| Encryption in Transit |
Expected
Transport Layer Security (TLS) should protect web access, application programming interfaces (APIs), and file transfers. TLS 1.2 or later is a practical minimum for current deployments.
|
Review the provider’s encryption documentation, supported protocol settings, certificate-management process, and any independent security assessment.
|
Protects files and credentials from interception while data moves between users, offices, applications, and international regions.
|
| Encryption at Rest |
Expected
Stored data should use strong encryption such as AES-256 or an equivalent industry-accepted standard. Encryption should cover primary storage and backups where applicable.
|
Confirm the encryption scope, key-management method, key-rotation controls, separation of customer data, and treatment of temporary storage.
|
Reduces exposure if storage media, backups, or an underlying infrastructure component is accessed without authorization.
|
| Identity and Access Management |
Expected
Multi-factor authentication, role-based access control, least-privilege permissions, single sign-on support, and administrator activity logging should be available.
|
Request access-control documentation, sample audit-log fields, privileged-access procedures, session controls, and the process for disabling departing users.
|
Limits unauthorized access across distributed teams, contractors, resellers, and administrators operating in different countries.
|
| Security Monitoring and Incident Response |
Expected
Continuous security monitoring, documented incident-response procedures, vulnerability management, and a defined customer-notification process should be in place.
|
Review the incident-response policy, escalation contacts, vulnerability-disclosure process, notification commitments, and summaries of independent testing.
|
Enables faster containment and clearer communication when a security event affects users or regulated information.
|
| Independent Assurance |
Strong Indicator
Look for a current ISO/IEC 27001 certificate, SOC 2 Type II report, or comparable independent assurance. These frameworks assess different requirements and should not be treated as interchangeable.
|
Verify the certificate or report validity, audit period, scope, covered services, exceptions, and any complementary customer responsibilities.
|
Provides third-party evidence that security controls are designed and, in some cases, operating effectively over a defined period.
|
| Privacy and Data-Processing Terms |
Expected
A clear data-processing agreement should define processing instructions, confidentiality, subprocessors, security measures, assistance obligations, deletion, and return of data.
|
Review the data-processing agreement, subprocessor list, change-notification process, international-transfer terms, and data-subject request procedures.
|
Helps buyers assign responsibilities and manage privacy obligations when personal data crosses borders or is handled by subcontractors.
|
| Regional Data Residency |
Business Requirement
The provider should identify where primary data, replicas, metadata, logs, and backups are stored and whether customers can select approved regions.
|
Request a current region map, replication description, backup-location policy, data-transfer mechanism, and written confirmation of residency options.
|
Supports contractual, sector-specific, and jurisdictional requirements that restrict where certain information may be stored or processed.
|
| Privacy Regulation Readiness |
Verify Scope
For European operations, assess GDPR-related roles, processor obligations, breach assistance, and international-transfer safeguards. Other jurisdictions may impose separate privacy requirements.
|
Examine the privacy notice, processing terms, transfer safeguards, retention controls, deletion workflow, and response commitments for data-subject requests.
|
Prevents buyers from assuming that a general security certification automatically proves compliance with every privacy law.
|
| Backup and Disaster Recovery |
Expected
Backups should be encrypted, access-controlled, geographically appropriate, regularly tested, and protected against accidental deletion or ransomware where feasible.
|
Request backup frequency, retention periods, restoration testing results, recovery time objective, recovery point objective, and disaster-recovery test cadence.
|
Reduces the operational impact of hardware failures, human error, regional outages, malicious deletion, and other disruptions.
|
| Availability and Resilience |
Measure
Evaluate published service-level commitments, redundancy design, maintenance procedures, status transparency, and historical performance rather than relying only on marketing claims.
|
Review the service-level agreement, service-credit terms, status-history records, architecture overview, and exclusions for scheduled maintenance or customer-caused incidents.
|
Helps global teams estimate disruption risk when users depend on storage across multiple time zones and business regions.
|
| Data Retention and Secure Deletion |
Expected
The service should support configurable retention, legal-hold handling where required, customer-controlled deletion, and secure disposal of data and media at end of life.
|
Confirm deletion timelines, backup-expiration rules, retention exceptions, media sanitization standards, and the availability of deletion confirmation.
|
Limits unnecessary exposure, supports records-management policies, and reduces risks after account closure or contract termination.
|
| Compliance Fit for Regulated Data |
Use-Case Specific
Payment Card Industry Data Security Standard (PCI DSS) applies to environments handling payment-card data. Health information may require additional contractual and regulatory controls, depending on jurisdiction.
|
Request the relevant attestation or shared-responsibility statement, confirm service scope, and identify controls that remain the customer’s responsibility.
|
Prevents costly gaps caused by assuming that a storage service’s certification covers the buyer’s entire application, organization, or regulatory obligation.
|
| Vendor and Subprocessor Governance |
Expected
The provider should maintain a documented supplier-risk process, publish subprocessors, assess critical dependencies, and provide reasonable notice of material changes.
|
Review the subprocessor register, supplier-assessment summary, change-notification terms, audit rights, and exit-assistance provisions.
|
Makes hidden dependencies visible and helps buyers manage compliance obligations throughout the service supply chain.
|
| Portability and Exit Planning |
Expected
Data should be exportable in documented, commonly usable formats without unreasonable technical or contractual barriers. Exit procedures should address metadata, versions, logs, and backups.
|
Test a sample export, review API and transfer limits, confirm export fees, check deletion after migration, and document the expected transition timeline.
|
Reduces lock-in and supports business continuity if pricing, regulatory requirements, service quality, or regional needs change.
|
Overwhelmed? We're here to help.
