If your cloud service provider sounds like your local weather reporter – partly cloudy with a chance of rain – you may be in for a data security storm. A USA Today guest essay by Rajiv Gupta highlights the need for a multi-layered approach for cloud providers to ensure data stored in the cloud is secure, something we’ve touched upon here before. Businesses need greater certainty concerning the security of their data in the cloud and should be pressing their cloud providers for a security forecast with more certainty than their local weather report.

As Mr. Gupta notes, “by 2020 nearly 40% of the information in the digital universe will be touched by cloud computing providers.” Many businesses recognize this trend and may already have business data and applications in the cloud. However, some may not realize that some of their data is in the cloud without their knowledge or authorization, and without having had an opportunity to vet the provider(s). For example, it has been found that as many as 1 in 5 employees use commercial cloud providers to store company information.

Mr. Gupta discusses a number of tactics cloud providers should employ to secure data in the cloud – encryption, contextual access control, data loss prevention technologies, audit trails, and enforcement of security policies from application to application. Good advice for cloud providers. But customers of the cloud need to think a little differently.

Purchasers of cloud data storage services need to have a sense of the multiple layers of security tactics that are recommended for cloud providers and see to it that their provider(s) have them in place. But they also need to be thinking about:

• What protections does their company have if the cloud provider’s systems are breached?

• Does the services agreement with the cloud provider adequately address security, data breach, indemnity, reporting and so on?

• What policies do they have for their employees concerning the privacy, security, integrity and accessibility of company data when using the cloud? And, which cloud should they be using?

• How would employees’ use of their personal commercial cloud services complicate a company’s litigation hold processes?

• Who at the company and at the cloud provider has/should have access to the data?

• Is the cloud service provider a business associate/subcontractor under HIPAA, prepared to comply with the HITECH Act? What about the agreement requirements under state law?

• Where is the data stored? Is it in the United States, or in a foreign country subject to different data security standards?

• What if the cloud goes down, out of business? Will company data and applications be accessible?

• Are the businesses’ customers and clients on board with use of the cloud for their data?

These are just some of the key questions businesses should be asking about concerning use of the cloud. The technology can indeed yield substantial cost savings, but the failure to think carefully about its adoption and implementation can create substantial exposure for the company.