Clouds on the information horizon: how to avoid the storm: cloud-based solutions, such as web-based e-mail, have many advantages. But organizations must be aware of the compliance issues related to storing their information outside of their own control.

• Author: Gatewood, Brent

[ILLUSTRATION OMITTED]

While much has been written about cloud computing, there has been little focus on the implications for applying records management rules to information stored in the clouds. Without that understanding, organizations cannot make informed decisions about using these resources. This understanding begins with a couple of definitions.

Generally, clouds are large collections of easily usable and accessible virtualized resources (i.e., hardware, development platforms, and]or services). These resources can be easily reconfigured to match varying service demands (loads) allowing the service provider to adjust for optimal resource utilization. A few examples include resources offered by Amazon, Google, and IBM.

There is an interdependence between cloud computing and software-as-a-service (SaaS). SaaS, which is commonly defined as a software delivery method that provides access to applications and functionality through remote access to a web-based service/infrastructure, typically operates in the cloud. With SaaS, applications are not owned by the user; access and use are licensed for a defined period of time from an application service provider. This can save the licensing organization money for software, hardware, support, and maintenance.

This article relates to records and information being stored in a SaaS/cloud environment--whether created in an organization's captive environment or outside of its in-house computing systems. Information in the cloud resides in server farms and data warehousing facilities that may be spread throughout the country or even globally. Even though an organization may be doing business with a vendor down the street, its data may be stored many states away- or even in a different country.

As vendors identify needs and applications in the market and rush to develop and present cloud-based solutions, their ideas may not be fully developed or include records management rules-based control.

Not knowing where their information is stored and not having records management control over it are two major compliance concerns for organizations storing their records in the cloud environment.

Typical Cloud Matter

The number and variety of cloud-based applications is growing rapidly, and many organizations either already use a SaaS solution or are considering one. Following are some of the most common types of solutions.

Communications

Communications are a natural fit for cloud computing solutions because they almost uniformly rely on the same basic infrastructure- the Internet. E-mail and instant messaging rely on the Internet for their delivery--and as such, it makes sense that email was one of the first solutions to be offered in the cloud.

Having communications hosted by a SaaS provider has many benefits to an organization, especially because email is one of the largest consumers of technology resources in most organizations. Outsourcing some or all e-mail infrastructure can free IT/IS resources for tasks more central to the organization's business. However, due to e-mail's pervasiveness, many of an organization's records and a substantial amount of risk reside in e-mail; managing these records and associated risks in the cloud can be problematic.

Document Management

Many organizations are also experimenting with some form of document management in the cloud. These applications range from ad hoc repositories for external access to very specific point solutions for defined departments and document sets. Typically the level of control surrounding the application and content rises as the solution becomes more narrow and specific to a task or function. More generalized implementations typically have fewer controls compared to highly specialized point solutions.

Structured...