Is Your Financial Institution’s Data Safe in the Cloud? FFIEC Issues Joint Statement on Cloud Computing

As with any data management model, cloud computing comes with varying degrees of risk associated with possible security breaches. It is crucial that financial institutions understand these risks and what to look for when selecting a cloud provider. 

• Understanding the risk – Financial institutions should understand the risk they are accepting when choosing a cloud provider. A risk-based due diligence process is critical in vetting out vendors that do not meet the organization’s risk appetite. Not every vendor used by an institution is “critical,” with most institutions reserving this risk rating for only those services that impact transaction operations. Cloud providers should be able to provide due diligence documents, such as a System and Organization Controls (SOC) report, certificate of cyber liability insurance, penetration testing summaries, and financial statements. Vendor oversight should be ongoing and documented, with critical vendor re-evaluated annually, or as needed.  
• Know your data is secured – When working with cloud providers, it is critical to understand where your data is, how it is being secured, and what happens to customer data when services are ended. Even if a third party is hosting your data, it is still the institution’s data and your responsibility to perform adequate due diligence to gain assurance that this data is appropriately secured. Ask your cloud service providers about data encryption at rest and in transit, datacenter location, backup and redundancy, and data destruction. Also, be aware of data ownership and ensure any contracts with cloud service providers specify your continued ownership of the data requirement to securely dispose of your data at the end of the relationship. 

• Understand User Responsibilities – Understand your responsibilities to mitigate risk as a user of cloud services. Be sure your contract defines service level expectations and control responsibilities. User entity control considerations (UECC) are often included in a service provider’s SOC report and should be considered and implemented by the institution as a user of the service. For example, user access controls, such as configuring employee accounts and assigning roles within the cloud service, are typically the institution’s responsibility to manage. Ensuring you understand this responsibility alleviates control gaps and helps to mitigate risk to your environment.  
• Audit and Control Assessment – Leverage third-party attestation reports from your cloud service provider to gain assurance of the effectiveness of the control environment hosting your data. When reviewing a vendor’s SOC Report, or penetration testing, pay attention to any findings or exceptions noted in the report. These findings could be an indicator of a weak control environment and should be addressed by your vendors.