In some ways, moving to an outsourced cloud provider is a bit like outsourcing the storage of your physical files – whether to an active records center or to a box storage provider.
In both cases, the files themselves now reside within facilities owned and managed by the outsourcing provider. In both cases you are relying on another party to help ensure the privacy and security of your records.
The cloud presents unique challenges
Because of the similarities, it would be tempting to conclude that outsourcing to the cloud was a relatively straightforward decision.
The cloud presents several challenges that physical records outsourcing does not. Here are four potential pitfalls that are unique to records storage, and some tips to help you avoid them:
Pitfall 1: Non-compliance with legal requirements for records storage.
One of the most common question that comes up regarding cloud-based storage is, “Are we allowed to do it?” In other words, is it legal?
Unfortunately, there is no universal answer to this, and finding the answer is not always easy. A lot of the legislation in the North America specifies very clearly that specific records must be stored in very specific locations. Often this is within the geography covered by the legislation itself. This poses challenges for cloud storage because you can’t always be sure where the cloud servers are located – and in fact, your data may be stored in multiple physical locations.
In some cases, there are specific requirements as to the format of the documents. For example, it is common to see statutes requiring the retention of a hard copy record.
Avoiding legal issues is a matter of making sure you understand all the applicable legislation and ensuring that your outsourced cloud solution provider can meet those requirements.
Pitfall 2: Loss of legal control
A number of challenges are introduced by the fact that your records may be stored in legal jurisdictions – or even countries – outside your company’s headquarters or operating region.
In the worst case scenario, the movement of records to systems outside your organization’s normal operating jurisdictions means that you lose legal rights, remedies and controls.
To avoid this scenario, it is important to ensure that the outsourced solution allows you to:
- Review or monitor how information is handled and processed – in all potential locations
- Resume direct custody and control of your records in the event of contract termination or dispute
- Control and prevent access to your information by unauthorized parties.
Pitfall 3: Retention and disposition issues
As with any storage scenario, you need to ensure that records are kept as long as needed and disposed of in a legally defensible manner once all such needs have lapsed.
Some cloud storage solutions make these tasks difficult, creating a nightmare of extra work to stay compliant and avoid retention-related risks.
To avoid these pitfalls:
- Make sure our cloud storage solution supports both time-based and event-based records retention periods.
- Be sure that your records will exist in a readable format for the duration of the retention period. This is especially important for retention periods longer than 15 or 20 years, given the rapid rate of technology obsolescence.
- Make sure that any backup copies or mirrors are also deleted along with the original records.
Pitfall 4: Privacy and security issues
Outsourcing records to the cloud introduces a brand new set of security and privacy risks.
The main issue is the fact that all manner of information – from sensitive corporate records to personal information about clients – is now stored outside your company firewall. This means that it is now at greater risk of hacking and other forms of unauthorized access and misuse, from literally anywhere on earth.
To address this risk, the first step is to investigate and validate the security measures used by the outsourced provider. You will also want to ensure that your organization has put in place security controls and protocols – and that they are followed on a regular basis.
Our list of pitfalls may make outsourced cloud storage seem like a daunting and risky prospect. By asking the right questions and exercising diligence when seeking a provider, these risks are all very much manageable – allowing you to enjoy the benefits of cloud without worry.
In our next blog post, we’ll provide a list of questions to ask a potential cloud storage provider. Follow us on Twitter to be alerted when it is available!
- Learn more about tackling these pitfalls in our full white paper, Considerations for Moving Records Storage to the Cloud
- Learn practical tips for moving records into the cloud: http://www.tab.com/resources/making-cloud-storage-work-a-records-management-action-plan/
- Get in touch to talk to an expert about moving your records into the cloud: http://www.tab.com/contact/