Before signing-up to use a Cloud hosting or backup services provider, it is really important to determine who is the best supplier for your needs. Here are some suggested questions to ask to help you decide if they are the best supplier for your needs.
Please note that this is not an exhaustive list – it is to help get you started – make sure you tailor it to your organisation’s requirements.
.
Data location
- Where will my data be located?
- Do you distribute your systems or load balance in such a way that my data could reside in a different jurisdiction? If so, where are these jurisdictions?
- If you perform backups, where is the location of the backup storage site?
For more information about data jurisdiction and why it matters, click here.
.
Security of your data
You must ensure that the service provider will protect your data. The security of your backups needs to at least match the security you place around your client data. Imagine you want to steal a company’s data – targeting the backup media would be so much easier that trying to hack into individual systems and copy data from them.
As a real-life reminder of this, In August 2010, the UK’s Financial Services Authority (FSA) hit the UK arm of Zurich Insurance with a record £2.275 million fine for the loss of a backup data tape containing the details of 46,000 clients.
- Describe the physical security of your data centres.
- Is my data encrypted on your systems?
- What level of encryption is used?
- Who can decrypt it and who has access to the decryption keys?
- Who has access to my data?
- Are your backups encrypted when stored on media?
- What level of encryption is used for the backup media?
- For the backup media, who can decrypt it and who has access to the decryption keys?
- Is the backup media securely stored in a site other than the live hosting site?
- Where is the location of the backup media storage?
- Does the site used for backup media storage have the same physical and logical security as the live hosting sites?
- If the backups are transported from one site to another (such as a courier), what physical security is used?
- If my backups are transmitted to another site, are they encrypted during transmission?
- What level of transport encryption is used?
.
Service continuity
- What is your business continuity and disaster recobery strategies?
- How many different power sources supply your hosting site?
- Do you have UPS protection with automatic cut-in in the event of a power failure?
- Do you have generator protection with automatic cut-in in the event of a power failure?
- How often do you test the UPS and generator?
- When was the last time your hosting site suffered a complete loss of power?
- When was the last time that one of your clients suffered an outage due to the loss of power?
- Do you have an alternative hosting site that you can automatically switch to in the event of an issue?
- How many different and diversely routed Internet connections do you have?
- In the event of an Internet service providers connection failing, can all your services be provided on the other Internet connection(s)?
- When was the last time your hosting site suffered a complete loss of Internet connectivity?
- When was the last time that one of your clients suffered an outage due to the loss of Internet connectivity?
- Is your Internet connectivity protected from DOS or DDOS type attacks?
- Have you experienced a DOS or DDOS type attack and how were your clients impacted?
- If your service (including your hosted clients and applications) is attacked/hacked in any way, how quickly do you inform me and how is it reported?
.
Backup related questions
- Are yours systems backed-up?
- Is my data backed-up? (This may seem like a bizarre question, but if your provider suffers a major systems failure, you could lose your backups that you need for legal of regulatory purposes).
- How often is my data backed-up?
- What is the backup retention policy?
- Can I determine the backup retention policy of my data?
- What media is it backed-up to? (Remember this could be disk-to-disk).
- If backup is to disk, is this storage on completely separate infrastructure and in a different location to the hosting service? (This question is if you are looking at using a backup service from the same hosting provider).
- How often is testing performed of recovering your systems from backup media?
- How often is testing performed of restoring data from backup media?
- Can I copy my backups to an external source?
- Can I perform an ad-hoc backup when I need to? (For example, before a significant system change).
- Can I restore an individual object (such as a file) from a backup?
- Are ‘open file’ backups supported?
- Are my e-mail system(s) supported?
- Are the database(s) that I use supported?
- Do you support incremental backups?
- Can I select whether I perform a full or incremental backup?
- If a send/receive of data to/from yourselves should fail, is there a ‘transmit from failure point’ option or will it start at the beginning again?
- Who has access to my backed-up data?
.
Accessing data
- How do I send you my data in order to get started?
- What level of transport encryption is used?
- How do I access my backed-up data?
- How quickly can I get access to my backed-up data?
- Do you object to my company or an independent technical auditor from validating the backups on a regular basis?
- If necessary, is it possible to transport large backups on physical media to aid a fast recovery?
- Is it possible to perform data mining on my backup data (for example in legal data discovery), or do I need to restore it to my systems first?
.
Cost of service?
- How do you charge for the hosting service?
- How do you charge for the backup service? (Make sure you calculate the likely tariffed cost for the service, taking into account your data volumes, backup frequency and retention period).
- Is there a charge for each system I backup from (such as backup agent software).
- Is there a charge for accessing or restoring backed-up data?
.
General questions?
- Are your services and those of your sub-contractors/partners, SAS70 compliant?
- Do I retain exclusive ownership of my data at all times, including after the end of a contract?
- Do you own and run your own data centres? If not, please give details of the underlying service provider.
- What accreditations does your organisation have?
- Has your organisation won any awards relevant to the service to be provided?
- What type of employee/contractor/services provider screening do you perform before you hire or contract with them?
.
Also read this….
.
And finally….
A key indicator of a providers service will be how they respond to your questions. If you have an open dialogue with them, it’s a good sign.
Remember that a supplier’s pre-sales service is nearly always better than after-sales …. so if you’re not happy before you sign-up – don’t do it !
.
.
Resources for CIO and COO Professionals
Remember to bookmark the following ….
- CIOCOO.com
- add CIOCOO.com/feed/rss/ to your RSS feed
- and follow twitter.com/timbullock/ on Twitter
For more information, contact 
For copyright details, refer to http://ciocoo.com/legal/copyright/
For terms of use, refer to http://ciocoo.com/legal/terms-of-use/
© Copyright Tim Bullock 2010
