1. Page 1 Recording of this session via any media type is strictly prohibited. Page 1 The Cloud: A Necessary Risk for Business

2. Page 2 Recording of this session via any media type is strictly prohibited. Toby Merrill ACE Group, Division SVP ACE Global Cyber Risk Practice Anthony Caratzas Broadridge Financial Solutions Managing Director, Risk Management Vinny Sakore ICSA Labs, a division of Verizon Program Manager, Cloud Services David Navetta, Esq. CIPP Information Law Group, Partner

3. Page 3 Recording of this session via any media type is strictly prohibited. What to Expect What is Cloud Computing and Should Risk Managers Care? How Can Cloud Computing Benefit Business? What are the Risks of Migrating to the Cloud? Making the Cloud Work for Your Company

4. Page 4 Recording of this session via any media type is strictly prohibited. CFO RoundTable News, CFOs and CIOs Can Keep Up With Business’ Growth With Cloud Computing, 2013 http://www.thecforoundtable.com/news/bid/327086/CFOs-and-CIOs-Can-Keep-Up-With-Business-Growth-With-Cloud-Computing http://www.thecforoundtable.com/news/bid/327086/CFOs-and-CIOs-Can-Keep-Up-With-Business-Growth-With-Cloud-Computing

5. Page 5 Recording of this session via any media type is strictly prohibited. IRDC 3 DMW, Cloud Computing, 2013 http://www.c3dmw.com/IRDC3DMW/CloudComputing.jsp http://www.c3dmw.com/IRDC3DMW/CloudComputing.jsp

6. Page 6 Recording of this session via any media type is strictly prohibited. Mother Nature Network, Is cloud computing secure?, Photo: Shutterstock, 2012 http://www.mnn.com/money/sustainable-business-practices/stories/cloud-computing-secure http://www.mnn.com/money/sustainable-business-practices/stories/cloud-computing-secure

7. Page 7 Recording of this session via any media type is strictly prohibited. What is Cloud Computing? Visual Model of NIST Working Definition of the Cloud http://csrc.nist.gov/groups/SNS/cloud-computing/index.html http://csrc.nist.gov/groups/SNS/cloud-computing/index.html

8. Page 8 Recording of this session via any media type is strictly prohibited. What is Cloud Computing?

9. Page 9 Recording of this session via any media type is strictly prohibited. Should Risk Managers Care? Cisco UCS and EMC® VNX™ 5300 with Microsoft Private Cloud Fast Track 2.0, 2012 http://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/unified-computing/whitepaper_c11-711496.html http://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/unified-computing/whitepaper_c11-711496.html

10. Page 10 Recording of this session via any media type is strictly prohibited. How Can Cloud Computing Benefit Business? Adapted from Source: ©Teacher & Educational Development, University of New Mexico School of Medicine, 2005 Reduced Infrastructure Costs Capacity, Scalability and Speed Security and Backup Availability, Geography and Mobility Regulatory Compliance Other Benefits http://s1228.photobucket.com/user/thewindowsclub/media/cloud-computing.jpg.html#/user/thewindowsclub/media/cloud- computing.jpg.html?&_suid=139784972428108712990863256382

11. Page 11 Recording of this session via any media type is strictly prohibited. What are some of the Risks of Migrating to the Cloud? Adapted from Source: ©Teacher & Educational Development, University of New Mexico School of Medicine, 2005 Contracts Loss of Control Aggregation Risk Costs Data Security

12. Page 12 Recording of this session via any media type is strictly prohibited. What are Risks of Migrating to the Cloud? – In More Detail Adapted from Source: ©Teacher & Educational Development, University of New Mexico School of Medicine, 2005 Cloud Relationships Geography Privacy System and Data Availability Data Retention Incident response Electronic Discovery / Electronic Evidence

13. Page 13 Recording of this session via any media type is strictly prohibited. Making Cloud Computing Work for Your Company Adapted from Source: ©Teacher & Educational Development, University of New Mexico School of Medicine, 2005 Privacy by Design and Culture Shared Security and Related Responsibilities Control and Liability Due Diligence and Vendor Management Programs

14. Page 14 Recording of this session via any media type is strictly prohibited. Making Cloud Computing Work for Your Company Mitigating Risks – Multidisciplinary Adapted from Source: ©Teacher & Educational Development, University of New Mexico School of Medicine, 2005 Technical Legal Risk Transfer (Insurance)

15. Page 15 Recording of this session via any media type is strictly prohibited. Adapted from Source: ©Teacher & Educational Development, University of New Mexico School of Medicine, 2005 https://www.gartner.com/doc/2221320

16. Page 16 Recording of this session via any media type is strictly prohibited. Making Cloud Computing Work for Your Company Vendor Management Programs Adapted from Source: ©Teacher & Educational Development, University of New Mexico School of Medicine, 2005 RFP Phase Risk Identification Phase Formal Security and Privacy Assessment Data Security and Privacy Schedule Negotiation Strategies Audit and Reoccurring Risk Assessment This material is for informational purposes only and not for the purpose of providing legal advice. You should contact your attorney to obtain advice with respect to any particular issue or problem

17. Page 17 Recording of this session via any media type is strictly prohibited. Making Cloud Computing Work for Your Company Key Contract Terms Adapted from Source: ©Teacher & Educational Development, University of New Mexico School of Medicine, 2005 Definitions Preventative Contract Terms Controls in place to prevent data breach “Reasonable security” Specific controls Audit and Enforcement Terms Assessment / scanning rights Non-compliance reporting Credits / damages Incident Response Contract Terms Risk of Loss Contract Terms This material is for informational purposes only and not for the purpose of providing legal advice. You should contact your attorney to obtain advice with respect to any particular issue or problem

18. Page 18 Recording of this session via any media type is strictly prohibited. Making Cloud Computing Work for Your Company Adapted from Source: ©Teacher & Educational Development, University of New Mexico School of Medicine, 2005 Privacy by Design and Culture Shared Security and Related Responsibilities Control and Liability Due Diligence and Vendor Management Programs This material is for informational purposes only and not for the purpose of providing legal advice. You should contact your attorney to obtain advice with respect to any particular issue or problem

19. Page 19 Recording of this session via any media type is strictly prohibited. Questions, Final Comments and Contact Information Toby Merrill toby.merrill@acegroup.com toby.merrill@acegroup.com Anthony Caratzas Anthony.Caratzas@broadridge.com Anthony.Caratzas@broadridge.com Vinny Sakore vinny.sakore@icsalabs.com vinny.sakore@icsalabs.com David Navetta, Esq. CIPP dnavetta@infolawgroup.com dnavetta@infolawgroup.com