1. Cyber Security and how to safeguard data in the ‘Cloud’ Claire Jacques 21 April 2016

2. Cyber Security Risk Cyber risk increasing at unprecedented rate Cyber attacks Criminal State sponsored Hacktivism Insider

3. Cyber Security – legal framework UK Government Cyber Strategy – Cyber Essentials Legal Framework Data Protection Act 1998  “Appropriate technical and organisational measures”  Data Security breaches – ICO Fines EU General Data Protection Regulation

4. Cyber Security – managing cyber risks Best practice steps Risk assessment across the whole business Understand EU-wide legal/regulatory obligations and adopt government cyber security recommendations Disaster recovery and business continuity Employees - security policies and procedures, promote risk management and incident reporting, training and monitoring Check insurance cover (specific cyber insurance) Ensure obligations to meet cyber security measures are passed on in supplier contracts

5. Typical Cloud Contract “Take it as it is” Ability for the supplier to unilaterally vary the scope of services and associated policies Right for supplier to terminate or suspend provision of services on short notice Limited (if any) warranties Little (if any) coverage for IP infringement claim Very low limits of liability Limited service levels, no associated service credits or termination rights

6. The Customer fights back! 1.Data loss and data liability 2.Service Levels 3.Security requirements 4.Lock in and exit 5.Data migration, deletion and return 6.Unilateral service changes 7.Intellectual property rights

7. Checklist for cloud customers Is the infrastructure multi-layered and, if so, in what way? Where will your data be processed (including storage/replication)? Who controls the critical infrastructure (and from where)? How easily can third parties get access to your data? What happens if the cloud provider / their provider goes bust? How easily could you move your data to another cloud service (or back to your own systems) and how long would it take?

8. Any Questions? Claire Jacques Senior Associate Commercial/IT – Business Services BrookStreet des Roches LLP 01235 836643 07805 819854 Claire.jacques@bsdr.com