rise to a unique set of security and privacy issues that not only impact your risk management practices but have also stimulated a fresh evaluation of legal issues in areas such as compliance, auditing, and eDiscovery.
If your organization is interested in cloud computing, these are the kinds of issues you need to broach with the service provider. To help with this process, we have put together a checklist of key issues and concerns. When evaluating the different services available, be sure the ask the following questions.