How to Spot a Good Cloud Provider – a Simple Checklist
How to Spot a Good Cloud Provider – a Simple Checklist
When choosing a cloud service, many people ask the same question: how can I tell whether a provider is a good fit for me? Germany's Federal Office for Information Security (BSI) has published criteria catalogues for this, for example C5 for information security and C3A on the question of how self-determined you can be when using a cloud service. These catalogues are mainly aimed at providers and larger organisations. But you can easily use the ideas behind them for yourself.
Briefly explained: C5 and C3A
- C5 (Cloud Computing Compliance Criteria Catalogue) sets out security requirements for cloud services. Many providers have themselves audited against it.
- C3A deals with criteria around sovereignty – for example where data is stored, who can access it and how easy it is to switch.
As a small business, you don't need to work through these catalogues. The checklist below picks up the most important ideas.
The checklist
| Question | What to look out for |
|---|---|
| Where is my data? | Country and data centre should be clearly stated |
| Who else processes it? | A list of subprocessors should be available |
| How secure is the service? | Certificates or attestations, such as ISO 27001 or C5, are a good sign |
| Are there backups? | What is backed up, how often, and how does restoring work? |
| Can I switch? | Export in open formats, clear notice periods |
| How do I reach support? | In your language and time zone? |
| Is the software open? | With open source, you can switch providers without switching software |
Why open source scores here
One big advantage of open source is freedom of choice. Nextcloud, Element or Vaultwarden run with lots of different providers – or on your own server. If a provider no longer suits you, you can simply keep running the same software somewhere else. Your data, your habits and your apps stay the same.
With open source, you also decide for yourself:
- which data centre the software runs in,
- how often backups are made,
- who has access to the server.
For law firms and practices
Especially if you work with confidential or sensitive data – as a law firm, tax office or practice – it's worth going through the checklist calmly. If you're unsure which requirements apply in your field, it's best to ask your professional chamber, your data protection adviser or a lawyer.
A few terms, briefly explained
- Attestation: Confirmation by independent auditors that certain requirements are met.
- ISO 27001: An international standard for information security management systems.
- Subprocessor: Other companies a provider uses for its service, for example a data centre.
- Data portability: The ability to take your data with you in a common format.
An everyday example
An occupational therapy practice is looking for a provider for shared file storage. It compares two offers using the checklist:
| Question | Provider A | Provider B |
|---|---|---|
| Data location | Germany | "EU" without further detail |
| Subprocessors | public list | on request |
| Certificate | ISO 27001 | none mentioned |
| Export | WebDAV, normal files | individual downloads only |
| Support | German, by phone | English, by ticket |
Both offers could work. The practice chooses A because it gets all the answers there quickly and clearly. That's exactly the point: the checklist makes the decision easier and easy to explain.
Tip: keep the answers
Store the providers' answers together with the contract. That way you have everything to hand when clients ask or when you update your data protection documentation.
Conclusion
A good cloud provider is transparent: it tells you where your data is, who's involved and how you can get out again. With open source, you also keep the freedom to switch at any time. If you'd like support with choosing, have a look at Consulting.
If you'd like to give it a try, I'm happy to help – just drop me a line.
IT Security in Healthcare – What Practices Can Learn from Hospitals
Hospitals invest a lot in secure IT. The ideas behind it and how small medical practices can benefit too, with open source.
Schleswig-Holstein Goes Open Source – What Small Businesses Can Learn
The German state of Schleswig-Holstein is moving its administration to open source step by step. A great example small businesses can learn a lot from.