Barriers to UC Cloud Success, Part 2

Non-technical issues may be greater than most enterprises and their IT staff may anticipate when subscribing to Unified Communications and collaboration (UC) cloud services. This is the second of two TechNotes on implementing UC cloud services. The first TechNote, "Barriers to UC Cloud Success, Part 1," focused on the business case for the UC cloud service and the terms of the cloud service agreement. This second TechNote focuses on protecting enterprise data, accessing emergency services, and telecom regulations that may limit international UC coverage.

Two of the fears encountered by enterprises when they consider the cloud is how well secured is the data stored in the cloud and can the transmissions be monitored. Ensuring security and privacy of the information that passes through and/or is stored in the cloud are continual problems for the enterprise. In addition, there are federal and state industry specific regulations and compliance requirements that have to be satisfied. The legal responsibilities and liabilities of the UC cloud service provider and enterprise need to be fully documented. In this age of virtualization it is difficult to determine where data is located and what legal requirements are in force where the data is stored. 

Here is an issue that almost every enterprise may not plan for except maybe the lawyers. What if a government agency subpoenas data of another enterprise sharing the same virtualized UC cloud service? There has been more than one case where the FBI confiscated all the servers and storage systems because it could not isolate the subpoenaed data. This created a situation where the other service subscribers could no longer access to their data. For intents and purposes, the stored data was lost. How is the enterprise protected in this case is part of the legal agreement? 

Enterprises are accountable for their data and cannot contract their compliance requirements to a third party. In another situation, the provider was asked to deliver data as part of a court case. The provider could not comply. The provider and the enterprise where both fined and the enterprise lost their court case, because the enterprise could not produce relevant data to support its legal position.

There are ways to mitigate these problems:

Do not exempt the provider from supporting emergency conditions and handling 911 and E911 calls. 911 is national in scope. E911 is state regulated. There are enough state regulatory differences so that one E911 location requirement will not fit all locations. For example, the physical area covered from an E911 call may range in size from 7000 to 20,000 square feet depending on the state regulation. 

These calls present challenges for the provider. There is the safety of employees, contractors, and visitors to be ensured. Inadequate emergency response actions may lead to tort liability. Finally there is the technical design to meet the requirements.

The cloud service agreement should accurately and completely define the enterprise and provider responsibilities. The costs may not have been factored into the into the original service quotation. There are third party 911 and E911 services that may have to be part of the UC cloud implementation but are not part of the UC cloud provider's agreement with the UC provider and the 911/E911 providers limiting their individual responsibilities. If the 911/E911 solutions are too expensive or do not meet the regulatory requirements, then the enterprise may have to:

Providers would prefer not to accept the emergency responsibilities. Look for disclaimers in the contract that assigns the burden solely to the enterprise. Some disclaimers will probably exist for the provider concerning death and personal injuries.

It would be unusual that the features and functions provided by the cloud service will be illegal in the U.S. International UC support may encounter other country's legal requirements such as the location of stored information. It is also possible that encrypted transmissions may not be allowed. 

The enterprise should know in advance where the communications may geographically take place. Does the provider have the proper authority to offer the services in another country? Other considerations include:

Many enterprises want to try UC in the cloud. It is inevitable that some enterprise UC cloud implementation will occur such as video conferencing. Knowing what to look for when investigating and then contracting for cloud services can only lead to a better level of service and ultimate success.