External Hosting (Cloud) evaluation checklist - Detailed

1,224
-1

Published on

Published in: Technology, Business
1 Comment
0 Likes
Statistics
Notes
  • Find coupons for your hosting. Get a promo deal before you purchase hosting http://www.scriptcoupons.com/Vps.net/
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • Be the first to like this

No Downloads
Views
Total Views
1,224
On Slideshare
0
From Embeds
0
Number of Embeds
0
Actions
Shares
0
Downloads
51
Comments
1
Likes
0
Embeds 0
No embeds

No notes for slide

External Hosting (Cloud) evaluation checklist - Detailed

  1. 1. INITIAL RISK ANALYSIS – EXTERNAL HOSTING SOLUTIONS OU Name:………………….…………… Date of Review:…………… Compiled by:………………………………. Date:…………… Approved by:……………………………… Date:……………. Note: This is an initial, high level analysis of the potential risks associated with UQ entering into external hosting solutions and is intended as a general guide only. A definitive analysis of the risks associated with a particular proposed external hosting solution should be conducted once the detailed particulars of the particular solution (eg proposed service provider, jurisdiction in which University data will be hosted, technical features of the solution, commercial offering and service provider’s proposed contractual terms) are known. IDENTIFICATION ANALYSIS Ref Brief risk description Details of risk Impact Potential measures (controls) which could minimise risk 1. Business risks 1.1 Downtime Loss of service / access to data. Business Contractual provisions including indemnities, impact will depend on importance of service / robust service level and service credits regime, application / data to the business. specified failover requirements / business continuity See also Legal section of this paper. obligations linked to service credits / most favoured customer clause, if possible Insurance coverage – UQ and/or service provider 1.2 Reliance upon / tie to Less commercial leverage Interoperability due diligence chosen service provider for Contractual provisions around interoperability future services Robust exit provisions and vigilance in ensuring these are used (eg ensure exit plan is prepared and kept up to date as part of contract management) 1.3 Chosen service provider Loss of service; need to bring service in-house Contractual provisions requiring service provider to becomes insolvent or transfer to another service provider notify on insolvency events (see GITC definition of insolvency events), so that UQ has prior notice of potential insolvency and allowing UQ to terminate agreement and/or enliven exit services upon certain insolvency events Also as per Ref 1.2 1.4 Data loss Service Provider loses client data Loss of data. Business impact will depend on Ensure service provider offers backup and importance of data to the business. archiving services See also Legal section of this paper. UQ clients may need to maintain local backup of data 1
  2. 2. INITIAL RISK ANALYSIS – EXTERNAL HOSTING SOLUTIONS OU Name:………………….…………… Date of Review:…………… Compiled by:………………………………. Date:…………… Approved by:……………………………… Date:……………. Note: This is an initial, high level analysis of the potential risks associated with UQ entering into external hosting solutions and is intended as a general guide only. A definitive analysis of the risks associated with a particular proposed external hosting solution should be conducted once the detailed particulars of the particular solution (eg proposed service provider, jurisdiction in which University data will be hosted, technical features of the solution, commercial offering and service provider’s proposed contractual terms) are known. IDENTIFICATION ANALYSIS Ref Brief risk description Details of risk Impact Potential measures (controls) which could minimise risk Insurance coverage – UQ and/or service provider Also as per Ref 1.1 in relation to downtime 2. Technical risks 2.1.1 Interoperability Restrictive client-side OS or browser Not usable by all UQ clients SaaS offerings use browser for client side requirements for Software-as-a-Service Supported browsers must at least include Internet Offerings (SaaS) Explorer, Safari, Firefox 2.1.2 Service provider upgrades software and/or Cost/time impact on UQ users Adequate notification and details of upgrades infrastructure (cover in contract) Data integrity (cover in contract) Service provider must provide migration tools if appropriate to upgrade activity 2.1.3 Lack of confirmed VM image format Cost/time impact on UQ clients UQ clients made aware standardisation complicates migration of VMs between UQ and Service Provider clouds and between Service Provider Clouds 2.1.4 IP address changes of external hosted Service availability Service providers need to provide UQ with IP address, services small range of IP addresses or DNS name 2.2.1 Integration Service can not utilise Identity Provider Security and inconvenience (potentially Service provider demonstrates capability to use external services remember many multiple passwords) Identity Provider services 2.2.2 Lack of standardised Service Provider Lock in to specific Service Provider Encourage service providers to participate in APIs standardisation activities Promote UQ client awareness 2.2.3 Decentralised use of cloud services results Support and maintenance costs associated with Centralised register of hosted services. 2
  3. 3. INITIAL RISK ANALYSIS – EXTERNAL HOSTING SOLUTIONS OU Name:………………….…………… Date of Review:…………… Compiled by:………………………………. Date:…………… Approved by:……………………………… Date:……………. Note: This is an initial, high level analysis of the potential risks associated with UQ entering into external hosting solutions and is intended as a general guide only. A definitive analysis of the risks associated with a particular proposed external hosting solution should be conducted once the detailed particulars of the particular solution (eg proposed service provider, jurisdiction in which University data will be hosted, technical features of the solution, commercial offering and service provider’s proposed contractual terms) are known. IDENTIFICATION ANALYSIS Ref Brief risk description Details of risk Impact Potential measures (controls) which could minimise risk in a multitude of hosted services and each instance of locally developed software Centralised approval mechanism for hosted therefore service providers, some interacting with a hosted service. services. providing the same services, and a Support and maintenance costs for each local Centralised SOA-based solution for corresponding number of UQ-based provisioning and deprovisioning solution to provisioning/deprovisioning processes and software to utilise these utilise a hosted service. Difficulties associated Centralised SOA-based solution for data integration services. with identifying all hosted services in use - with hosted services, where applicable auditability issues 2.3.1 Data Service requires access to non-public Security; Privacy Where possible seeks alternate means of delivering facing UQ services such as databases data to service provider Transfer data using strong encryption 2.3.2 Portability - use of non-standard data Cost/time to UQ clients Promote UQ client awareness interchange formats to allow for ease of migration between service provider and UQ 2.4.1 Heavy reliance on stability UQ Internet link failure or degradation Degradation and/or loss of service Increase UQ Internet link resilience and capacity and speed of network (reduced capacity, reduced performance) connection 2.4.2 Service Provider link failure or Degradation and/or loss of service Contractual service levels / service credits degradation (reduced capacity, reduced performance) 2.4.3 Connectivity failure or degradation Degradation and/or loss of service Contract requiring service provision with multiple (reduced capacity, reduced performance) internet attachment points with diverse connectivity between UQ and service provider 3
  4. 4. INITIAL RISK ANALYSIS – EXTERNAL HOSTING SOLUTIONS OU Name:………………….…………… Date of Review:…………… Compiled by:………………………………. Date:…………… Approved by:……………………………… Date:……………. Note: This is an initial, high level analysis of the potential risks associated with UQ entering into external hosting solutions and is intended as a general guide only. A definitive analysis of the risks associated with a particular proposed external hosting solution should be conducted once the detailed particulars of the particular solution (eg proposed service provider, jurisdiction in which University data will be hosted, technical features of the solution, commercial offering and service provider’s proposed contractual terms) are known. IDENTIFICATION ANALYSIS Ref Brief risk description Details of risk Impact Potential measures (controls) which could minimise risk 3. Legal risks 3.1 UQ non-compliance with Breach of any Information Privacy negative PR associated with UQ breaching UQ to contractually oblige the service provider to obligations under newly- Principles (“IPPs”) under the IP Act, legislation employ security measures against hacking / enacted Information including: fines for offences under the IP Act (eg accidental disclosure of personal information Privacy Act 2009 (Qld) The obligation to ensure reasonable potential $10,000 fine for failure to take encryption, so that an individual’s identity is cannot (“IP Act”). safeguards are in place to prevent loss, reasonable steps to comply with be discerned or is not effectively being disclosed unauthorized access, use disclosure, compliance notice issued by the subject service provider to contractual provisions modification or misuse of personal Information Commissioner following that effectively uphold principles for the fair information held by UQ alleged non-compliance with any handling of personal information that are The obligation to fulfill individuals’ provision of the IP Act or failure to substantially similar to the IPPs (ideally replicate requests to see all records containing produce a document when requested to do IPPs) their personal information and have so by the Information Commissioner conduct due diligence to ensure the personal any inaccuracies in such records information it transfers will not be held, used or corrected on request disclosed by the service provider in a way that is The obligation to only disclose inconsistent with the IPPs. personal information if the individual Make any individuals whose personal information concerned is aware of or has consented may be disclosed as part of external hosting aware to, that disclosure. Depending on the that such information is being so disclosed (see IPP details of the external hosting model 11). the personal information may or may Need to strictly specify reason for disclosure of not be “disclosed” to the service information (ie external hosting only – information provider. not disclosed to the service provider for any other The obligation to seek individuals’ purpose and the service provider may not use the consent to transfer of personal information for any other purpose). information outside Australia OR in Get individuals’ consent to any transfer of 4
  5. 5. INITIAL RISK ANALYSIS – EXTERNAL HOSTING SOLUTIONS OU Name:………………….…………… Date of Review:…………… Compiled by:………………………………. Date:…………… Approved by:……………………………… Date:……………. Note: This is an initial, high level analysis of the potential risks associated with UQ entering into external hosting solutions and is intended as a general guide only. A definitive analysis of the risks associated with a particular proposed external hosting solution should be conducted once the detailed particulars of the particular solution (eg proposed service provider, jurisdiction in which University data will be hosted, technical features of the solution, commercial offering and service provider’s proposed contractual terms) are known. IDENTIFICATION ANALYSIS Ref Brief risk description Details of risk Impact Potential measures (controls) which could minimise risk absence of consent, to carry out due information outside Australia OR ensure: diligence and have appropriate UQ reasonably believes that the recipient of the contractual provisions in place to personal information is subject to a law, binding ensure personal information is scheme or contract which effectively upholds protected in line with the IP Act. principles for fair handling of the information that are substantially similar to the IPPs [this is about Potential future obligation under privacy the contractual provisions per bullet point 3 above]; laws: AND obligation to notify the Privacy UQ has taken reasonable steps to ensure that the Commissioner and affected individuals personal information it transfers will not be held, of a data breach in which their personal used or disclosed by the recipient of the details may have been compromised information in a way that is inconsistent with the IPPs [this is about due diligence by UQ to ensure the service provider’s technology and processes live up to the IPP requirements – UQ should keep a record of such due diligence activity] Contractual obligation on service provider to advise UQ of any security breach so that individuals whose personal information may have been disclosed may be notified. 3.2 Non-compliance with Breach of any NPPs to which UQ is Breach of contract and potential for damages Contractual obligations to ensure UQ is able to National Privacy Principles subject under its agreements which are not claim for losses parties UQ contract with may access information at required and placing (“NPPs”) set out in the already covered by the IPPs in Ref 3.1, suffer as a result of UQ’s breach of NPPs obligations on service provider to keep information Privacy Act 1988 (Cth) or including: up to date (if appropriate in context of service proposed new Uniform Obligation to keep all personal arrangement) 5
  6. 6. INITIAL RISK ANALYSIS – EXTERNAL HOSTING SOLUTIONS OU Name:………………….…………… Date of Review:…………… Compiled by:………………………………. Date:…………… Approved by:……………………………… Date:……………. Note: This is an initial, high level analysis of the potential risks associated with UQ entering into external hosting solutions and is intended as a general guide only. A definitive analysis of the risks associated with a particular proposed external hosting solution should be conducted once the detailed particulars of the particular solution (eg proposed service provider, jurisdiction in which University data will be hosted, technical features of the solution, commercial offering and service provider’s proposed contractual terms) are known. IDENTIFICATION ANALYSIS Ref Brief risk description Details of risk Impact Potential measures (controls) which could minimise risk Privacy Principles set out information held complete and up to Also as per Ref 3.1 in the ALRC report. date The obligation to ensure reasonable While UQ is not required safeguards are in place to prevent loss, to comply with the unauthorized access, use disclosure, National Privacy Principles modification or misuse of personal (“NPPs”) as a matter of information held by UQ law it is required to do so Obligation to fulfill individuals’ under some of its requests to access their personal agreements (eg under a information number of Commonwealth funding agreements). 3.3 Non-compliance with Deletion of records negative PR contractual provisions / indemnity around obligations under the Loss of records s13 of the PR Act makes it an offence to compliance with UQ’s obligations under the PR Public Records Act 2002 Inability to access records dispose of a public record without State Act (Qld) (“PR Act”) Archivist’s approval. Fine - $16,500 PR Act provides that, without limiting the public This could be caused by downtime, data authority’s responsibility for ensuring the safe loss or security breach custody and preservation of records in its possession, an arrangement between a public authority and another person for the person to have custody of a record of the public authority must include arrangements for the safe keeping, proper preservation and return of the record (s8) create back up / contractually oblige service provider to create back up 6
  7. 7. INITIAL RISK ANALYSIS – EXTERNAL HOSTING SOLUTIONS OU Name:………………….…………… Date of Review:…………… Compiled by:………………………………. Date:…………… Approved by:……………………………… Date:……………. Note: This is an initial, high level analysis of the potential risks associated with UQ entering into external hosting solutions and is intended as a general guide only. A definitive analysis of the risks associated with a particular proposed external hosting solution should be conducted once the detailed particulars of the particular solution (eg proposed service provider, jurisdiction in which University data will be hosted, technical features of the solution, commercial offering and service provider’s proposed contractual terms) are known. IDENTIFICATION ANALYSIS Ref Brief risk description Details of risk Impact Potential measures (controls) which could minimise risk 3.4 Non-compliance with UQ is unable to provide information in negative PR contractual provisions around data retention and obligations under the response to a request of a member of fines under the RTI Act. For example, in security and UQ ability to access information on newly enacted Right to the public or the Information addition to the public’s right to access request, within required timeframes / indemnity Information Act 2009 Commissioner in the timeframe documents by request under the RTI Act, (Qld) (“RTI Act”) required under the RTI Act or at all the Information Commissioner may by because it cannot be identified or notice require UQ to produce a particular accessed document. Failure to do so constitutes an UQ is fettered in its ability to use the offence with a fine of $10,000. option to “push” information to the public rather than wait for applications under the RTI Act UQ’s published information on the “push” model is unavailable to the public, making UQ in breach of its published statements on availability of information. This could be caused by downtime, data loss or security breach * The RTI Act was enacted in June 2009 and is expected to commence on 1 July 2009. The RTI Act replaces the Freedom of Information Act 1992 (Qld) but represents an overhaul of FOI legislation. 7
  8. 8. INITIAL RISK ANALYSIS – EXTERNAL HOSTING SOLUTIONS OU Name:………………….…………… Date of Review:…………… Compiled by:………………………………. Date:…………… Approved by:……………………………… Date:……………. Note: This is an initial, high level analysis of the potential risks associated with UQ entering into external hosting solutions and is intended as a general guide only. A definitive analysis of the risks associated with a particular proposed external hosting solution should be conducted once the detailed particulars of the particular solution (eg proposed service provider, jurisdiction in which University data will be hosted, technical features of the solution, commercial offering and service provider’s proposed contractual terms) are known. IDENTIFICATION ANALYSIS Ref Brief risk description Details of risk Impact Potential measures (controls) which could minimise risk UQ is still in the process of considering the legislative changes and adjusting its procedures to ensure compliance, so it is possible that additional issues around the RTI Act in the external hosting context will come to light as UQ works through that process. 3.5 Breach of contractual Storage of information on service provider Breach of contract - potential for damages Most effective risk mitigation would be to audit obligations systems could risk breach of contractual claim for losses parties UQ contract with may contracts and seek consent to external hosting – obligations, eg: suffer as a result of UQ’s breach of contract note this could be impractical obligations not to disclose certain Minimise risk by employing strategies information; recommended in respect of Refs 3.1 to 3.4 above obligations to keep certain data safe etc obligations to comply with NPPs (see Ref 3.2) – this obligation is commonly included in UQ’s Commonwealth funding agreements 3.6 Breach of software licence Software licence terms may not allow for Breach of licence – licensor could charge UQ Before entering into external hosting arrangement, terms operation of software on third party service additional licence fee, sue UQ for damages if consider what licensed software UQ would be provider systems it suffers loss flowing from breach of licence running on external service provider systems and or take any other action it is entitled to take check software licence terms allow for this. If under its licence agreement licence terms do not allow for this, seek amendment to licence to cater for external hosting (but bear in mind there could be a cost implication) 3.7 Disclosure of UQ Storage of information on third party UQ secrets could be disclosed to third parties Encryption 8
  9. 9. INITIAL RISK ANALYSIS – EXTERNAL HOSTING SOLUTIONS OU Name:………………….…………… Date of Review:…………… Compiled by:………………………………. Date:…………… Approved by:……………………………… Date:……………. Note: This is an initial, high level analysis of the potential risks associated with UQ entering into external hosting solutions and is intended as a general guide only. A definitive analysis of the risks associated with a particular proposed external hosting solution should be conducted once the detailed particulars of the particular solution (eg proposed service provider, jurisdiction in which University data will be hosted, technical features of the solution, commercial offering and service provider’s proposed contractual terms) are known. IDENTIFICATION ANALYSIS Ref Brief risk description Details of risk Impact Potential measures (controls) which could minimise risk confidential information (service provider) systems could constitute – impact would depend upon importance of Due diligence on service provider security disclosure of confidential information to particular confidential information to UQ Contractual obligations around service provider service provider OR poor data security by security service provider could result in disclosure Periodical audits around service provider security of confidential information to other third parties 3.8 Disclosure of third party Storage of information on third party Third party secrets disclosed to UQ and which As per Ref 3.7 confidential information (service provider) systems could constitute UQ is required to keep confidential could be disclosure of confidential information to disclosed to third parties. service provider OR poor data security by This could place UQ in breach of common service provider could result in disclosure law, equitable or contractual obligations of of confidential information to other third confidence to third parties. Third parties parties affected could sue for damages to cover their losses. 3.9 Legal risk flowing from Will depend upon particular jurisdiction Will depend upon particular jurisdiction, Assess issues associated with proposed local laws in particular however examples could include: jurisdiction/s and decline to use service if jurisdictions (eg Patriot Fines jurisdiction presents too many issues Act in US, encryption Criminal penalties Include a compliance with laws obligation in prohibitions in US and Cancellation of accounts by service contract France) provider in response to government / court Contractual obligations to consult with UQ and order provide warning / opportunity for issue to be resolved before cancellation of account or other government / court action is taken Otherwise, will depend upon particular jurisdiction 3.10 Legal risk flowing from Will depend upon particular jurisdiction Will depend upon particular jurisdiction Assess issues associated with proposed 9
  10. 10. INITIAL RISK ANALYSIS – EXTERNAL HOSTING SOLUTIONS OU Name:………………….…………… Date of Review:…………… Compiled by:………………………………. Date:…………… Approved by:……………………………… Date:……………. Note: This is an initial, high level analysis of the potential risks associated with UQ entering into external hosting solutions and is intended as a general guide only. A definitive analysis of the risks associated with a particular proposed external hosting solution should be conducted once the detailed particulars of the particular solution (eg proposed service provider, jurisdiction in which University data will be hosted, technical features of the solution, commercial offering and service provider’s proposed contractual terms) are known. IDENTIFICATION ANALYSIS Ref Brief risk description Details of risk Impact Potential measures (controls) which could minimise risk lack of local laws in jurisdiction/s and decline to use service if particular jurisdictions (eg jurisdiction presents too many issues fewer laws protecting Will need specific contractual protections intellectual property in depending on particular issues faced in particular Asia) jurisdictions 3.11 Loss of legal professional Waiver of legal professional privilege by Discovery of sensitive legal advice in legal As per Ref 3.7 privilege disclosure of communication proceedings – could have very significant impact depending upon the circumstances Negative PR 3.12 Inability to comply with UQ may not be able to meet its obligations Fines Contractual provisions ensuring data security and disclosure / discovery / on time or at all if records being externally Other discipline by Court ability for UQ to access data in a timely manner subpoena obligations hosted are not accessible or if data has been lost 3.13 Ownership of email External hosting service provider owns Mass communication required internally Contractual provisions ensuring addresses are owned addresses on exit email addresses and when contract comes and externally on change of email by UQ and returned / transferred to the control of UQ, to an end, UQ does not have a right to use addresses. or transferred to a new service provider, on exit from the email addresses. Technical measures required to ensure contract. emails are forwarded in interim. Service provider given opportunity to charge for transfer of email addresses 3.14 Loss of or inability to UQ is not able to access historical data Inability to resist patent right challenges by Contractual provisions around data security and access access information relevant relevant to patentability or proof of patent third parties to data to patents ownership 3.15 Invalidation of patents Disclosure of information relevant to No right to patents for UQ inventions affected Data security measures 10
  11. 11. INITIAL RISK ANALYSIS – EXTERNAL HOSTING SOLUTIONS OU Name:………………….…………… Date of Review:…………… Compiled by:………………………………. Date:…………… Approved by:……………………………… Date:……………. Note: This is an initial, high level analysis of the potential risks associated with UQ entering into external hosting solutions and is intended as a general guide only. A definitive analysis of the risks associated with a particular proposed external hosting solution should be conducted once the detailed particulars of the particular solution (eg proposed service provider, jurisdiction in which University data will be hosted, technical features of the solution, commercial offering and service provider’s proposed contractual terms) are known. IDENTIFICATION ANALYSIS Ref Brief risk description Details of risk Impact Potential measures (controls) which could minimise risk patents that invalidate patent due to and/or competitors stealing ideas and UQ UQ policies quarantining such information (eg such disclosure into public domain unable to seek redress due to information information not to be sent by email) having been leaked into public domain 3.16 Loss of IP Inability to access material in which Will depend upon value of particular IP lost Contractual obligations on service provider in respect intellectual property rights subsist due to of protection of data data loss 3.17 Breach of employment If UQ’s passing of information to external Negative PR Careful due diligence and continuing contract laws or general law duty of host was negligent and a staff member Employee could sue UQ for damages management to ensure appropriate safeguards in place care to employees if they suffered loss suffer loss as a result of the outsourcing 11
  1. A particular slide catching your eye?

    Clipping is a handy way to collect important slides you want to go back to later.

×