Buyers of commercial cloud services, especially software as a service (SaaS), are finding security provisions inadequate. Gartner, Inc. said SaaS contracts often have ambiguous terms regarding the maintenance of data confidentiality, data integrity and recovery after a data loss incident. This leads to dissatisfaction among cloud services users. It also makes it harder for service providers to manage risk and defend their risk position to auditors and regulators.
Gartner said that, through 2015, 80 per cent of IT procurement professionals will remain dissatisfied with SaaS contract language and protections that relate to security. "We continue to see frustration among cloud services users over the form and degree of transparency they are able to obtain from prospective and current service providers," said Alexa Bona, vice president and distinguished analyst at Gartner.
At a minimum, cloud services users need to ensure that SaaS contracts allow for an annual security audit and certification by a third party, with an option to terminate the agreement in the event of a security breach if the provider fails on any material measure. In addition, it is reasonable for cloud service buyers to ask a provider to respond to the findings of assessment tools. The Cloud Security Alliance (CSA), for example, has a Cloud Controls Matrix in the form of a spreadsheet containing control objectives deemed by participants in the CSA to be important for cloud computing. "As more buyers demand it, and as the standards mature, it will become increasingly common practice to perform assessments in a variety of ways, including reviewing responses to a questionnaire, reviewing third-party audit statements, conducting an on-site audits and/or monitoring the cloud services provider," said Ms Bona.
Furthermore, cloud users should not assume that SaaS contracts include adequate service levels for security and recovery. "Whatever term is used to describe the specifics of the service-level agreement (SLA), IT procurement professionals expecting their data to be protected from attack, or to be restorable in case of an incident, must ensure their providers are contractually obligated to meet those expectations," said Ms Bona. "We recommend they also include recovery time and recovery point objectives and data integrity measures in the SLAs, with meaningful penalties if these are missed."
As no consensus exists about how commitments to security services should be described contractually, most SaaS vendors choose to commit to as little as possible. It is crucial that some form of service, such as protection from unauthorised access by third parties, annual certification to a security standard, and regular vulnerability testing, is committed to in writing.
The lack of meaningful financial compensation for losses of security, service or data also represents an undesirable form of risk exposure in SaaS contracts. "SaaS is a one-to-many situation in which a single service provider failure could impact thousands of customers simultaneously, so it represents a significant form of portfolio risk for the provider," said Ms Bona. Therefore, the majority of cloud providers avoid contractual obligation for any form of compensation, other than providing service in kind or penalties in the event that they miss a service level in the contract. SaaS users should negotiate for 24 to 36 months of fee liability limits, rather than 12 months, and additional liability insurances, where possible.
"Concerns about the risk ramifications of cloud computing are increasingly motivating security, continuity, recovery, privacy and compliance managers to participate in the buying process led by IT procurement professionals. They should continue regularly to review their cloud contract protection to ensure that IT procurement professionals make sustainable deals that contain sufficient risk mitigation," said Ms Bona.
More detailed analysis is available in "Cloud Contracts Need Security Service Levels to Better Manage Risk", a report available on Gartner's web site at http://www.gartner.com/document/2372720?ref=QuickSearch&sthkw=g00247574.
Gartner analysts will discuss cloud pricing models and contracting in more detail at the Gartner IT Financial, Procurement & Asset Management Summit 2013 in London on 11-12 September, and at the Gartner IT Financial, Procurement & Asset Management Summit 2013 in Orlando, Florida on 25-27 September. To register for the Summit in London, please contact laurence.goasduff@gartner.com. For the US Summit, please contact janessa.rivera@gartner.com.
You can also follow the event on Twitter at http://twitter.com/Gartner_inc using #GartnerITAM.
About Gartner IT Financial, Procurement & Asset Management Summit 2013
The Nexus of Forces - mobile, social, cloud and big data - is rewriting the rules of IT. Major trends such as the transition to the cloud, "bring your own device" and the explosion of "smart" everything cannot be avoided or even slowed down. At the Summit, Gartner analysts will identify how to optimise costs, maximise the value of existing investments, minimise risk and make informed decisions about new purchases.
Gartner said that, through 2015, 80 per cent of IT procurement professionals will remain dissatisfied with SaaS contract language and protections that relate to security. "We continue to see frustration among cloud services users over the form and degree of transparency they are able to obtain from prospective and current service providers," said Alexa Bona, vice president and distinguished analyst at Gartner.
At a minimum, cloud services users need to ensure that SaaS contracts allow for an annual security audit and certification by a third party, with an option to terminate the agreement in the event of a security breach if the provider fails on any material measure. In addition, it is reasonable for cloud service buyers to ask a provider to respond to the findings of assessment tools. The Cloud Security Alliance (CSA), for example, has a Cloud Controls Matrix in the form of a spreadsheet containing control objectives deemed by participants in the CSA to be important for cloud computing. "As more buyers demand it, and as the standards mature, it will become increasingly common practice to perform assessments in a variety of ways, including reviewing responses to a questionnaire, reviewing third-party audit statements, conducting an on-site audits and/or monitoring the cloud services provider," said Ms Bona.
Furthermore, cloud users should not assume that SaaS contracts include adequate service levels for security and recovery. "Whatever term is used to describe the specifics of the service-level agreement (SLA), IT procurement professionals expecting their data to be protected from attack, or to be restorable in case of an incident, must ensure their providers are contractually obligated to meet those expectations," said Ms Bona. "We recommend they also include recovery time and recovery point objectives and data integrity measures in the SLAs, with meaningful penalties if these are missed."
As no consensus exists about how commitments to security services should be described contractually, most SaaS vendors choose to commit to as little as possible. It is crucial that some form of service, such as protection from unauthorised access by third parties, annual certification to a security standard, and regular vulnerability testing, is committed to in writing.
The lack of meaningful financial compensation for losses of security, service or data also represents an undesirable form of risk exposure in SaaS contracts. "SaaS is a one-to-many situation in which a single service provider failure could impact thousands of customers simultaneously, so it represents a significant form of portfolio risk for the provider," said Ms Bona. Therefore, the majority of cloud providers avoid contractual obligation for any form of compensation, other than providing service in kind or penalties in the event that they miss a service level in the contract. SaaS users should negotiate for 24 to 36 months of fee liability limits, rather than 12 months, and additional liability insurances, where possible.
"Concerns about the risk ramifications of cloud computing are increasingly motivating security, continuity, recovery, privacy and compliance managers to participate in the buying process led by IT procurement professionals. They should continue regularly to review their cloud contract protection to ensure that IT procurement professionals make sustainable deals that contain sufficient risk mitigation," said Ms Bona.
More detailed analysis is available in "Cloud Contracts Need Security Service Levels to Better Manage Risk", a report available on Gartner's web site at http://www.gartner.com/document/2372720?ref=QuickSearch&sthkw=g00247574.
Gartner analysts will discuss cloud pricing models and contracting in more detail at the Gartner IT Financial, Procurement & Asset Management Summit 2013 in London on 11-12 September, and at the Gartner IT Financial, Procurement & Asset Management Summit 2013 in Orlando, Florida on 25-27 September. To register for the Summit in London, please contact laurence.goasduff@gartner.com. For the US Summit, please contact janessa.rivera@gartner.com.
You can also follow the event on Twitter at http://twitter.com/Gartner_inc using #GartnerITAM.
About Gartner IT Financial, Procurement & Asset Management Summit 2013
The Nexus of Forces - mobile, social, cloud and big data - is rewriting the rules of IT. Major trends such as the transition to the cloud, "bring your own device" and the explosion of "smart" everything cannot be avoided or even slowed down. At the Summit, Gartner analysts will identify how to optimise costs, maximise the value of existing investments, minimise risk and make informed decisions about new purchases.
