Legal, Risk and Compliance · Topic 6 of 6
Outsourcing and Cloud Contract Design
CCSP cloud contracts: SLA, MSA and SOW, vendor assessment, lock-in, viability and escrow, key clauses, and supply chain security with ISO/IEC 27036.
- 5 min
- MSA sets legal terms; SOW sets specific work; SLA sets measurable targets.
- Vendor management covers assessment, lock-in, viability and escrow.
- Key clauses: right to audit, definitions, termination, data ownership, access, security, compliance, insurance.
What it is
Outsourcing to a cloud provider hands over operations but not accountability. The contract is the main tool the customer has to make the provider meet its security, privacy, availability and exit requirements. It must be designed with business requirements, vendor risks and the full supply chain in mind.
How it works
Business requirements and contract documents
| Document | Purpose |
|---|---|
| Master service agreement (MSA) | Overall legal terms of the relationship: liability, confidentiality, governing law, dispute resolution |
| Statement of work (SOW) | Specific services, deliverables, responsibilities and timelines for a project or service |
| Service level agreement (SLA) | Measurable service targets, measurement method, reporting and remedies |
Many public cloud contracts are standard terms with little room to negotiate. Large customers or regulated sectors may negotiate addenda, such as data processing agreements.
Vendor management
| Area | What it covers |
|---|---|
| Vendor assessments | Security questionnaires such as the CSA CAIQ, audit reports, certifications, financial checks |
| Vendor lock-in risks | Proprietary services, data formats and egress costs that make leaving hard |
| Vendor viability | Financial stability and likelihood the provider stays in business |
| Escrow | A neutral third party holds source code, data or keys, released if the vendor fails or breaches |
Vendor management continues for the life of the contract: periodic reassessment, review of new audit reports, SLA monitoring and relationship meetings.
Contract management: key clauses
| Clause | What to secure |
|---|---|
| Right to audit | Right to audit or, more often, to receive current third-party audit reports |
| Metrics | Clear, measurable SLAs with reporting |
| Definitions | Precise meanings of terms such as availability, incident, breach and customer data |
| Termination | Notice periods, termination for cause and convenience, transition assistance |
| Litigation | Governing law, jurisdiction, dispute resolution, support for legal holds and eDiscovery |
| Assurance | Ongoing evidence of control effectiveness, certifications maintained |
| Compliance | Provider meets the laws and standards relevant to the service |
| Access to cloud and data | Customer access to its data at all times, including during disputes |
| Cyber risk insurance | Provider's coverage levels; customer's own insurance requirements |
| Data ownership | Customer owns its data, metadata and derived data; provider use limited to delivering the service |
| Security requirements | Encryption, access control, incident notification times, subcontractor approval, data location |
Example clause:
Upon termination for any reason, the Provider shall, within 30 days, return all
Customer Data in a commonly used machine readable format and, upon the Customer's
written confirmation of receipt, securely delete all copies, including backups,
and provide written certification of deletion.Supply-chain management
Cloud services depend on chains of subcontractors: hosting providers, support companies, software vendors. ISO/IEC 27036 gives guidance on information security in supplier relationships; its part 4 addresses cloud services.
Supply chain controls include:
- Requiring the provider to list and notify changes to subprocessors.
- Flowing security and privacy obligations down to subcontractors.
- Checking that subservice organizations are covered by audit reports.
- Assessing concentration on shared fourth parties.
Outsourcing risks
- Loss of in house skills and control.
- Dependence on the provider's priorities and roadmap.
- Hidden costs such as egress, support tiers and premium features.
- Legal exposure through subcontractors in other jurisdictions.
- Difficulty exiting if the relationship fails.
A worked example
A logistics company negotiates with a SaaS provider for its warehouse system. The draft contract is silent on data return at exit, allows the provider to use customer data "to improve services", sets breach notification as "promptly", and gives no access to audit reports.
The security lead asks for a data return and deletion clause, limits data use to delivering the service, defines notification within 24 hours of confirmation, adds a right to receive SOC 2 Type 2 reports annually, and requires notice of subprocessor changes. Source code escrow is added because the provider is a small company.
How the exam asks about this
- "Which arrangement protects a customer if a small software vendor goes out of business?" Escrow of source code or data with a neutral third party.
- "Which document sets the overall legal terms of a cloud relationship?" The master service agreement.
- "Which standard provides guidance on information security for supplier relationships, including cloud?" ISO/IEC 27036.
What to remember for the exam
- MSA sets legal terms; SOW sets specific work; SLA sets measurable targets.
- Vendor management covers assessment, lock-in, viability and escrow.
- Key clauses: right to audit, definitions, termination, data ownership, access, security, compliance, insurance.
- Exit clauses must cover data return format, timeline and certified deletion.
- ISO/IEC 27036 covers supplier security; flow obligations down to subprocessors.
Vague terms such as "promptly" or "industry standard security" are hard to enforce. Define notification times, metrics and security requirements precisely.
Common mistakes
Accepting a right to audit you can never use. In practice the right to receive current third-party reports is more valuable.
Forgetting exit. Termination without data return and deletion terms leaves data stranded or exposed.
Ignoring subprocessors. The provider's suppliers handle your data too and need the same obligations.
Check yourself
What is the purpose of escrow in cloud contracts?
A neutral third party holds source code, data or keys that are released to the customer if the vendor fails or breaches the agreement.
What should a data ownership clause establish?
That the customer owns its data, metadata and derived data, and that the provider may use it only to deliver the service.
What is the difference between an MSA and an SOW?
The MSA sets the overall legal terms of the relationship, while the SOW describes the specific services, deliverables and responsibilities.
Topic 6 of 6 in Legal, Risk and Compliance
Test yourself on Legal, Risk and Compliance
The full ISC2 CCSP question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.