Industry sign banking north dakota business associate agreement computer
welcome everyone thank you for joining Mayor Browns cybersecurity and technology transactions webinar our program today will focus on security and privacy in the cloud I need to cover a couple of administrative matters and then we'll get started we schedule periodic programs on technology transactions topics so if the interested look out for future invitations and feel free to spread the words to others who might be interested you can also find many past programs on our technology transactions web page that's wwa our bran comm - experience - technology slash transactions you will also find our website on the materials for the lawyers participating on the call today and applying for CLE credit during the presidential presentation you'll be provided an alphanumeric code you'll need to record the code on the virtual sign-in sheet that you received by email with the connection details and you'll find the directions for returning the virtual sign-in sheet on that sheet itself we will read the code in the middle of the presentation and then again at the end of the presentation we hope to allow time at the end of the presentation for questions to submit a question electronically please use the Q&A panel in WebEx if we all get to your question during the webinar we'll make every effort to follow up with you after the webinar as Jackie mentioned this webinar is being recorded as we normally do with these programs in a day or so we'll be sending them an email with a link to the presentation and the recording will also be posted on our website turning to our panelists today my name is Linda Rhodes and I'm delighted to participate with my partner's Brad Peterson and Joe Pannell on today's topic I'm a partner in the Washington DC office of Mayor Browns technology transactions practice I focused my practice on complex technology transactions including business process and technology sourcing and digital services and I have experience in handling the data security and privacy issues in the context of these complex transactions I'm pleased to introduce my fellow panelists first Brad Peterson is a partner in our Chicago office and the leader of our technology transactions practice Brad helps global companies work more effectively with their technology suppliers and is one of the most experienced and highly ranked outsourcing lawyers Brad's represented clients and increasing numbers of contracts with digital service providers including the cyber security and privacy issues related to those scopes Jo's also a partner in our Chicago office of the technology transactions practice he focuses his practice on information technology and managed services transactions he's also the co-chair of a be a section of Science and Technology laws cloud computing Committee on slide three we provide more information about the breadth experience and recognition of our technology transactions practice we welcome you to peruse that at your convenience one more brief introductory points before we get started the participants on this webinar represent customers suppliers and other industry players will primarily be walking through the points from the customers perspective however we believe the discussion will be providing insights for all relevant parties so to kick us off on slide four businesses are increasingly trained to cloud solutions and they're accumulating data in the cloud at a Skyrim tape this is due in large part to the significant advantages that cloud solutions have over traditional outsourcing for example they offer little or require little if any upfront investment by the customer and we allow customers to quickly ramp up and down the resource usage however cloud solutions also prevent challenges for complying with data privacy and cybersecurity regulations to successfully use cloud solutions and in particular to ensure that your usage remains compliant with regulations the Kuster needs to fully evaluate first the nature of the data that will be placed on the cloud second we associated data privacy and cyber security laws that are applicable to that data and third the structure and location of the cloud solution next slide I'll start with just a few fundamental points to set the stage for our discussion today a cloud solution generally refers to a type of service under which the provider utilizes shared computing resources to provide services over the internet for multiple customers providers typically maintain the freedom to move data to maximize resource usage across the customer base and also to lower cost however because of the multi-tenant nature of cloud solutions providers have little ability to customize a public cloud solution for any particular customer so initially this limited customization presented risks for using cloud solutions but with time providers are becoming more sophisticated in understanding the need to develop cloud solutions designed to meet regulatory requirements now as an example certain large cloud providers offer additional audit services as an add-on to their core service offering in addition many have separate environments specifically designed for HIPAA and financial services compliance and it's the data that is going through the cloud is subject to those kinds of requirements you can work with your provider to provide the right solution however of course the customer always needs to do its own diligence to confirm that even these specialized environments meet their particular needs additionally contracting Platts practices have become more mature for example where as a cloud provider may not be able to customize this environment to meet any particular customer needs as we'll discuss further today the provider will likely have certain industries likely agree to certain industry standards or agree that certain security protocols while they may change over time are not going to become less stringent than those in place in the contract date so there is some flexibility to contract for these solutions in a way that meets your needs so these types of development doubts developments are abling the expanded use of cloud computing my customers Brad I'm going to turn to you next Thank You Linda on slide 5 Linda's talked about the benefits of the cloud unfortunately the benefits of cloud have to be balanced against the risk of a data breach and descent the stage for this the impact of a data breach might include the expense to investigate and respond to a data breach which may be substantial in terms of hiring consultants and advisors and so forth but it goes on there's damage to the brand and reputation because of the requirements to notify and thus you may lose sales as customers say hey that this company is not a reliable place to have my say my data that leads to disruption to management to public relations to marketing and operations as the entire company scrambles to address the results of the breach then the regulator's step in to help with regulatory fines sanctions or mandates and the biggest news out the biggest news today in the data privacy area is that the European General data protection regulation the gdpr imposes a fine up to four percent of global turnover for breaches this of course all will also anger shareholders who may do shareholder derivative suits against directors and officers for having failed to adequately secure the assets of the company and consumers who may sue because their data has been breached or abused and there may even be suits from credit card companies and others who are harmed because of the data breach and then there may be collateral damages to a variety of other companies including the credit card companies so this tremendous possibility for adverse impact let's go to slide 7 and talk about how those risks tie to cloud deals a familiar phrase is that your security is as good as your weakest vendors security the attackers will attack your weakest point when you expand your threat surface by what your data into a cloud that's a logical place for attackers to go an even trusted sub Congress trusted contractors trusted cloud providers might subcontract vital roles to subcontractors who you might not trust and there may be watch out for example in cloud contracts for restrictions on first layer subcontracting but not the sub sub contractors of the sub sub sub contractors this is a particular problem in cloud computing because of the because the cloud computing deals are often quite small and as a result they may have liability caps that are also small imagine that the company faces its estimate a 10 million dollar possible loss from a data breach it puts the data on a cloud where the cloud provider has a instead of a 10 10 million dollar revenue stream it has say a ten thousand dollar revenue stream or $100,000 round urbanist stream and thus its liability is capped at a hundred thousand dollars the provider of course will do good and logical things to avoid a breach but it would spend as if it's a hundred thousand dollar problem the company of course sees this as a 10 million dollar problem and all of this has led to genuine failures we list here on slide 7 some of the examples that we've all read about in the media of companies that have had problems as a result of third party breaches for our purpose and on slide 8 we will today focus on the laws and regulations on privacy and data security not these other collateral damages this by itself is a complex area in the United States alone we have a set of federal laws which are generally what we call sectoral we've got flaws for the financial industry like gramm-leach-bliley we've got health care industry laws like HIPAA we've got educational laws like FERPA in addition we have various regulators have taken as part of their mission to regulate data privacy the FTC the SEC and some others then most of the individuals stay have published their own individual laws protecting data privacy in many cases an individual state will have multiple laws on data privacy so for example our state of Illinois not only has a law which protects against breach for financial data but also has a sophisticated biometrics data privacy law which is a separate law in Europe there are a tremendous number of currently state-by-state privacy laws but those are being consolidated into a general data privacy regulation companies today evaluating cloud solutions must consider both the current and the future European laws in the rest of the world the laws are varied in some case more strict than either of those laws for this purpose a couple of things worth pointing out first most of these laws apply to the data owner the company but in the increasing trend is for regulators and and to say no this law needs to apply to the provider also so there may be protection for the company that the provider is at risk and for any company acting as a provider liability is being heightened the second point most of these laws look to the phrases like reasonable and appropriate they've gone back and forth between should we try to legislate specific ideas and then finding that those ideas are washed away by the next wave of cyber attacks and technology or should we set forth the general standard for the most part word a general standard that is difficult to interpret with that let me turn it over to Joe to speak about some of those laws thanks Brad so as many of you know and Brad just mentioned the current EU data privacy directive will be replaced in May 2018 with the general data protection regulation commonly referred to as gdpr this regulation is extensive and complicated and failure to comply can result in heavy penalties like Brad mentioned up to four percent of companies worldwide turnover 20 million euros whichever is greater in some cases so gdpr is a massive topic and some of our colleagues will be providing a webinar fully dedicated to GDP are on December 6 but I'll walk through a few key provisions that are relevant to your cloud contracting efforts first who does GDP are apply to it's not just businesses that are established in the European Union if your organization is outside of the EU and processes personal data in relation to the offer of goods or services to individuals within the EU or if your company is monitoring individuals within the EU you'll have to comply with the GDP are under the GDP are a cloud provider is a data processor or perhaps even a co controller of data there are many changes resulting from GDP are they will impact cloud computing including more sophisticated requirements between controllers and processors that need to be covered in your cloud contracts these are some examples of topics the data controller will need to consider when using cloud computing services so first privacy by design a customer buying cloud service is likely the data controller as the data controller you will need to satisfy requirements regarding privacy by design and data controllers will need to determine how their cloud providers have complied with privacy by design requirements next record keeping data controllers and processors have requirements to keep certain records regarding compliance of GDP our privacy impact assessments data controllers are required to perform privacy impact assessments in certain cases these may extend to cloud computing services customers and cloud providers will need to consider who's in the best position to perform one of these assessments cloud providers particularly your SAS providers are fully in control of their architecture and how it uses data and you as the customer might not be in the best position to do the assessment on your own without assistance from those providers enhanced data subject rights must be addressed so transparency right to be forgotten right to object the data processing etc all these concepts be covering your agreement with a cloud provider so that you as the data controller are in a position to comply with gdpr breach notification requirements organizations will now have to notify the relevant European data protection authority of a breach without undue delay and where feasible within 72 hours notifications must also be made to the individuals affected without undue delay where there is a higher risk to the individuals concerned finally profiling is an area that will require special consideration under gdpr many cloud providers perform data data analytics in the background of their cloud services customers will need to understand whether any of these functions may qualify as profiling and if so customers will need to consider how to comply with gdpr in that event so moving on to the United States in the next slide this slide 10 is just a partial list of some of the laws and regulations they're required data owners including customers and cloud contracts to take reasonable measures to protect a personal data this includes requirements to take reasonable measures and selecting and monitoring any third party who will have access to that data so moving down some of the items on this list gramm-leach-bliley contains extensive guidance about financial institutions selection and monitoring the third parties who process non-public personal information including cloud providers HIPAA has privacy and security rules that flow down to third-party providers if your cloud provider is handling thi that cloud provider is going to be a business associate under HIPAA and will need to execute a business associate agreement with your client as I think Brad might have mentioned the SEC enforcement arm recently put out a risk alert in August 2017 with guidance on cybersecurity and then you have other federal agencies like the FCC DOJ and FDA who have also put out guidance on cybersecurity compliance you also have industry groups like the NAIC in the auto ISEC that have similarly provided site security guidance and an industry level among state laws and regulations the Massachusetts regulations contain some very specific security guidance these regulations are short and well worth reading unlike many other laws and regulations that apply to a data owner or controller these regulations apply directly to owners and processors and personal information including cloud providers customers will want to include certain provisions in their contracts to comply with those Ma
sachusetts regs and cloud providers should examine them to determine if they're in compliance of those regulations forty-eight states now have data breach laws and the only remaining holdouts are Alabama and South Dakota currently so you know whether or not all these different laws and regulations directly apply to your business the laws and regulations that articulate security standards are examples of what is considered reasonable measures given that type of regulated data or similarly sensitive data next slide the FTC one third of the FTC's enforcement actions are not based on an actual data breach but rather on an increased risk of security or a misrepresentation about the type of security that a company follows the FTC for many years brought enforcement actions regarding inaccuracies and company's privacy statements but now they bring cases where they believe there's inferior security and/or a misrepresentation about the level of security being used the FTC's consent decrees with their enforcement targets generally have a common set of requirements and one of them is that the company develop reasonable steps to select secure vendors in fact as Brad mentioned is not in the specific FTC context but there are several cases where a third-party service provider caused a security problem that resulted in an FTC enforcement action against a customer your cloud providers or third-party service providers and you must apply the same standards and controls that you would apply when contracting with or monitoring any other third-party provider of your business with that I'll turn it over to Linda to discuss the new york DFS regulations on slide 12 and another recent developments in New York's Department of Financial Services issued final regulations which were effective March 1st of this year those regulations mandate cybersecurity standards for many financial institutions which are operating in New York the definition of covered entity under the new regulation is broad and includes not only banks insurance companies and insurance professionals the regulations are comprehensive they address everything from access controls to encryption to data disposal and employee training what's important to understand here is that this new regulation includes requirements that have to be passed through to the covered entities third-party service providers or in other words your cloud provider the cert the third-party service provider requirements take effect in March of 2019 and they obligate the covered financial institution to develop and then pass through to their third-party service providers written minimum security policies which are designed to ensure the security of systems our data in the control of or access so accessible by those third-party service providers therefore what that means is financial institutions that fall within the scope of the new regulations will need to review existing third-party contracts the determinants are compliant or if they're going to need to be amended and it's a footnote I think there's an important lesson here that when you're contracting for cloud solutions and other services you need to think about addressing in the contract the need for the solution to be able to change during the term of the contract for changes that occur and legal requirement on the next slide I'm going to talk about third-party access by means of legal process and blocking statutes and the concerns around these areas ie the third-party access to cloud data and blocking statutes are actually driving the structure of cloud solutions so what does that mean as background federal agencies have a variety of tools they can use to seek electronically stored data and that include warrants subpoenas or court orders and those can be used to compel not only the customer but also the service provider to facilitate access to electronically stored data however when you talk about the cloud environment we have US data that may be stored overseas this raises novel questions for the legal community a recent litigation suggests that the US government's ability to access US data that stored outside of the US isn't as innocent as data flux for example there was a recent Second Circuit Court of Appeals case that held a u.s. enforcement agency could not use the stored Communications Act to obtain a warrant issued on a US service provider for email content stored in Ireland whereas a Third Circuit District Court held to the contrary on the other hand data that's stored in the u.s. is subject to the jurisdiction of US authorities regardless of where the origin and that data is so what does this mean for cloud computing multinational customers are often using several cloud instances or multiple providers around the world to address these concerns so as an example a multinational company may both have a u.s. cloud instance and an EU cloud instance and the EU cloud instance would hold the EU data to protect the EU data from access by US governmental authorities a couple of footnotes worth mentioning in terms of access by private litigants linty litigants the plaintiff and defendant in inaction multiple courts have held that the provisions of the stored Communications Act permitting disclosure um through a service provider do not apply to private litigants therefore a party to litigation will not likely be able to speak electronic data from the service provider on the other hand moving data to the cloud is not likely going to alter the customers obligations to produce this own document in response to a subpoena or document me either by private litigants or US government entities secondly on the topic of blocking statues location of data issues are further complicated by many countries that have actually passed blocking statutes which means they've women or prohibit exploiting certain information outside of that country that is an acid bath blocking statute the most prominent examples are China and Russia so again when you're talking about your cloud contracts customers are often using cloud instances or local providers in for example China to deal with these kinds of blocking statutes with that we'll turn it back to Brad Thank You Linda so the question now is how do you address the privacy and data security risks of the cloud while capturing the value and as Joe has mentioned the regulators and we believe most of the rest of the sourcing community have concluded that the keys to success are to look at it in selection contracting and governance so I'd like to start on slide 16 with the first steps for the selection process these are steps to take before moving to a specific project and without the time pressure of a deal and the goal is to make sure that when that you are ready for the selection process step one looking for the documents that will help you understand the context for privacy and data security within your company first one and probably the Rosetta Stone of the collection is the written information security plan according to law every company should have or writ an information security plan if you don't have one advocate for one that is the plan for comprehensively how do you approach information security across your enterprise second you should have a data breach response plan that's the plan for what do you what you do in the first 24 48 and 72 hours when a data breach hits the written information security plan will be a guideline for the sorts of contractual provisions and steps and mitigations you need the data breach response plan won't form support you need from a provider in case of a data breach then review the cyber goals objectives set by your board make sure you're aligned with those identify the subject matter experts and stakeholders so you know who to talk to when you're in the midst of a cloud contract and you have a data security question so you you have these people on speed dial then to the extent that they aren't already described in the wisp identify the relevant laws the policies the standards whatever else you might need to comply with so that you know the compliance obligations you walk into clogged deals generally with those might be embedded in a cloud contracting policy at some companies and then finally as part of selection you'll need selection tools and the one that's most common is a data security questionnaire which asks a provider what data security had they have in place already and will be a great way for you to start on your efforts as we go to slide 17 which is called key steps and selection of providers now you've gotten to your in a specific sourcing opportunity you know what you want to leverage the cloud for you may have a cloud strategy you may just be looking at a opportunity to save some money these are what we would recommend is the key steps first identify what kind of data will be accessed or stored by that cloud provider second categorize that data by risk level and you probably have a risk level matrix which is set forth in your data breach in your in written information security program or in your cloud contracting policy then obtain copies of the bidders security documents they often be in the trust Center or something at that stored on the bidders website so you can often find that document that documentation without even asking for it but it's often valuable to ask for documentation send preliminary questionnaires regarding security and in those preliminary questionnaires ask for additional information the preps a sock to report under SSA 18 or perhaps it's an ISO 27001 certification something of that sort if you're still insecure commissioned some sort of security reviews and off in advance and then review all the data that you've gotten back in addition to all of the information that you've collected in that preliminary first step stage and remove the suppliers with inadequate security capabilities your goal is to get to a panel of suppliers or panel our collection of bidders that you can truly trust and then finally we'd recommend that having all that in hand you estimate the cost of the governance stage so that when people are thinking about how do I contract for this what's my business case they have a number to fund the contracting and governance stages that let me turn it over to Joe we garden contracting thanks Brad so now we'll move from the selection process that Brad was just describing into some of the challenges of contracting with cloud vendors so slide 19 contracting preparation first there are going to be some limitations in the cloud solution for business and technical perspective that may prevent you from getting all of the contract terms that you might ordinarily hope for in your technology contracts for example when you buy a public cloud solution you're getting the latest in technology and potentially much lower costs than conventional IT solutions the trade-off is that you may not be able to dictate security requirements that don't fit the providers architecture like physical separation of your data from other customers data second you're you're going to need to access the privacy and security risks of the cloud provider solution and identified non-contractual ways to mitigate that risk the easiest approach may be to keep the most sensitive personal data of your organization out of the cloud altogether third assess the risk of locations used by the supplier and find ways to mitigate that risk as Linda mentioned earlier many sophisticated providers offer geographically specific clouds for example in an EU jurisdiction like Ireland to help eliminate your compliance risk from cross-border data transfers on the other hand that that sounds great in theory but customers need to understand whether their data actually se stays in the EU cloud instance for data processing still going to occur outside of the EU via remote access from places like India or otherwise as many of you know remote access constitutes processing for purposes of EU law lastly identify areas where the provider may use your data and if you want to try to prevent that use fine contract so cloud providers will frequently offer an innocuous signing clause about using your data to quote improve our services or using your data and aggregated or anonymized form and that that sounds ok in theory but the big data analytics that a cloud provider could be running on your data may disclose valuable information that otherwise might be secret such as the characteristics of your high-margin customers or maybe your future business plans we recommend thinking about these issues in the context of your data before you begin contracting so that you don't inadvertently grant valuable rights in your data without even realizing your doing so next slide number 20 contracting approach our experience is that customers don't need to settle for cloud standard terms from the provider based on what their consumer oriented contracts say enterprise customers can and do obtain the protections they expect for critical data and critical services ideally you'll start from your own form agreement if you have the leverage to do so one cautionary note here is that using traditional outsource services forum is less likely to succeed than using a more abbreviated cloud friendly form agreement a lot of times that it's not a given that you're starting from your form versus the providers form and you'll hurt your credibility in pushing your form and in negotiations if you're proposing some type of 80 page professional services form that's full of personnel provisions that just don't apply to a cloud solution or otherwise don't make sense if you're unable to start from your own form with some of the bigger providers you'll need to instead focus on negotiating the negotiable elements of those providers form agreements with the leading providers of these services and if you end up on their paper it's frequently more efficient to identify an issue with their agreement rather than trying to add in your company's standard provision that addresses that issue usually when you identify you know a particular issue you may have the providers going to respond with standard clauses that they've already developed and had approved higher up in their legal department instead of laboring over your language that will ultimately be rejected in favor of their standard clause you're not likely the first customer to raise a fundamental concern with an industry specific data security issue and the bigger providers may have a workable solution for you that they can pull off the shelf Linda talked about this a little bit earlier finally prepare some type of risk memo that identifies the risk of accepting the providers terms this should inform your clients decisions of whether or not to go through with the cloud solution it helps you clearly identify the risks that you can't mitigate solely through contract terms and how you can mitigate those risks operationally or procedurally so for example the provider may only give you 60 days notice of changes their services and those changes could conceivably put you out of compliance with applicable laws whether it's data privacy and security or otherwise if you're not able to negotiate a prior approval right longer notice period for those changes some clients may look to mitigate the risk by standing up a parallel cloud solution with a different cloud vendor you can maintain that parallel platform as a hot backup to quickly transfer your data and operations to stay in compliance if that ever becomes necessary so these are these are just examples the types of things we see our clients doing when they can't get quite the contract terms they hope and they they come up with other creative operational solutions that otherwise you know nonetheless address their risk with that I'll hand it over to Linda to go through a cloud contracting checklist Thank You Jo um so the next several slides include checklists of data privacy and security provisions to be addressed in a cloud contract I'm not going to go through these you know one by one you will receive the presentation and of course are welcome to use this as you like and many of these items we've already touched on during the presentations thus far however there are a few provisions of that I would like to highlight for
xample many privacy laws and regulations require that the customer maintain the ability to monitor the performance of its third-party providers ie cloud providers by conducting audits however in many cases of a cloud provider will not or may not be able to offer broad audit rights that you would get in a on-premises type solution for example few large providers will I use to come in and access their data centers this is either for policy reasons or risk reasons again keeping in mind that a cloud solution is based upon this one-to-many model in those cases you know our recommendation is that the customer asks the provider what types of third party audits or certifications of their facilities they routinely obtain such as multi-tenant stock one or stock two type two reports or ISO 2700 series of certifications again whether or not those controls and industry standards are sufficient to meet a customer needs depends upon what the nature of the data is being placed in the cloud and what the data privacy into the cybersecurity laws that are applicable to that data so once again diligence is the key do you need a stock one report our stock one audit of the internal controls over financial reporting and may depend upon the services you are obtaining for example are you seeking finance and accounting services do you need a sock to audit which covers controls relevant to security availability processing integrity confidentiality and privacy most large providers will do these types of controls audits and it's possible through your conversations with the provider that they either already offer those up to you or you're able to get them to commit to that in the contract similarly it's not necessarily sufficient to just say you're going to require ISO certification your security team should review the statement of applicability and that identifies the controls that are in place that are being certified to for example providers can opt out of certain provisions that are part of the ISO standards for example they have many providers will opt out of the obligation to perform background checks and you need to assess from your company's perspective whether that's accessible to you or not once you determine what the provider actually does then you can look to your contract to see how to address those obligations for example including a commitment by the provider to regularly conduct those audits and report audit findings to the customer requirements for the provider to implement the controls and then maintain the controls and certifications during the contract term so this is an area where there may be some flexibility in negotiating the contracts terms or maybe seeking additional services that the provider may offer as add-ons to their core solutions also in many cases regulators may require the right to audit the customer's regulatory compliance a few if any cloud providers will that broad access by regulators but as I mentioned earlier there may be add-on professional services that you can get from your cloud provider well they're where they will work with you in working through the regulatory issues with your regulators similarly a customers may want to ensure that the cloud contract has appropriate physical and operational security measures so again depending upon the nature of your data you may want to require penetration testing or vulnerability scans of your scans or you may want to have longer law log retention periods to ensure there's sufficient time should there be a data breach for you to do your investigations you know in some cases these are rights you can obtain as additional as services through your service provider and then on slide 22 just a brief point on subcontracting brad's is touched on this earlier you know certain Davis data privacy laws have actual requirements that the customer maintain the right to approve subcontractors and pass through security obligations to those subcontractors you have to think about the fact that those subcontractors may have their own subcontractors and down the line so when you build approval rights into your contract you want to make sure they apply to subcontractors at all tiers I'm skipping over to slide 24 I'll touch again on data breach notification you've heard Joe talk about that some in his GDP are in state breach notification law requirements but again it comes back to the fundamental question of understanding the nature of your data and what laws applies so you're going to be dependent in a cloud environment on the cloud provider to notify you so that you can then meet your obligations to notify your customers or comply with your regulatory obligations and you may be subject to multiple laws in terms of data breach notification requirements so you're going to want to look to your to make sure that your contract ensure that you could ply with the most stringent of those requirements give for example the gdpr as Joe mentioned having the very short you know 72 hour notification requirement in Georgia data breach law which actually has a 24-hour notification requirement so you want to make sure you adhere again to the most stringent additionally the definition of what constitutes personal data is being brought in under many data privacy laws for example in California and other states personal data includes an email address and password so when you look at your cloud contract you have to make sure that the definition of personal data or customer data is broad enough so that you're getting the NORs you need in order for you to meet your compliance obligations with that I will turn it back to Brad pride you may be on youth thank you the third phase after you've selected a real asset of reliable cloud providers that you can trust that you've come to good solid contract terms with several of them the third phase is governance and that includes monitoring demanding correction of problems and verification of Corrections the contract terms that we've talked about are valuable as tools they on solve the problem on their own they have to be used in governance to be effective so let's talk about some of the ways that we see our clients following up in governance which appear on slide 26 the first step is to have a security team or a team that expressly takes responsibility for the security of the cloud platform someone at the company has it as part of their key job responsibilities to monitor to follow up and determine to verify corrections and one of the things that they would first take on is the implementation of the risk mitigations that were identified during contracting and Joe mentioned that there's a value in putting together a risk memo possibly even a privileged and confidential risk memo that would indicate some of the open problems problems not mitigated during contracting so those should be top of the list for that secure that data security team second I talked earlier about sending a data security risk questionnaire and the benefit of the questionnaires that had asked about the security practices that the providers were promising when they were offering the service but we want to make sure that that provider continues to be reliable as the threat as the threats change and the use of the cloud changes so having follow-on questionnaires that you may send on a regular basis to make sure that the provider continues to be offering the same today - security protections and same privacy protections and obtaining the certifications that were promised in the contract and so forth and then doing ongoing monitoring of those will help to make sure that you're actually getting what were promised if you're the company fourth idea maintain that data map we talked earlier about the importance of having a data map not a literal map but a way to find out where a company's data is within the company and a key is to be able to show where the data has been extended into the cloud often when people in the Big Data area are working on creating new databases for example they might take data out of primary databases the Accounts Payable database the accounts receivable database these the various systems of record and move them to secondary systems and if it's an Indian digital transformation with the intent to serve customers you might have an online transaction database which is a secondary database cloud-based permitting rapid access by customers to data about the products and services being provided by customers and you might have other online databases for data warehouses or online analytical databases for use by the company that means that data is flowing often out of the highly protected systems of record into the cloud knowing where that data is allows you to monitor to to manage not only the flow of data into potentially insecure spaces but also the application of contract terms this idea security audits security audits are expensive and they will obviously not win you any friends at the cloud provider but the benefit of security audits is that you get real information either from the the reports that the cloud provider is providing from its auditors are the reports provided by your auditors about the security situation at each cloud provider they are well worth investing in as well worth having a program where that investment is made on a regular basis then a process to review those audit reports and to follow up on exceptions and identified vulnerabilities governance is not just monitoring it's also following up and that also includes side point one that we've seen in a practical problem that we see for many of our clients and Friends is the need for rigorous policing of access rights and a shot off access rights when a person has left the organization so with those you've got follow-up in governance let's move to slide 27 just for a few concluding remarks in conclusion first privacy and data security breaches can have a high impact on companies these are board level issues for a reason second there is a complex legal and regulatory framework and that framework depends on your industry where you do business what data you have in other factors it's worth speaking with specialized counsel who understand the specialized data and secure data security and privacy framework for your business third cloud contracts might involve particularly high risks there's a spectrum of cloud contract some of them with are with highly secured providers and limited access to sensitive data those may be low risk but there are also certainly opportunities to have high risk cloud contracts and the profusion of cloud vendors and the novelty of the technology in the fact that it's inherently accessible for the internet presents a high risk profile for some cloud providers the best path to reduce the risk is diligence in selection or you pick cloud suppliers that can deliver secure solutions in contract negotiations where you establish commitments options and incentives that motivate the cloud supplier to deliver security and finally in governance or through monitoring follow and follow-up you assure that the cloud solution that you expected from the sub that the secure cloud supplier you desired is what is being delivered and with that you can have security and data privacy in the cloud with that I'd like to turn it back to Linda if we have more time for questions thanks Brad yeah I think we have a few minutes for questions and again for those of you who are on our WebEx you can submit questions electronically via the Q&A panel in WebEx if we don't get to your question during the Q&A period we'll do our best to get back to you following the program so quickly there was a quick question about just confirming some of the differences between the the data beach breach notification and requirements in the US and those under the new gdpr can you just kind of highlight again those for us yeah good question it's not necessarily a quick one but there are some key differences so first GDP RS notification requirements apply generally to any personal data so much broader net than in the US per se but there's a risk analysis that governs whether notification is necessary and I'll get into that in the u.s. notification laws there's usually a narrow definition of personal data that covers only those items that put an individual at risk for identity theft like social security or credit card numbers so that's one big difference is just what's the scope of the personal data that triggers the breach notification second your primary liability risk for a data breach under GDP are as large fines so there's a range of fines only told you the scariest one earlier but not complying with notification obligations can subject the controller in the process or the fines of ten million euros or two percent of worldwide turnover whichever is higher so that's not as scary as the four percent worldwide turnover but two percent is nonetheless terrifying your liability risk conversely in the US for data breach is usually due to class actions FTC enforcement actions AG enforcement actions etc so you know the big headline right now is about the Equifax breach and that so far has resulted in 50-plus class-action lawsuits investigation by state AG's and the FTC you have claims from financial institutions shareholders and small business owners there's a criminal investigation by the DOJ into insider trading and there's also a CFPB investigation so the EU penalties are headline-grabbing and bracing but obviously in the u.s. things come at you from many more directions and then lastly the notification obligations themselves vary a lot between the EU and the US so under gdpr there there are three standards basically first controllers have to notify a supervisory authority of a data breach without undue delay and not later than 72 hours after becoming aware of the breach unless the breach is unlikely to result in a risk of the data subject the the second part of the gdpr notification is controllers have to notify affected individuals in the data breach without undue delay if the breach is likely to result in a higher risk to the data subject so this is the risk analysis I mentioned earlier and then the third notification obligation or gdpr is that processors have to notify the data controller without undue delay after becoming aware of a data breach and there's no risk analysis involved there they they just must notify in the US it's not as simple as the three-prong risk analysis approach like we mentioned earlier there's 48 state notification laws to navigate and there's not much uniformity there so the data controller usually at the controllers usually have to notify a variety of entities depending on the state so you might be notifying state Attorney General's affected individuals credit reporting agencies law enforcement agencies and maybe even some other entities and the notification timeframes range wildly so some states will say you must notify within the most expedient time possible and without unreasonable delay some like Georgia at the 24 hour limit that Linda mentioned you know there's the 30 days or later standard some places and then there or even more vague time frames the time frames for processor processor notifications to controllers can range widely you know from immediately - without unreasonable delay to the 24 hours standard actually I think I may have misspoke the 24 hour standard for Georgia I think that's processor - controller and then there are other vague time frames so there's a lot to navigate in the US and not a lot of uniformity right now well great thank you Joe we're getting a little short just quickly there's a question about subcontracting how do you get the ability to approve subcontractors from a cloud provider and so another good question they have to think about first of all when you go into the contract you'll find out who the subcontractors are today so those existing subcontractors can be added to a schedule to the agreement and you can approve them day one then obviously over time the cloud providers going to want the flexibility to add or change you know delete subcontractors so you know typically what we try to do is do our best to get the cloud provider to notify us in advance of those changes or you know it may be that we can go to a website to ch
ck you know update you know who the current subcontractors are and while in this one too many model you're not going to get a cloud provider that's going to say ok any one customer can veto my right just to add another subcontractor you may be able to do things like you know have a termination right or you know change your solution and with without you know paying a penalty or receiving a reimbursement or pro rata reimbursement of cost prepaid because there's no it's a contractor who you didn't know about it and no longer approve and sometimes the provider will say well you can't just arbitrarily not you know be unhappy with the subcontractor it has to be based upon your concerns that they will put you out of compliance with data privacy laws so those kinds of things can be worked through so I want to be respectful of everyone's time we're near the end of the our quickly thank you again for joining us we on the lookout for future technology transactions webinars again want to highlight the gdpr webinar coming on December 6 and finally feel free to submit topics for future programs add text transactions at Mayor Brown comm thank you again and I'll turn it over to the operator for closing formalities
