Cloud Computing Vs. Internal Controls

John Bace, a research analyst at the Gartner Group, had just finished a presentation for a corporate client. Discussion shifted to the company’s data storage, and the client’s CIO mentioned he planned on moving much of that data to “the cloud.”

The general counsel looked across the table and asked him what he meant. He answered that the cloud is a virtual storage facility, existing out there on the Internet rather than in a back office filled with servers and other software.

“You mean you don’t know where our data’s going to be?” the general counsel gasped. “We have to talk.”

This is not an uncommon conversation in compliance circles these days. Cloud computing—also known as “Software as a Service,” hosted computing, or numerous other names—is quickly becoming the new darling of IT departments for its cost savings, which can be considerable. But concerns about internal control and compliance are raining down on legal departments just waking up to the idea.

“We are still living in a world where we have literally Gutenberg-era laws and businesses are using Star Wars technology,” Bace says. “New technology does not absolve an organization from its obligation to retain, produce, or manage data in any way.”

From the IT department’s view, cloud computing has an obvious appeal: Data storage capacity in the cloud can be scaled up or down as your company needs, which is far cheaper than creating your own data center that might be only 10 or 20 percent used. Many of the top names in technology—Google, Microsoft, EMC, Amazon, IBM, and others—are offering a wide range of services, from storage to running and managing software applications. Michael Nelson, a professor at Georgetown University and former director of Internet strategy at IBM, describes it as a world where companies could assemble software and data services into any configuration they need.

To Continue Reading: Click Here
-----------------------------------------------
Source: www.complianceweek.com
By: Todd neff