SaaS Security: Scrutinizing the Security Terms of Cloud Vendor Contracts

Numerous surveys and reports have found that the biggest worry businesses have today about adopting cloud/SaaS technologies is security.  For example, security is reported as a top concern by analysts like IDC, Gartner, and Forrester.

With concerns around security high, it is no wonder that businesses are carefully scrutinizing the terms describing security in their cloud and SaaS contracts.  Unfortuantely, they’re usually not happy with what they’re seeing.  Gartner found that 80 percent of IT procurement professions are not satisfied with the language that describes security in their SaaS contracts.

Alexa Bona, vice president and distinguished analyst at Gartner, said that “We continue to see frustration among cloud services users over the form and degree of transparency they are able to obtain from prospective and current service providers.  As more buyers demand it, and as the standards mature, it will become increasingly common practice to perform assessments in a variety of ways, including reviewing responses to a questionnaire, reviewing third-party audit statements, conducting an on-site audit and/or monitoring the cloud services provider.”

The Gartner report found that “nearly all contracts have a force majeure clause that excludes several forms of catastrophic incident.  If a failure simultaneously affected 1,000 customers, and each was entitled to $2 million of compensation, it would amount to a total payout of $2 billion. Ask service providers what their total liability would be in the case of a failure impacting all of their tenants, and demand evidence of adequately underwritten insurance.”

What should customers look for in their SaaS contracts?  TechRepublic reports that Gartner recommends the following:

• Audits – Annual security audits should be made that are backed by third-party certification.  The findings should be available.
• Security and Recovery – Contract SLAs should include  language about recovery times, recovery point objectives and data integrity.  Penalties should kick in if the SLAs are missed.
• Written Commitments – Contract language should address security measures, protection from third party attacks, and vulnerability testing.
• Compensation and Penalties – Ideally the contract should provide meaningful compensation for lost security, service or data.  This is often missing in many of today’s contracts.

Despite anxiety around security, it doesn’t seem to be holding back businesses from signing onto cloud contracts.  Gartner estimates that the SaaS market is growing at an unstoppable rate — from $14.5 billion in 2012 to more than $22 billion in 2015.