How Risky is the Cloud?
Source: AICPA CPA Insider
The following includes excerpts, reproduced with permission, from an article by Jason Rosenthal and Nicholas Gowen.
While cloud computing – and particularly data storage – presents many advantages and likely will become more prevalent, there are unique risks to CPA firms and their clients. This column analyzes some of these risks.
Confidentiality and Data Security Concerns
To protect data confidentiality, negotiate specific contractual terms before uploading data into a cloud storage system. CPA firms should consider factors such as:
- Whether the provider will segregate your data;
- Whether the provider will access, use, or copy data for its own purposes;
- Whether the provider will delete or return your firm's data at your request;
- How the provider will purge data to ensure that confidential information is not compromised; and
- What the cloud provider's obligations are to notify your firm of a potential data breach.
Establish preventative and back-up measures to protect the integrity of your firm's data and that of your clients. Ensure that your service provider offers advanced security capabilities that include:
- A high level of tested encryption technology to ensure the shared storage space safeguards all data;
- Stringent access controls to prevent unauthorized access to the data;
- Scheduled data backup and safe storage of the backup media; and
- Business continuity and disaster recovery solutions.
Intellectual Property Issues
Be aware that courts do not generally make a distinction between the content of data stored electronically in the cloud and the data stored in paper files in your storage room.
Compelled Disclosure to Third Parties
Cloud providers may be compelled to disclose their firm's data and their clients' data if the provider is served with a civil or criminal subpoena or search warrant.
For the complete article, read “Warning: Cloud Could Bring Storm.”
From AICPA CPA Insider, February 12, 2012, http://www.CPA2biz.com.