{"id":1900,"date":"2012-05-02T00:00:00","date_gmt":"2012-05-02T00:00:00","guid":{"rendered":"http:\/\/otava.test\/nist-recommendations-for-security-in-the-outsourced-cloud\/"},"modified":"2012-05-02T00:00:00","modified_gmt":"2012-05-02T00:00:00","slug":"nist-recommendations-for-security-in-the-outsourced-cloud","status":"publish","type":"post","link":"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/","title":{"rendered":"NIST Recommendations for Security in the Outsourced Cloud"},"content":{"rendered":"<p>NIST (The National Institute of Standards and Technology) provides a number of recommendations addressing security and privacy issues with outsourcing <a href=\"https:\/\/otavawebsite.wpengine.com\/solutions\/cloud\/\">cloud hosting<\/a> services in its <a href=\"https:\/\/csrc.nist.gov\/publications\/nistpubs\/800-144\/SP800-144.pdf\">Guidelines on Security and Privacy in Public Cloud Computing<\/a> published last December:<\/p>\n<p><strong>Governance<\/strong><br \/>\nNIST refers to the organizational controls over policies, procedures, standards of development, and the design, implementation, testing, use and monitoring of deployed services. In short, they explain that while the cloud requires less capital investment, it still requires a high level of employee training and administrative oversight to maintain security.<\/p>\n<p>Governance also refers to proactive risk management in the form of deploying audit tools to determine how data is stored, protected and used. Securing an audit trail of user\/system activity \u00a0is also a <a href=\"https:\/\/otavawebsite.wpengine.com\/compliance-security\/pci-compliant-cloud\/\">PCI DSS requirement<\/a> (10.5), and recommended for <a href=\"https:\/\/otavawebsite.wpengine.com\/compliance-security\/hipaa-compliant-cloud\/\">HIPAA compliance<\/a>. The use of <a href=\"https:\/\/www.onlinetech.com\/secure-hosting\/technical-security\/file-integrity-monitoring-fim\">file integrity monitoring<\/a> and <a href=\"https:\/\/www.onlinetech.com\/secure-hosting\/technical-security\/daily-log-review\">log monitoring<\/a> can provide continuous records of activity and alert you to any abnormal use to help prevent a breach.<\/p>\n<p><strong>Compliance<\/strong><br \/>\nWhile NIST recognizes the complexity and breadth of compliance regulations varying by industry, region and governing body, the take-home message is that organizations are ultimately held accountable for the security and privacy of data that is held by a cloud provider on their behalf.<\/p>\n<p>NIST doesn\u2019t come out and say cloud providers need to abide by the same standards that, for example, covered entities or health organizations in the healthcare industry need to follow. They also recognize that \u201cthe degree to which they will accept liability in their service agreements, for exposure of content under their control, remains to be seen.\u201d This statement is more a reflection of current industry trends in compliance, instead of endorsing a standard that cloud providers should follow.<\/p>\n<p>But if the organization is responsible for the security and privacy of data held by a cloud provider, then it\u2019s up to the organization to do a thorough assessment of their cloud provider\u2019s security controls and knowledge of industry standards.<\/p>\n<p>Another aspect of compliance is data location &#8211; if outsourcing, be sure to tour their <a href=\"https:\/\/otavawebsite.wpengine.com\/operations\/locations\/michigan-cloud-and-data-centers\/\">data center<\/a> facilities to know exactly where your data will live, and what kind of security is in place to protect it. Download our <a href=\"https:\/\/www.onlinetech.com\/resources\/white-papers\/hipaa-compliant-data-centers\">HIPAA compliant data centers white paper<\/a> for a complete guide to HIPAA hosting.<\/p>\n<p><strong>Trust<\/strong><br \/>\nDirect control over security and privacy is transferred to the cloud provider, obviously demanding a fair amount of trust between the organization and provider. NIST recommends ensuring visibility into a cloud provider\u2019s security and privacy controls and their performance over a period of time. NIST also recommends establishing cohesive and exclusive ownership rights over data.<\/p>\n<p>Insider access can also lead to threats such as fraud and theft &#8211; ask your cloud provider if they do background checks on employees, and if they are properly trained on how to handle sensitive data.<\/p>\n<p>Establishing data ownership and access, gaining visibility into security controls and conducting a risk analysis or assessment is fundamental to risk management. Prior to undergoing a third-party audit, a cloud provider should conduct a risk assessment of any potential vulnerabilities, whether alone or with the help of a security consultant. Find out what&#8217;s in a <a href=\"https:\/\/otavawebsite.wpengine.com\/reference\/whats-in-a-hipaa-risk-analysis\/\">HIPAA risk analysis<\/a> (helpful for healthcare organizations and anyone concerned with security).<\/p>\n<p>Stay tuned for future blog posts on other cloud security recommendations, including <em><strong>Architecture, Identity and Access Management, Software Isolation, Data Protection, Availability<\/strong><\/em> and <em><strong>Incident Response<\/strong><\/em>.<\/p>\n<p>References:<br \/>\n<a href=\"https:\/\/csrc.nist.gov\/publications\/nistpubs\/800-144\/SP800-144.pdf\">Guidelines on\u00a0Security and Privacy\u00a0in Public Cloud Computing<\/a>\u00a0(PDF)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>NIST (The National Institute of Standards and Technology) provides a number of recommendations addressing security and privacy issues with outsourcing cloud hosting services in its Guidelines on Security and Privacy in Public Cloud Computing published last December: Governance NIST refers to the organizational controls over policies, procedures, standards of development, and the design, implementation, testing, use and monitoring of deployed services. In short, they explain that while the cloud requires less capital investment, it still requires a high level of employee training and administrative oversight to maintain security. Governance also refers to proactive risk management in the form of deploying audit tools to determine how data is stored, protected and used. Securing an audit trail of user\/system activity \u00a0is also a PCI DSS requirement (10.5), and recommended for HIPAA compliance. The use of file integrity monitoring and log monitoring can provide continuous records of activity and alert you to any abnormal use to help prevent a breach. Compliance While NIST recognizes the complexity and breadth of compliance regulations varying by industry, region and governing body, the take-home message is that organizations are ultimately held accountable for the security and privacy of data that is held by a cloud provider on&#8230;<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"other_category":[],"class_list":["post-1900","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.2 (Yoast SEO v27.2) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>NIST Recommendations for Security in the Outsourced Cloud | OTAVA<\/title>\n<meta name=\"description\" content=\"NIST (The National Institute of Standards and Technology) provided recommendations on security and privacy issues with outsourcing cloud hosting services.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"NIST Recommendations for Security in the Outsourced Cloud\" \/>\n<meta property=\"og:description\" content=\"NIST (The National Institute of Standards and Technology) provided recommendations on security and privacy issues with outsourcing cloud hosting services.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/\" \/>\n<meta property=\"og:site_name\" content=\"OTAVA\" \/>\n<meta property=\"article:published_time\" content=\"2012-05-02T00:00:00+00:00\" \/>\n<meta name=\"author\" content=\"Irma Brillantes\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Irma Brillantes\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/\"},\"author\":{\"name\":\"Irma Brillantes\",\"@id\":\"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263\"},\"headline\":\"NIST Recommendations for Security in the Outsourced Cloud\",\"datePublished\":\"2012-05-02T00:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/\"},\"wordCount\":581,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.otava.com\/#organization\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/\",\"url\":\"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/\",\"name\":\"NIST Recommendations for Security in the Outsourced Cloud | OTAVA\",\"isPartOf\":{\"@id\":\"https:\/\/www.otava.com\/#website\"},\"datePublished\":\"2012-05-02T00:00:00+00:00\",\"description\":\"NIST (The National Institute of Standards and Technology) provided recommendations on security and privacy issues with outsourcing cloud hosting services.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.otava.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"NIST Recommendations for Security in the Outsourced Cloud\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.otava.com\/#website\",\"url\":\"https:\/\/www.otava.com\/\",\"name\":\"OTAVA\u00ae\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.otava.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.otava.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.otava.com\/#organization\",\"name\":\"OTAVA\u00ae\",\"url\":\"https:\/\/www.otava.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.otava.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg\",\"contentUrl\":\"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg\",\"caption\":\"OTAVA\u00ae\"},\"image\":{\"@id\":\"https:\/\/www.otava.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263\",\"name\":\"Irma Brillantes\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g\",\"caption\":\"Irma Brillantes\"},\"url\":\"https:\/\/www.otava.com\/blog\/author\/ibrillantesotava-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"NIST Recommendations for Security in the Outsourced Cloud | OTAVA","description":"NIST (The National Institute of Standards and Technology) provided recommendations on security and privacy issues with outsourcing cloud hosting services.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/","og_locale":"en_US","og_type":"article","og_title":"NIST Recommendations for Security in the Outsourced Cloud","og_description":"NIST (The National Institute of Standards and Technology) provided recommendations on security and privacy issues with outsourcing cloud hosting services.","og_url":"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/","og_site_name":"OTAVA","article_published_time":"2012-05-02T00:00:00+00:00","author":"Irma Brillantes","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Irma Brillantes","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/#article","isPartOf":{"@id":"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/"},"author":{"name":"Irma Brillantes","@id":"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263"},"headline":"NIST Recommendations for Security in the Outsourced Cloud","datePublished":"2012-05-02T00:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/"},"wordCount":581,"commentCount":0,"publisher":{"@id":"https:\/\/www.otava.com\/#organization"},"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/","url":"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/","name":"NIST Recommendations for Security in the Outsourced Cloud | OTAVA","isPartOf":{"@id":"https:\/\/www.otava.com\/#website"},"datePublished":"2012-05-02T00:00:00+00:00","description":"NIST (The National Institute of Standards and Technology) provided recommendations on security and privacy issues with outsourcing cloud hosting services.","breadcrumb":{"@id":"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.otava.com\/blog\/nist-recommendations-for-security-in-the-outsourced-cloud\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.otava.com\/"},{"@type":"ListItem","position":2,"name":"NIST Recommendations for Security in the Outsourced Cloud"}]},{"@type":"WebSite","@id":"https:\/\/www.otava.com\/#website","url":"https:\/\/www.otava.com\/","name":"OTAVA\u00ae","description":"","publisher":{"@id":"https:\/\/www.otava.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.otava.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.otava.com\/#organization","name":"OTAVA\u00ae","url":"https:\/\/www.otava.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.otava.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg","contentUrl":"https:\/\/www.otava.com\/wp-content\/uploads\/2025\/03\/otava-logo.svg","caption":"OTAVA\u00ae"},"image":{"@id":"https:\/\/www.otava.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.otava.com\/#\/schema\/person\/35774075f8f4fcdd4eae80cb72034263","name":"Irma Brillantes","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d5251bebc1699793a698d1a6158603cb3cdc50a095a12357e42d415b3e5546c2?s=96&d=mm&r=g","caption":"Irma Brillantes"},"url":"https:\/\/www.otava.com\/blog\/author\/ibrillantesotava-com\/"}]}},"_links":{"self":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/posts\/1900","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/comments?post=1900"}],"version-history":[{"count":0,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/posts\/1900\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/media?parent=1900"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/categories?post=1900"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/tags?post=1900"},{"taxonomy":"other_category","embeddable":true,"href":"https:\/\/www.otava.com\/wp-json\/wp\/v2\/other_category?post=1900"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}