9Aug - Sept - 2018European Network and Information Security Agency (ENISA) provided a number of best practice directives to security officers. For example, ENISA advises that:· Customers should review and update disaster recovery capabilities regularly, taking into account changes, past incidents, and results of tests and exercises· Customers should retain the right to perform second party audits where it is deemed necessary from a risk perspective and define responsibilities regarding the maintenance, operation, and ownership of assets· Establish cybersecurity roles and responsibilities for the entire workforce and third-party stakeholders (e.g., suppliers, customers, and partners)· Information security roles and responsibilities are coordinated and aligned with internal roles and external partnersTo be secure in the cloud, an organization must work with their vendor to design a fail-safe SLA. This will go a long way toward ensuring adequate resilience and back-up capacity, as well as capabilities for data restoration and disaster recovery.Not All Cloud Service Providers are Created EqualBearing in mind that all technology requirements frequently change over time, a company should look for a third-party vendor with a broad portfolio of other investment-related services to accommodate new business growth. A third-party vendor with a wide array of technological and financial services can help keep a financial firm on the path to best practices as it evolves over time.Cloud Provider Checklist for CompaniesWhatever cloud-based solution a company chooses, the provider should have strong capabilities in these critical areas:· Deep understanding of your respective industry· Knowledge of compliance and regulatory issues· History of providing cloud-based services· Cloud provider does not outsource responsibility of passing an audit to a third-party technology vendor· Responsible for the cloud technology· Robust business continuity planning model with adequate data centers for back-up· Automatic upgrades by way of the cloud· Predictable payments without a large up-front cost· Capability for hybrid solutions to integrate the cloud with local installations if needed· Willingness to customize solutions for company· Security and privacy protections that meet or exceed internal IT and data security policies· Quickly scalable up and down as resources are needed· Clear explanation about where data is stored and how it is handled· Comprehensive set of SLAs that meet or exceed organization's needs and requirements· Proven financial stability· A track record of successes, including referencesConclusionToday's realities make cloud computing a logical fit for both financial firms and their clients--who demand a combination of flexibility, efficiency, and support for the completion of large workloads at high speed.For financial firms, cloud computing does not delegate accountability to cloud providers but requires a partnership grounded in clear requirements, expectations, roles, and responsibilities. Having these expectations included by way of SLAs in a contract will help ensure long-term success. Reputable providers will not add language to contracts that they cannot commit to.Having these expectations included in the firm's contract review process and in the implementation of services will help prevent confusion and support the service levels that business is accustomed to being provided by internal IT. This further solidifies that a company's internal IT division is an advocate and vital contributor to the success of all services used by the business. This SLA usually includes the Recovery Time Objective (RTO) which is the time it takes from the point of disaster to fail, over to the secondary operation and resume production processing
< Page 8 | Page 10 >