security requirements are met and providing a single point of contact for the various security-related communications likely to occur between the organization and the cloud, while developing new, and integrating existing, strategic company goals.

14.2.2  Data Classification

Assuming that an organization is subject to at least one of their industry-specific regulations or laws, they will be required, at a minimum, to demonstrate some semblance of control over its IT resources, quite likely predicating the existence of an information security program. To meet regulatory obligations, an organization needs to understand the information assets and their related security requirements, which can only be achieved by doing something that most companies try to avoid: proper classification and labeling of their data.

14.2.2.1  Classifying Data and Systems

The exercise of classifying data is incredibly important when looking at allowing others access. An organization needs to be able to provide the security requirements surrounding the data in question at any given point, especially if considering granting another entity the custodianship over said data. This exercise also provides an organization with the ability to pick and choose which data they will provide to outsourcers – and more importantly, which to exclude. By limiting the inclusion of government classified PII or PCI data, for instance, the requirements related to the security of the hosting systems become remarkably more relaxed. Presumably, each of these classifications would have unique and distinct security requirements needed to be passed onto the cloud provider. Reducing those requirements would likely substantially reduce the cost of using the cloud in general, although it may also limit the systems and data the organization possesses from being outsourced. Classification of data and systems will likely lead to a cost-benefit analysis with respect to the use of the cloud as a better understanding of the metadata may reveal shortcomings in the existing security architecture. Knowing what an organization sends to the cloud can help set the expectations on how a provider is required to protect it.

14.2.2.2  Specific Type of Data of Concern

Understanding the requirements of the data is paramount to appropriately securing it. Aside from Personally Identifiable Information, Payment Card Industry data, and the myriad regulations with which an organization would need to be concerned, there are many other types of relevant data to be taken into account.