Company Docs in the Cloud: the Risks and Rewards

Sandra Gittlen

A Boston area freelance business and technology writer, Sandra Gittlen also contributes to Computerworld, Network World and other publications. She also moderates webcasts and leads programs on topics such as virtualization, cloud-based infrastructure and services, disaster recovery and data security. She is a graduate of the University of Wisconsin-Madison with degrees in Political Science and International Relations. She can be contacted at sandra@slgpublishing.net.

DropBox, GoogleDocs, Microsoft Office 365, SkyDox … the field of companies urging you to put your documents in the cloud is growing by the minute. Appealing as this concept might seem, CFOs and IT teams have to take a step back and evaluate the benefits and risks.

The pros for a cloud-based strategy, through which corporate users access their data in the cloud, are easily enumerated:

1. Less in-house infrastructure to procure, configure, deploy, manage and maintain.
2. Data is available regardless of desktop or mobile platform.
3. Placing data in a central location, in some cases, promotes collaboration.

Costs are predictable as they are based on monthly or yearly per-user subscription fees. 

Sounds fabulous, right? The problem with these services comes when users are encouraged or allowed to sign up for them individually. Suddenly, their data is siloed in the cloud, and if the employee leaves or is terminated, you have no access to it. Also, if you are subject to an audit that requires review of the content posted to the cloud, getting to it will require employee cooperation.

If you decide to go with a cloud-based management service for your documents, there are several things you must do first.

• Assess the risk. Who will be putting what in the cloud? If you examine roles and the content they generate, you might find it is just too dangerous for them to use the cloud for document storage and sharing. For instance, if researchers are working on highly sensitive projects that will result in future revenue streams, you probably don’t want that information off-site.
• Investigate the level of security the service provider guarantees. Depending on what you are sending to the cloud, you’ll want a certain assurance of protection. Make sure that if the provider fails to meet their security SLAs, there are repercussions. (). Also, take the time to match your compliance mandates, such as customer privacy, with the provider’s capabilities.
• Test-drive group policies and central controls. A cloud strategy won’t be effective if you can’t manage user policies from a single, central console. You’ll want to be able to assign role-based access, limit sharing, and conduct audits. If an employee leaves the organization, you must be able to change their passwords and lock down their content so they can’t copy it or erase it. Before you sign on the bottom line, pilot each of these actions yourself.
• Look into backup and disaster recovery processes. Having a place to store documents is all well and good, but does the service provider back up what is stored? And can you access those backups? What is their disaster recovery timeframe? If the provider promises to be back up within a day, but your data is needed for real time business such as finance or health care, then that is not the provider for you. There is a potential that you’ll have to pay more for a better tier of service so think about your recovery needs.
• Plan out your exit strategy. Initially, you might allow a department or two to sign on with a cloud-based document service. Then, costs or risk might dictate that data come back in house. Or the provider might shut its doors. How are you going to get the volumes of data you’ve put into the cloud back to your data center? Get the provider’s plan in writing and regularly drill that scenario. You don’t want to find out that it’s impossible once it’s too late.

Tags: cloud computing, document management, risk management