When it comes to administrative controls, communication
management is extremely important, and we should be thinking
about this from two perspectives.
So there should be the upstream perspective, us to a provider, and
then any customers that we are managing that are consuming
services from us, that represents an arbitrage from the service
from the cloud service provider.
If you were to consider the Organization for Economic
Cooperation and Development's Openness Principle, that really
speaks to transparency as being an imperative when it comes to
communication with customers, again,
both ways, from the provider to us and from us to our customers.
So it's not only the business sense thing to do,
but under many circumstances, it's a requirement by laws and regulations.
If you were to meet the robust nature of ISO/IEC 27018,
Protection of Personal Data in the Cloud,
you would be thinking about what does it mean to protect the data for my
customer who may be consuming services from me? The cloud service provider is
definitely thinking about that from the standpoint of certifications that they
may have done based off of ISO 27017 and 18,
which mirror 27001 and 27002, but in the cloud. Think about your
responsibility as a data controller with the data subjects
information you've been given consent to use.
There are huge concerns by many different regulatory
frameworks that go beyond the GDPR.
One thing that's common across all of the frameworks
related to PII is the matter of transparency.
This could have to do with system repair and maintenance, as well as
customer notification that needs to be scheduled when scheduled
maintenance is being done. The cloud provider will need to ensure
adequate resources are available to meet expected demand and
service‑level requirements.
Therefore, you will rarely see notices from the cloud service
provider because they have capacity plans so that they can
withstand any kind of maintenance. But they will plug in a certain
amount of time that's automatically part of the uptime that is
really downtime for maintenance.
Personal data breach means a breach of security leading to
the accidental or unlawful destruction, loss,
alteration, or unauthorized disclosure or access to personal data that's
transmitted, stored, or otherwise provision service by a CSP.
You need to understand the responsibilities that really fall upon you
as a data controller, regardless of what happens with the cloud service
provider. You may be responsible for the regulatory impact or the legal
impact of some type of breach.
These are things that you need to know.
Obviously, you should have communication to those who are depending
on you for service on an annual basis, a transparency report that
lists things like how your data was utilized, how often law
enforcement and national security agents made inquiries into
particular users of your system.
You can get that same information from your cloud
service providers on an annual basis.