Negotiating in the cloud - legal issues in cloud ... - About AGIMO

the inclusion of standard Commonwealth exceptions to confidentiality including the right toprovide information to the relevant minister as well as houses of Parliament.Records management requirementsAgencies should refer to Records management and the cloud - a checklist 6 prepared by theNational Archives of Australia for records management considerations in cloud computing. Thatadvice requires agencies to include appropriate controls and protections (for example throughagreement with the cloud service provider) that match the value of the records and address therisks of cloud computing for an agency’s records.AuditAll the protections described in this section may potentially be worthless unless the agency isable to confirm that required information protection requirements are in fact being met. Audit ofcloud computing arrangements is one way of checking compliance. Audit of such arrangementsis however potentially complicated by:the location of the data – which, unless specifically identified and locked down in theagreement, may be unknown to the agency, and could be located in one or more discretesites in foreign countriesthe nature of cloud computing itself which may involve agency data being spread across alarge number of different provider computing devices (in order to harness the economies ofscale and on-demand provision of computing that cloud computing services offer).As a result, agencies should consider including the following rights in any agreement: restricting the locations/countries in which agency data may be held (with movement tonew locations permitted with advance approval in writing from the agency) rights to audit the provider’s compliance with the agreement including rights of access to theprovider’s premises where relevant records and agency data is being held audit rights for the agency (or its nominee), the Auditor-General and the InformationCommissioner a right for the agency to appoint a commercial auditor as its nominee (as this allows theagency to appoint an auditor in the same location as the provider’s data centre to save costsand ensure compliance with relevant jurisdictional laws) where technically available, the right for the agency to remotely monitor access to its dataand where this is not possible, a requirement that the provider maintain an audit log ofaccess to the agency's data and provide that log to the agency on request.Compensation for data loss/misuseIt is possible that data could be permanently lost by a cloud computing services provider in anumber of circumstances such as technical or operator error as well as fire or other disasters.Similarly, there is always the risk of misuse of data by rogue employees of the provider orcompromise by external parties.While the probability of such problems can be minimised by the provider ensuring offsite databack-up, proper technical and security training and hardware maintenance, it is important for6 http://www.naa.gov.au/records-management/publications/cloud-checklist.aspxNegotiating the cloud – legal issues in cloud computing agreements | 8