[{"innerBlocks":[],"name":"core\/freeform","postId":125840,"blockType":{"name":"core\/freeform","keywords":[],"attributes":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"providesContext":[],"usesContext":[],"selectors":[],"supports":{"className":false,"customClassName":false,"reusable":false},"styles":[],"variations":[],"apiVersion":3,"title":"Classic","description":"Use the classic WordPress editor.","category":"text"},"originalContent":"Organizations are increasingly coming to rely on software as a service, replacing applications that have previously been hosted on-premises.In April, for example, Gartner predicted SaaS global revenue <\/a>would grow 18.5 percent over 2018 to more than $94 billion this year and that, by 2022, it would grow to $143.7 billion. And while there are many benefits to a SaaS approach\u2014lower costs, no on-premises equipment or software to operate, no updates or patches to manage\u2014it does raise significant questions around compliance with GDPR, HIPAA, Sarbanes-Oxley and other regulatory schemas that govern company data. So, who owns the data? Who has responsibility for compliance? And what questions should customers ask a potential SaaS vendor to determine whether their data will be compliant in their service?Let\u2019s address data ownership first. When it comes to security (and security is an important part of compliance) SaaS services typically operate on a shared responsibility model. The provider takes responsibility for securing its own infrastructure and environment, while the customer is responsible for ensuring access to the service is locked down.This model extends to data protection and backups, where the provider protects the platform against catastrophic failure or breach, but when it comes to discrete recovery of individual items due to events such as accidental deletion, that\u2019s up to the customer.

Inside The Hackathon At The Yahoo! Inc. Mobile Developer Conference<\/bsp-image>Nevertheless, from a practical point-of-view, the short and simple answer is: you own the data. The vendor may store and process it for you, but, ultimately, you\u2019re responsible for ensuring that data is compliant with all relevant regulations. If the vendor fails, you could be on the hook for fines, other penalties and damage to the organization's brand.Compliance is an enormous topic, so we\u2019ll just hit the highlights of the measures you should take when it comes to SaaS data.Data protection<\/b>A r

ecent study from 451 Research<\/a> shows that nearly three-quarters of organizations either depend on the vendor to protect their data or have no protection for SaaS data at all. That\u2019s a terrible position to be in, because if someone accidentally deletes data or the SaaS vendor suffers a catastrophic hack or natural disaster, your data could be gone forever. You need to take responsibility to ensure it is protected, especially for sensitive data such as financials, health or personally identifiable information, and even emails or texts that could be relevant in a court case. Thankfully, there are solutions to help you back up data in SaaS applications, and many are themselves SaaS-based.Data sovereignty<\/b>Many countries require that data produced or collected inside their borders be physically stored there. As such, it\u2019s important for end users to understand what SaaS data falls under these requirements and where your SaaS vendors will store it. Make sure to get documentation so you can demonstrate compliance, should you need to do so.Security<\/b>Be certain that your provider is taking proper security precautions to protect their own environment. If they have achieved SOC2 attestation, that\u2019s a great indicator, but, at minimum, ensure that they encrypt data stored in their systems. In the absence of an attestation or certification, you may have the vendor complete a vendor risk assessment which provides you more details about the underlying protections and controls in their system. Also, make sure they will contact you immediately if there is a breach on their side. GDPR requires that organizations notify individuals if their data was part of a breach within 72 hours. From your side, ensure that you\u2019ve locked down access for SaaS applications that store sensitive data. Your provider is responsible for securing their infrastructure, but it\u2019s on the end-user to control access.The right to be forgotten<\/b>This requirement from GDPR famously requires organizations to delete an individual\u2019s data if they request it. As such, make sure that when you delete data from your SaaS application that it is also permanently deleted from the infrastructure. There is some ambiguity about whether organizations are required to delete data from backups, but most experts believe this is not necessary to comply. That said, when you restore data, it\u2019s important to make sure that no data is recovered that should have been \u201cforgotten.\u201dDocumentation<\/b>If you\u2019re storing data that requires special treatment for compliance, make sure to obtain detailed documentation from your SaaS provider regarding their own compliance with HIPAA, GDPR, Sarbanes-Oxley, PCI DSS 3.0 and any other schemas that may apply. Compliance in an as-a-service world doesn\u2019t have to be any scarier than on-premises compliance. In fact, in some ways, it can be much easier, with the provider taking responsibility for many functions. But it\u2019s critical to do a lot of vetting up front to ensure you\u2019re working with a strong provider. After all, ultimately, the buck stops with your organization. If you entrust sensitive data to a SaaS provider that doesn\u2019t live up to their responsibilities, regulators aren\u2019t going to cut you any slack.","saveContent":"Organizations are increasingly coming to rely on software as a service, replacing applications that have previously been hosted on-premises.In April, for example, Gartner predicted SaaS global revenue <\/a>would grow 18.5 percent over 2018 to more than $94 billion this year and that, by 2022, it would grow to $143.7 billion. And while there are many benefits to a SaaS approach\u2014lower costs, no on-premises equipment or software to operate, no updates or patches to manage\u2014it does raise significant questions around compliance with GDPR, HIPAA, Sarbanes-Oxley and other regulatory schemas that govern company data. So, who owns the data? Who has responsibility for compliance? And what questions should customers ask a potential SaaS vendor to determine whether their data will be compliant in their service?Let\u2019s address data ownership first. When it comes to security (and security is an important part of compliance) SaaS services typically operate on a shared responsibility model. The provider takes responsibility for securing its own infrastructure and environment, while the customer is responsible for ensuring access to the service is locked down.This model extends to data protection and backups, where the provider protects the platform against catastrophic failure or breach, but when it comes to discrete recovery of individual items due to events such as accidental deletion, that\u2019s up to the customer. Inside The Hackathon At The Yahoo! Inc. Mobile Developer Conference<\/bsp-image>Nevertheless, from a practical point-of-view, the short and simple answer is: you own the data. The vendor may store and process it for you, but, ultimately, you\u2019re responsible for ensuring that data is compliant with all relevant regulations. If the vendor fails, you could be on the hook for fines, other penalties and damage to the organization's brand.Compliance is an enormous topic, so we\u2019ll just hit the highlights of the measures you should take when it comes to SaaS data.Data protection<\/b>A recent study from 451 Research<\/a> shows that nearly three-quarters of organizations either depend on the vendor to protect their data or have no protection for SaaS data at all. That\u2019s a terrible position to be in, because if someone accidentally deletes data or the SaaS vendor suffers a catastrophic hack or natural disaster, your data could be gone forever. You need to take responsibility to ensure it is protected, especially for sensitive data such as financials, health or personally identifiable information, and even emails or texts that could be relevant in a court case. Thankfully, there are solutions to help you back up data in SaaS applications, and many are themselves SaaS-based.Data sovereignty<\/b>Many countries require that data produced or collected inside their borders be physically stored there. As such, it\u2019s important for end users to understand what SaaS data falls under these requirements and where your SaaS vendors will store it. Make sure to get documentation so you can demonstrate compliance, should you need to do so.Security<\/b>Be certain that your provider is taking proper security precautions to protect their own environment. If they have achieved SOC2 attestation, that\u2019s a great indicator, but, at minimum, ensure that they encrypt data stored in their systems. In the absence of an attestation or certification, you may have the vendor complete a vendor risk assessment which provides you more details about the underlying protections and controls in their system. Also, make sure they will contact you immediately if there is a breach on their side. GDPR requires that organizations notify individuals if their data was part of a breach within 72 hours. From your side, ensure that you\u2019ve locked down access for SaaS applications that store sensitive data. Your provider is responsible for securing their infrastructure, but it\u2019s on the end-user to control access.The right to be forgotten<\/b>This requirement from GDPR famously requires organizations to delete an individual\u2019s data if they request it. As such, make sure that when you delete data from your SaaS application that it is also permanently deleted from the infrastructure. There is some ambiguity about whether organizations are required to delete data from backups, but most experts believe this is not necessary to comply. That said, when you restore data, it\u2019s important to make sure that no data is recovered that should have been \u201cforgotten.\u201dDocumentation<\/b>If you\u2019re storing data that requires special treatment for compliance, make sure to obtain detailed documentation from your SaaS provider regarding their own compliance with HIPAA, GDPR, Sarbanes-Oxley, PCI DSS 3.0 and any other schemas that may apply. Compliance in an as-a-service world doesn\u2019t have to be any scarier than on-premises compliance. In fact, in some ways, it can be much easier, with the provider taking responsibility for many functions. But it\u2019s critical to do a lot of vetting up front to ensure you\u2019re working with a strong provider. After all, ultimately, the buck stops with your organization. If you entrust sensitive data to a SaaS provider that doesn\u2019t live up to their responsibilities, regulators aren\u2019t going to cut you any slack.","order":0,"get_parent":{},"attributes":[],"attributesType":{"content":{"type":"string","source":"raw"},"lock":{"type":"object"}},"dynamicContent":""}]

How data compliance challenges emerge in an as-a-service world

More for you