By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
Health Works CollectiveHealth Works CollectiveHealth Works Collective
  • Health
    • Mental Health
  • Policy and Law
    • Global Healthcare
    • Medical Ethics
  • Medical Innovations
  • News
  • Wellness
  • Tech
Search
© 2023 HealthWorks Collective. All Rights Reserved.
Reading: NIST Recommendations for Security in the Outsourced Cloud
Share
Notification Show More
Font ResizerAa
Health Works CollectiveHealth Works Collective
Font ResizerAa
Search
Follow US
  • About
  • Contact
  • Privacy
© 2023 HealthWorks Collective. All Rights Reserved.
Health Works Collective > Uncategorized > NIST Recommendations for Security in the Outsourced Cloud
Uncategorized

NIST Recommendations for Security in the Outsourced Cloud

onlinetech
onlinetech
Share
5 Min Read
SHARE

NIST (The National Institute of Standards and Technology) provides a number of recommendations addressing security and privacy issues with outsourcing cloud hosting services in its Guidelines on Security and Privacy in Public Cloud Computing published last December:

NIST (The National Institute of Standards and Technology) provides a number of recommendations addressing security and privacy issues with outsourcing cloud hosting services in its Guidelines on Security and Privacy in Public Cloud Computing published last December:

Governance
NIST refers to the organizational controls over policies, procedures, standards of development, and the design, implementation, testing, use and monitoring of deployed services. In short, they explain that while the cloud requires less capital investment, it still requires a high level of employee training and administrative oversight to maintain security.

Governance also refers to proactive risk management in the form of deploying audit tools to determine how data is stored, protected and used. Securing an audit trail of user/system activity  is also a PCI DSS requirement (10.5), and recommended for HIPAA compliance. The use of file integrity monitoring and log monitoring can provide continuous records of activity and alert you to any abnormal use to help prevent a breach.

More Read

8 Mistakes to Avoid when Securing Cloud Services
Life Technologies Launches New Sequencing Analysis Software For The Cloud
The Cloud in Healthcare – Top 10 Takeaways from iHT2 San Francisco
Cloud Security in the Medical Imaging Environment
Video:HIT Cloud Model Discussion with Intel Health at HIMSS12

Compliance
While NIST recognizes the complexity and breadth of compliance regulations varying by industry, region and governing body, the take-home message is that organizations are ultimately held accountable for the security and privacy of data that is held by a cloud provider on their behalf.

NIST doesn’t come out and say cloud providers need to abide by the same standards that, for example, covered entities or health organizations in the healthcare industry need to follow. They also recognize that “the degree to which they will accept liability in their service agreements, for exposure of content under their control, remains to be seen.” This statement is more a reflection of current industry trends in compliance, instead of endorsing a standard that cloud providers should follow.

But if the organization is responsible for the security and privacy of data held by a cloud provider, then it’s up to the organization to do a thorough assessment of their cloud provider’s security controls and knowledge of industry standards.

Another aspect of compliance is data location – if outsourcing, be sure to tour their data center facilities to know exactly where your data will live, and what kind of security is in place to protect it. Download our HIPAA compliant data centers white paper for a complete guide to HIPAA hosting.

Trust
Direct control over security and privacy is transferred to the cloud provider, obviously demanding a fair amount of trust between the organization and provider. NIST recommends ensuring visibility into a cloud provider’s security and privacy controls and their performance over a period of time. NIST also recommends establishing cohesive and exclusive ownership rights over data.

Insider access can also lead to threats such as fraud and theft – ask your cloud provider if they do background checks on employees, and if they are properly trained on how to handle sensitive data.

Establishing data ownership and access, gaining visibility into security controls and conducting a risk analysis or assessment is fundamental to risk management. Prior to undergoing a third-party audit, a cloud provider should conduct a risk assessment of any potential vulnerabilities, whether alone or with the help of a security consultant. Find out what’s in a HIPAA risk analysis (helpful for healthcare organizations and anyone concerned with security).

Stay tuned for future blog posts on other cloud security recommendations, including Architecture, Identity and Access Management, Software Isolation, Data Protection, Availability and Incident Response.

References:
Guidelines on Security and Privacy in Public Cloud Computing (PDF)

TAGGED:cloud computing
Share This Article
Facebook Copy Link Print
Share

Stay Connected

1.5kFollowersLike
4.5kFollowersFollow
2.8kFollowersPin
136kSubscribersSubscribe

Latest News

Epidemiological Health Benefits
Personal and Epidemiological Health Benefits of Blood Pressure Management
Health
October 13, 2025
Traumatic Brain Injuries
Understanding Traumatic Brain Injuries: What Families Need to Know
Policy & Law
October 10, 2025
Remote Monitoring touchpoints
Remote Monitoring Touchpoints Patients Will Actually Follow
Technology
October 9, 2025
dental care
Importance of Good Dental Care for Health and Confidence
Dental health Specialties
October 2, 2025

You Might also Like

tips for recovering from a serious injury
Uncategorized

Best Practices on Expediting Your Recovery After a Serious Injury

May 19, 2022
Cloud Hosting Security
Uncategorized

What to Look for in a Cloud Hosting Provider

April 6, 2012
eat the right foods to deal with autoimmune disorder
Uncategorized

6 Foods That Can Improve Your Autoimmune System

May 11, 2022

Filtering versus Overload : Information and Content in The Digital Age

July 25, 2011
Subscribe
Subscribe to our newsletter to get our newest articles instantly!
Follow US
© 2008-2025 HealthWorks Collective. All Rights Reserved.
  • About
  • Contact
  • Privacy
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?