After reading ?Who’s afraid of the big, bad cloud?? (http://blogs.techrepublic.com.com/tech-manager/?p=3548&tag=content;leftCol) I saw that there were many concerns with Cloud Computing. This made me think that I need to make a checklist of questions I need to ask the vendors when and if we decide to go to cloud computing. Not only do I need a list of questions, but I need some sort of benchmark and scoring for these questions. Does anyone have some thoughts on the issue?
A few questions I have came up with so far are;
Where is the data being stored? Country/state
What privacy rights do I have with my data based on where it is being stored?
What type of separation will my data have from other?s data (physical/virtual)?
What type of notification do I get when security is breached? My data, the service?s locations, ???
What type of redundancy is there in place for access to the service/data?
What type of regulatory compliance is in place?
Who is responsible for problems/data loss/breach? If the service, how are they responsible??? Can I sue them??? If no money loss or jail time top them, then what is their motivation to ensure I am ?safe????
What is their hiring process? Background checks? Initial and periodic. You may be good when hired, but later you become a risk.
What type of security measures/reporting do they do to monitor their employees and my data?
What type of security measures are in place (encryption, others)?
What third parties am I dealing with?