Is your cloud vendor secure? 10 questions you need to ask

These should include:

• Successful completion of a SOC 1 audit under SSAE-16 guidelines (showing that they've done their part in terms of shared-responsibility security).
• As relevant, certifications for FISMA (Federal Information Security Management Act), ISO 27001, FIPS 140-2 (Federal Information Processing Standard) and others.
• At a minimum, they need to be compliant with any relevant government and industry regulations regarding loss of unprotected data, such as HIPAA (Health Insurance Portability and Accountability Act), GLBA (Gramm-Leach Bliley Act), PCI DSS (Payment Card Industry Data Security Standard), FINRA (Financial Industry Regulatory Authority), and PIPEDA (Personal Information Protection and Electronic Documents Act).

Also look for auditing certifications, e.g., having been audited against AICPA/CICA standards. Don't just ask to see a list. Ask to see documents that substantiate their claims, such as a SOC2 (Service Organization Control) or SOC3 report.

More to the point, how are data center IT staff and other employees, other customers, and cyber-intruders prevented from viewing, copying, changing or deleting your data? What encryption, keys, and other authentication are used? Where are keys kept?

For any multi-tenant services, ask:

• Is appropriate user authentication built in, to ensure each customer's data is separate and other customers can't see your data?
• Do they limit and monitor the use of system-wide administrator accounts, to prevent a flaw in one tenant's application from allowing an attacker to access your data?