Use of Third Party and Cloud Services

You probably know best the type of information that the cloud service provider will have. The cloud service provider may post other privacy information on their site as “Privacy Policy” or in “Terms of Service” or in Support/FAQs. Review of news items may indicate past privacy issues. For more information, contact privacy@ucsc.edu.

• Does the provider have a privacy policy?
• How might UC or individuals be harmed if the information the cloud provider was storing or had access to was compromised?
• Can you as the user remove or delete your information or account with the cloud service provider?  Is there a tool to export your information?
• If you remove or delete your information, does the cloud service provider retain any rights to continue storing or using your information?
• How long does the information remain with the cloud service provider (in online and offline storage), including after you delete it or your account?
• Under what circumstances will the cloud service provider access content or restrict service without your consent as the user?
• Will your information be used by, shared with or sold to a third-party?  Is that inconsistent with why you gave the information to the cloud service provider?
• Will the cloud service provider respond to requests for your information from government officials or law enforcement?
• Does the cloud service provider have a history of regulatory or legal findings related to privacy?

Answering Yes to any of these questions indicates some risk in the use of the cloud service and that a contract or another service should be considered. For more information on contracts, contact buy4me@ucsc.edu.

You probably know best the type of information that the cloud service provider will have. The cloud service provider may post other security information on their site as “Security” or in “Terms of Service” or in Support/FAQs. Review of news items may indicate past security issues. For more information, contact itpolicy@ucsc.edu.

• Will the cloud service provider have non-public (P2-P4) information?
• Will the cloud service provider have social security number, driver’s license, health, insurance or financial information?
• Are there any compliance requirements for the information, e.g. credit cards (PCI) or health information (HIPAA)?
• Are there export-control restrictions on the information that preclude storing it internationally?
• Will student information be stored or accessed by the cloud service provider?
• Does the cloud service provider have a security plan or provide information about their security controls?
• Has their security plan been mapped or certified to any security frameworks?
• Has the cloud service provider been audited by a trustworthy and certified third-party?  Is there an available SOC report?
• Will the cloud service provider contact you, the user, if there is a breach of information or passwords?
• How will they contact you if there is a breach of information or passwords and in what timeframe?  
• Does the cloud provider have a history of security breaches or other regulatory or legal findings related to security?

Answering Yes to any of these questions indicates some risk in the use of the cloud service and that a contract or another service should be considered. For more information on contracts, contact buy4me@ucsc.edu.

You probably know best how you intend to use the cloud service. The cloud service provider may post other information on their site in “Terms of Service” or in Support/FAQs. For more information, contact buy4me@ucsc.edu.

• Does the cloud service provider claim any rights of ownership to your information?
• Does the user or the University retain rights, e.g. to intellectual property or copyright?
• Does the cloud service provider restrict your rights for research publication, e.g. how their service is presented?
• Might your use of the service create liability for the University?
• How might UC or individuals be liable if the information the cloud service provider was storing or had access to was compromised? Who is liable for the impact if information is compromised or breached?
• Will you use the cloud service for a business critical function?
• Does the cloud service provider have service levels that promise availability?  
• Do you have an exit strategy in case the relationship with the cloud service provider needs to be terminated?  Is there a tool to export your information?
• Is there an acceptable use policy and are there any restrictions of use that may conflict with your anticipated use?
• Might the cloud service provider censor your activity based on the acceptable use policy?
• Is there a charge for the cloud service?  What is the history of price increases? How are you notified?
• Will you be affected by changes to the service?  How does the cloud service provider notify you of changes?

Answering Yes to any of these questions indicates some risk in the use of the cloud service and that a contract or another service should be considered. For more information on contracts, contact buy4me@ucsc.edu.