Cloud computing by its very nature spans different jurisdictions.
The laws of the country of a request’s origin may not match the laws of the country where the request is processed, and it’s possible that neither location’s laws match the laws of the country where the service is provided.
Compliance is a complex issue that requires considerable expertise.
A Compliance as a Service application would need to serve as a trusted third party, because this is a man-in-the-middle type of service.
CaaS may need to be architected as its own layer of a SOA architecture in order to be trusted.
A CaaS would need to be able to manage cloud relationships, understand security policies and procedures, know how to handle information and administer privacy, be aware of geography, provide an incidence response, archive, and allow for the system to be queried, all to a level that can be captured in a Service Level Agreement. CaaS has the potential to be a great value-added service.
In order to implement CaaS, some companies are organizing what might be referred to as “vertical clouds,” clouds that specialize in a vertical market.
Examples of vertical clouds that advertise CaaS capabilities include the following:
- athenahealth (http://www.athenahealth.com/) for the medical industry
- bankserv (http://www.bankserv.com/) for the banking industry
- ClearPoint PCI Compliance-as-a-Service for merchant transactions under the Payment Card Industry Data Security Standard
- FedCloud (http://www.fedcloud.com/) for government
- Rackserve PCI Compliant Cloud (http://www.rackspace.com/; another PCI CaaS service)
It’s much easier to envisage a CaaS system built inside a private cloud where the data is under the control of a single entity, thus ensuring that the data is under that entity’s secure control and that transactions can be audited. Indeed, most of the cloud computing compliance systems to date have been built using private clouds.
It is easy to see how CaaS could be an incredibly valuable service. A well-implemented CaaS service could measure the risks involved in servicing compliance and ensure or indemnify customers against that risk.
CaaS could be brought to bear as a mechanism to guarantee that an e-mail conformed to certain standards, something that could be a new electronic service of a network of national postal systems—and something that could help bring an end to the scourge of spam.
Comments