IBM Cloud - Revision history

Shawndouglas: Text replacement - "\[\[L7 Informatics, Inc.(.*)" to "[[Vendor:L7 Informatics, Inc.$1"

2024-04-03T20:26:09Z

Text replacement - "\[\[L7 Informatics, Inc.(.*)" to "[[Vendor:L7 Informatics, Inc.$1"

← Older revision		Revision as of 20:26, 3 April 2024
Line 45:		Line 45:
	1. '''What experience do you have working with laboratory customers in our specific industry?'''		1. '''What experience do you have working with laboratory customers in our specific industry?'''

	Few publicly described examples of non-technology [[Laboratory\|laboratories]] working with IBM Cloud could be found, with only Allegany Ballistics Laboratory<ref name="IBMAchieves16">{{cite web \|url=https://www-03.ibm.com/press/us/en/pressrelease/49018.wss \|archiveurl=https://web.archive.org/web/20210124035001/https://www-03.ibm.com/press/us/en/pressrelease/49018.wss \|title=IBM Achieves Highest U.S. Defense Information Systems Agency Authorization for Cloud Services \|publisher=IBM \|date=11 February 2016 \|archivedate=24 January 2021 \|accessdate=02 August 2023}}</ref>, a manufacturing and research center for the Department of Defense, being mentioned. One [[laboratory informatics]] vendor, [[L7 Informatics, Inc.]]<ref name="BSLab717">{{cite web \|url=https://www.biospace.com/article/releases/lab7-systems-announces-high-performance-cloud-for-genomic-scale-data-management-built-on-ibm-cloud-/ \|title=Lab7 Systems Announces High-Performance Cloud For Genomic-Scale Data Management Built On IBM Cloud \|work=BioSpace \|author=Lab7 Systems, Inc \|date=23 May 2017 \|accessdate=02 August 2023}}</ref>, could be verified to be using or have used IBM Cloud for its SaaS offerings. An IBM Cloud representative is more likely to be able to supply other examples of laboratories and laboratory informatics developers that use or have used IBM Cloud.		Few publicly described examples of non-technology [[Laboratory\|laboratories]] working with IBM Cloud could be found, with only Allegany Ballistics Laboratory<ref name="IBMAchieves16">{{cite web \|url=https://www-03.ibm.com/press/us/en/pressrelease/49018.wss \|archiveurl=https://web.archive.org/web/20210124035001/https://www-03.ibm.com/press/us/en/pressrelease/49018.wss \|title=IBM Achieves Highest U.S. Defense Information Systems Agency Authorization for Cloud Services \|publisher=IBM \|date=11 February 2016 \|archivedate=24 January 2021 \|accessdate=02 August 2023}}</ref>, a manufacturing and research center for the Department of Defense, being mentioned. One [[laboratory informatics]] vendor, [[Vendor:L7 Informatics, Inc.]]<ref name="BSLab717">{{cite web \|url=https://www.biospace.com/article/releases/lab7-systems-announces-high-performance-cloud-for-genomic-scale-data-management-built-on-ibm-cloud-/ \|title=Lab7 Systems Announces High-Performance Cloud For Genomic-Scale Data Management Built On IBM Cloud \|work=BioSpace \|author=Lab7 Systems, Inc \|date=23 May 2017 \|accessdate=02 August 2023}}</ref>, could be verified to be using or have used IBM Cloud for its SaaS offerings. An IBM Cloud representative is more likely to be able to supply other examples of laboratories and laboratory informatics developers that use or have used IBM Cloud.

Shawndouglas: Cats

2024-02-28T22:55:21Z

Cats

← Older revision		Revision as of 22:55, 28 February 2024
Line 184:		Line 184:
	==References==		==References==
	{{Reflist\|colwidth=30em}}		{{Reflist\|colwidth=30em}}

			<!---Place all category tags here-->
			[[Category:Cloud computing services]]
			[[Category:Managed security services]]

Shawndouglas: Updated for 2023.

2023-08-02T19:45:22Z

Updated for 2023.

Show changes

Shawndouglas: /* Provider research */ Tweak

2021-08-21T17:45:28Z

Provider research: Tweak

← Older revision		Revision as of 17:45, 21 August 2021
Line 40:		Line 40:

	==Provider research==		==Provider research==
	This section uses public information to provide some answers to the 18 questions posed in Chapter 6 of the wiki-based guide ''[[LII:Choosing and Implementing a Cloud-based Service for ~~your~~ Laboratory\|Choosing and Implementing a Cloud-based Service for ~~your~~ Laboratory]]''. In some cases, public information could not be found, and a recommendation to further discuss the question with the cloud service provider (CSP) is made.		This section uses public information to provide some answers to the 18 questions posed in Chapter 6 of the wiki-based guide ''[[LII:Choosing and Implementing a Cloud-based Service for Your Laboratory\|Choosing and Implementing a Cloud-based Service for Your Laboratory]]''. In some cases, public information could not be found, and a recommendation to further discuss the question with the cloud service provider (CSP) is made.

Shawndouglas: /* Provider research */ Chapter number

2021-06-04T15:56:48Z

Provider research: Chapter number

← Older revision		Revision as of 15:56, 4 June 2021
Line 40:		Line 40:

	==Provider research==		==Provider research==
	This section uses public information to provide some answers to the 18 questions posed in Chapter 5 of the wiki-based guide ''[[LII:Choosing and Implementing a Cloud-based Service for your Laboratory\|Choosing and Implementing a Cloud-based Service for your Laboratory]]''. In some cases, public information could not be found, and a recommendation to further discuss the question with the cloud service provider (CSP) is made.		This section uses public information to provide some answers to the 18 questions posed in Chapter 6 of the wiki-based guide ''[[LII:Choosing and Implementing a Cloud-based Service for your Laboratory\|Choosing and Implementing a Cloud-based Service for your Laboratory]]''. In some cases, public information could not be found, and a recommendation to further discuss the question with the cloud service provider (CSP) is made.


Line 157:		Line 157:

	It is unclear if support personnel are local to the customer or if support is outsourced to another business and country. Discuss this with an IBM Cloud representative.		It is unclear if support personnel are local to the customer or if support is outsourced to another business and country. Discuss this with an IBM Cloud representative.


	==Managed security services==		==Managed security services==

Shawndouglas: Typo

2021-06-03T23:49:58Z

Typo

← Older revision		Revision as of 23:49, 3 June 2021
Line 165:		Line 165:
	* '''Managed network security''': managed firewall, as well as intrusion detection and prevention management		* '''Managed network security''': managed firewall, as well as intrusion detection and prevention management

	IBM Managed Security Services is listed in the top 10 of managed security service provider lists for multiple ~~entitites~~.<ref name="MSSPCyber20">{{cite web \|url=https://www.msspalert.com/top250/list-2020/25/ \|title=Top 250 MSSPs for 2020: Companies 10 to 01 \|work=Top 250 MSSPs: Cybersecurity Company List and Research for 2020 \|publisher=MSSP Alert \|date=September 2020 \|accessdate=27 May 2021}}</ref><ref name="STHTop15_21">{{cite web \|url=https://www.softwaretestinghelp.com/managed-security-service-providers/ \|title=Top 15 Best Managed Security Service Providers (MSSPs) In 2021 \|publisher=Software Testing Help \|date=30 April 2021 \|accessdate=27 May 2021}}</ref><ref name="CDMMSSPs21">{{cite web \|url=https://www.cyberdefensemagazine.com/top-100-managed-security-service-providers-mssps/ \|title=Top 100 Managed Security Service Providers (MSSPs) \|work=Cyber Defense Magazine \|publisher=Cyber Defense Media Group \|date=18 February 2021 \|accessdate=27 May 2021}}</ref>		IBM Managed Security Services is listed in the top 10 of managed security service provider lists for multiple entities.<ref name="MSSPCyber20">{{cite web \|url=https://www.msspalert.com/top250/list-2020/25/ \|title=Top 250 MSSPs for 2020: Companies 10 to 01 \|work=Top 250 MSSPs: Cybersecurity Company List and Research for 2020 \|publisher=MSSP Alert \|date=September 2020 \|accessdate=27 May 2021}}</ref><ref name="STHTop15_21">{{cite web \|url=https://www.softwaretestinghelp.com/managed-security-service-providers/ \|title=Top 15 Best Managed Security Service Providers (MSSPs) In 2021 \|publisher=Software Testing Help \|date=30 April 2021 \|accessdate=27 May 2021}}</ref><ref name="CDMMSSPs21">{{cite web \|url=https://www.cyberdefensemagazine.com/top-100-managed-security-service-providers-mssps/ \|title=Top 100 Managed Security Service Providers (MSSPs) \|work=Cyber Defense Magazine \|publisher=Cyber Defense Media Group \|date=18 February 2021 \|accessdate=27 May 2021}}</ref>

Shawndouglas: MSS

2021-05-27T21:39:01Z

MSS

← Older revision		Revision as of 21:39, 27 May 2021
Line 157:		Line 157:

	It is unclear if support personnel are local to the customer or if support is outsourced to another business and country. Discuss this with an IBM Cloud representative.		It is unclear if support personnel are local to the customer or if support is outsourced to another business and country. Discuss this with an IBM Cloud representative.


			==Managed security services==
			IBM Managed Security Services is described by IBM as set of services that "simplifies security and risk with continuous, value-driven monitoring, management, and intelligence backed by global expertise, local delivery, and an integrated security portfolio."<ref name="IBMManaged19">{{cite web \|url=https://www.ibm.com/downloads/cas/BVWMRDGY \|format=PDF \|title=IBM Managed Security Services \|publisher=IBM \|date=2019 \|accessdate=27 May 2021}}</ref> The company touts both managed cybersecurity services and managed network security services. This includes<ref name="IBMMSS">{{cite web \|url=https://www.ibm.com/security/services/managed-security-services \|title=Managed Security Services (MSS) \|publisher=IBM \|accessdate=27 May 2021}}</ref>:

			* '''Managed cybersecurity''': threat management, managed detection and response, managed cloud security, managed endpoint security, identity management, and command center security
			* '''Managed network security''': managed firewall, as well as intrusion detection and prevention management

			IBM Managed Security Services is listed in the top 10 of managed security service provider lists for multiple entitites.<ref name="MSSPCyber20">{{cite web \|url=https://www.msspalert.com/top250/list-2020/25/ \|title=Top 250 MSSPs for 2020: Companies 10 to 01 \|work=Top 250 MSSPs: Cybersecurity Company List and Research for 2020 \|publisher=MSSP Alert \|date=September 2020 \|accessdate=27 May 2021}}</ref><ref name="STHTop15_21">{{cite web \|url=https://www.softwaretestinghelp.com/managed-security-service-providers/ \|title=Top 15 Best Managed Security Service Providers (MSSPs) In 2021 \|publisher=Software Testing Help \|date=30 April 2021 \|accessdate=27 May 2021}}</ref><ref name="CDMMSSPs21">{{cite web \|url=https://www.cyberdefensemagazine.com/top-100-managed-security-service-providers-mssps/ \|title=Top 100 Managed Security Service Providers (MSSPs) \|work=Cyber Defense Magazine \|publisher=Cyber Defense Media Group \|date=18 February 2021 \|accessdate=27 May 2021}}</ref>


	==Additional information==		==Additional information==
Line 164:		Line 174:
	* [https://www.ibm.com/downloads/cas/3NXVRXG9 HIPAA compliance guide]		* [https://www.ibm.com/downloads/cas/3NXVRXG9 HIPAA compliance guide]
	* [https://www.ibm.com/cloud/architecture/files/ibm-cloud-security-white-paper.pdf Client security whitepaper]		* [https://www.ibm.com/cloud/architecture/files/ibm-cloud-security-white-paper.pdf Client security whitepaper]
			* [https://www.ibm.com/downloads/cas/BVWMRDGY IBM Managed Security Services data sheet]
	* [https://www.ibm.com/support/customer/csol/terms/?cat=data-security#detail-document IBM security and privacy principles]		* [https://www.ibm.com/support/customer/csol/terms/?cat=data-security#detail-document IBM security and privacy principles]

Line 170:		Line 181:
	* [https://cloud.ibm.com/docs/overview?topic=overview-shared-responsibilities IBM Cloud shared responsibility model]		* [https://cloud.ibm.com/docs/overview?topic=overview-shared-responsibilities IBM Cloud shared responsibility model]
	* [https://www.ibm.com/trust IBM Cloud trust center]		* [https://www.ibm.com/trust IBM Cloud trust center]
			* [https://www.ibm.com/security/services/managed-security-services IBM Managed Security Services]

	==References==		==References==
	{{Reflist\|colwidth=30em}}		{{Reflist\|colwidth=30em}}

Shawndouglas: Created as needed.

2021-04-25T23:06:31Z

Created as needed.

New page

{{Infobox company
| name = IBM Cloud
| logo = [[File:IBM Cloud logo.png|200px]]
| caption =
| type =
| traded_as =
| genre = 
| fate =
| predecessor =
| successor =
| foundation = 
| founder = Charles Ranlett Flint
| defunct = 
| location_city = Armonk, New York
| location_country = United States
| location =
| locations =
| area_served = Worldwide
| key_people = Arvind Krishna (CEO)
| industry = Computing, Cloud computing, Web services
| products = [[Infrastructure as a service|IaaS]], [[Platform as a service|PaaS]], [[Database as a service|DBaaS]], [[Desktop virtualization#Desktop as a service|DaaS]], [[Software as a service|SaaS]]
| services =
| revenue = $7.5 billion (2020, Q4)<ref name="EvansIBM21">{{cite web |url=https://cloudwars.co/ibm/ibm-shocker-q4-cloud-growth-plummets-to-8/ |title=IBM Shocker: Q4 Cloud Growth Plummets to 8% |author=Evans, B. |work=Cloud Wars |date=27 January 2021 |accessdate=25 April 2021}}</ref>
| operating_income =
| net_income =
| aum = 
| assets =
| equity =
| owner =
| num_employees =
| parent =
| divisions =
| subsid =
| homepage = {{URL|https://www.ibm.com/cloud}}
| footnotes =
| intl =
}}

'''IBM Cloud''' is a collection of public, private, hybrid, and multicloud [[cloud computing]] services offered by IBM, an American multinational information technology company. IBM Cloud deploys to over 60 data centers in various locations around the world, primarily in the U.S. and Europe but also with some representation in the Pacific region and South America.<ref name="IBMGlobalLocs">{{cite web |url=https://www.ibm.com/cloud/data-centers/ |title=Global locations for your global business |publisher=IBM Cloud |accessdate=16 April 2021}}</ref> More than 170 different products and services are associated with IBM Cloud, representing elastic computing, networking, content delivery, data storage, database management, security management, enterprise management, [[data analysis]], scientific computing, container management, developer support, [[blockchain]] management, [[internet of things]], and [[artificial intelligence]].<ref name="IBMCloudProds">{{cite web |url=https://www.ibm.com/cloud/products |title=IBM Cloud Products |publisher=IBM |accessdate=25 April 2021}}</ref>

==Provider research==
This section uses public information to provide some answers to the 18 questions posed in Chapter 5 of the wiki-based guide ''[[LII:Choosing and Implementing a Cloud-based Service for your Laboratory|Choosing and Implementing a Cloud-based Service for your Laboratory]]''. In some cases, public information could not be found, and a recommendation to further discuss the question with the cloud service provider (CSP) is made.

1. '''What experience do you have working with laboratory customers in our specific industry?'''

Few publicly described examples of non-technology [[Laboratory|laboratories]] working with IBM Cloud could be found, with only Allegany Ballistics Laboratory<ref name="IBMAchieves16">{{cite web |url=https://www-03.ibm.com/press/us/en/pressrelease/49018.wss |title=IBM Achieves Highest U.S. Defense Information Systems Agency Authorization for Cloud Services |publisher=IBM |date=11 February 2016 |accessdate=16 April 2021}}</ref>, a manufacturing and research center for the Department of Defense, being mentioned. One [[laboratory informatics]] vendor, [[L7 Informatics, Inc.]]<ref name="BSLab717">{{cite web |url=https://www.biospace.com/article/releases/lab7-systems-announces-high-performance-cloud-for-genomic-scale-data-management-built-on-ibm-cloud-/ |title=Lab7 Systems Announces High-Performance Cloud For Genomic-Scale Data Management Built On IBM Cloud |work=BioSpace |author=Lab7 Systems, Inc |date=23 May 2017 |accessdate=16 April 2021}}</ref>, could be verified to be using or have used IBM Cloud for its SaaS offerings. An IBM Cloud representative is more likely to be able to supply other examples of laboratories and laboratory informatics developers that use or have used IBM Cloud.

2. '''Can your solution readily integrate with our other systems and business processes, making it easier for our end users to perform their tasks?'''

It will ultimately be up to your organization to get an answer from IBM tailored to your systems and business processes. However, this much can be said about IBM Cloud integrations. The company provides a wide variety of tools for integration, as outlined on its [https://www.ibm.com/cloud/integration integration solutions page]. Its main tool, IBM Cloud Pak for Integration, "provides an automated and closed-loop lifecycle across multiple styles of enterprise integration."<ref name="IBMCloudPak">{{cite web |url=https://www.ibm.com/cloud/cloud-pak-for-integration |title=IBM Cloud Pak for Integration |publisher=IBM Cloud |accessdate=16 April 2021}}</ref> Related integration tools include IBM API Connect, IBM App Connect, and IBM Secure Gateway Service (useful for hybrid cloud deployments).

3. '''What is the average total historical downtime for the service(s) we're interested in?'''

Some public information is made available about historic outages and downtime. IBM Cloud has a [https://cloud.ibm.com/status/ systems status page] with status history (you have to click on the "History" link to the left). You should be able to read through the incident details for each issue, going back through a fair amount of history. This will give you a partial picture of the issues experienced in the past, as well as any scheduled maintenance and currently impacted services. A follow-up on this question with an IBM Cloud representative may reveal more historical downtime history for the services you are interested in.

4. '''Do we receive comprehensive downtime support in the case of downtime?'''

IBM Cloud does not make this answer clear. However, the answer is likely tied to what [https://cloud.ibm.com/docs/get-support?topic=get-support-support-plans after-sales support plan] you choose. Confirm with IBM Cloud what downtime support they provide based on the services your organization are interested in.

5. '''Where are your servers located, and how is data securely transferred to and from those servers?'''

IBM Cloud has 60 data centers spread across six regions and 18 availability zones<ref name="IBMGlobalLocs" />, with three more regions planned (as of April 2021).<ref name="IBMCloudMulti21">{{cite web |url=https://www.ibm.com/downloads/cas/2BWNGJM3 |format=PDF |title=IBM Cloud Multi-zone region |publisher=IBM Cloud |accessdate=16 April 2021}}</ref> These zones [https://www.ibm.com/cloud/data-centers/ are distributed] in various locations around the world, primarily in the U.S. and Europe but also with some representation in the Pacific region and South America. IBM Cloud uses its Content Delivery Network to deliver content, which "allows your users to receive the content with less delay, and delivers a better overall experience for your customers."<ref name="IBMAboutContent21">{{cite web |url=https://cloud.ibm.com/docs/CDN?topic=CDN-about-content-delivery-networks-cdn- |title=About Content Delivery Network |work=IBM Cloud Docs - Content Delivery Network (CDN) |publisher=IBM Cloud |date=01 February 2021 |accessdate=16 April 2021}}</ref> Data in motion is protected through IBM Cloud's [https://www.ibm.com/cloud/architecture/architectures/securityArchitecture/security-for-data IBM Security Guardian Data Encryption] suite for applying "data-at-rest and data-in-transit security quickly and consistently."<ref name="IBMSecArchSecData">{{cite web |url=https://www.ibm.com/cloud/architecture/architectures/securityArchitecture/security-for-data |title=Security architecture for cloud applications - Security for Data |publisher=IBM Cloud |accessdate=16 April 2021}}</ref> As for data localization and residency requirements, IBM Cloud [https://cloud.ibm.com/docs/blockchain?topic=blockchain-console-icp-about-data-residency documentation] and [https://www.ibm.com/blogs/cloud-computing/2015/07/21/how-hybrid-cloud-solves-data-localization-and-regional-compliance-challenges/ blog articles] address some elements of this topic, partly in the scope of blockchain networks; discuss the topic further with an IBM Cloud representative.

6. '''Who will have access to our data (including subcontractors), and what credentials, certifications, and compliance training do they have?'''

IBM Cloud addresses this topic partially in its architecture documentation<ref name="IBMSecArchPhysical">{{cite web |url=https://www.ibm.com/cloud/architecture/architectures/securityArchitecture/physical-asset-security |title=Security architecture for cloud applications - Physical Security |publisher=IBM Cloud |accessdate=16 April 2021}}</ref>:

<blockquote>Each data center has at least one security entry point that is always staffed and can include one or more access controlled entry ways that are monitored by CCTV. Each controlled area requires at least badge reader based authentication. Sensitive areas such as server rooms, network closets, and utility closets require badge and biometric authentication. Access attempts are logged and logs retained for at least one calendar year. Repeated failed access attempts trigger an alert to the security guards ... Access to the data center does not in turn confer access to the secured rooms within the data center. Employee access is based on job role, for example, so that server technicians do not have access to the network closet, and only trained facility staff have access to power feed termination rooms.</blockquote>

As for certifications and training, little is said about certifications. IBM indicates that an "extensive security training program" is required of each employee, and they must recertify that training annually. They also receive additional security awareness training based on role.<ref name="IBMSecArchPhysical" /> For additional information about roles, certifications, and training, discuss this with an IBM Cloud representative.

7. '''Will our sensitive and regulated data be stored on a machine dedicated to complying with the necessary regulations?'''

Not all [https://www.ibm.com/cloud/data-centers/ IBM Cloud machines] have the same controls on them; it will depend on the region, product, and compliance requirements of your lab. That said, verify with a representative that the machine your data will land on meets all the necessary regulations affecting your data.

8. '''How segregated is our cloud data from another customer's, i.e., will lapses of security of another customer's cloud affect our cloud? (It typically won't, but asking the question will hopefully prompt the provider to better explain how your data is segregated.)'''

It appears some IBM Cloud services may offer a premium "physical separation" plan. For example, the Text to Speech offering has a standard multi-tenant plan that provides "logical separation of data by using common encryption keys," and a premium single-tenant plan that provides "dedicated data storage accounts that use unique [[encryption]] keys."<ref name="IBMDataSec21">{{cite web |url=https://cloud.ibm.com/docs/text-to-speech?topic=text-to-speech-data-security |title=Data Security |work= IBM Cloud Docs - Text to Speech |publisher=IBM Cloud |accessdate=17 April 2021}}</ref> It's not clear how many other services IBM Cloud services have similar plans associated with them, but a [https://www.ibm.com/cloud/blog/single-tenant-cloud-vs-multi-tenant-cloud 2020 blog post] by IBM indicates they are able to accommodate both single- and multi-tenant environments in more than a few cases. Verify with a representative about physical vs. logical separation for your desired services.

As for tenant isolation, the previously mentioned blog post, as well as a few other bits of documentation, talks about tenant isolation security measures. For example, those on multi-tenant environments can take advantage of IBM's Cloud Key Protect, which "provides a root of trust that is secured by FIPS 140-2 Level 3 certified cloud-based HSMs that protect against theft of information."<ref name="IBMSecArchSecData" /> For more details about security measures in tenant isolation, discuss this with an IBM Cloud representative.

9. '''Do you have documented data security policies?'''

IBM Cloud documents its security practices in several places:

* [https://www.ibm.com/cloud/security IBM Cloud Security portal]
* [https://www.ibm.com/cloud/architecture/files/ibm-cloud-security-white-paper.pdf Cloud-native security practices in IBM Cloud]
* [https://www.ibm.com/cloud/architecture/architectures/securityArchitecture/ Security architecture for cloud applications]

Some security-related documents, like the SOC 2 report, may not be publicly available, requiring direct discussion with an IBM Cloud representative to obtain them.

10. '''How do you test your platform's security?'''

IBM Cloud notes the following about testing platform security<ref name="IBMHowDoI21">{{cite web |url=https://cloud.ibm.com/docs/overview?topic=overview-security |title=How do I know that my data is safe? |work=IBM Cloud Docs - Getting Started with IBM Cloud |publisher=IBM Cloud |date=23 March 2021 |accessdate=17 April 2021}}</ref>:

<blockquote>In addition to the regular penetration testing conducted by IBM and our partners, customers can conduct their own penetration testing of their resources on IBM Cloud. No permission is necessary from IBM Cloud for penetration testing of IP addresses allocated to your classic infrastructure account that is set up on classic virtual or bare metal servers. For penetration testing of IBM Cloud VPC or PaaS offerings, or any IBM-owned IP space that is not allocated to your classic infrastructure account, open a support case to get instructions on signing the Client Penetration Testing Authorization Agreement.</blockquote>

IBM also has IBM X-Force Red, "an autonomous team of veteran hackers, within IBM Security, hired to break into organizations and uncover risky vulnerabilities that criminal attackers may use for personal gain."<ref name="IBMXForceRed">{{cite web |url=https://www.ibm.com/security/services/offensive-security-services |title=X-Force Red Offensive Security Services |publisher=IBM |accessdate=17 April 2021}}</ref> However, it's not clear if this same team also tests IBM Cloud's own infrastructure. Discuss this topic more thoroughly with a representative.

11. '''What are your policies for security audits, intrusion detection, and intrusion reporting?'''

''Audits'': IBM Cloud discusses security audits and reviews in its security architecture documentation, under "[https://www.ibm.com/cloud/architecture/architectures/securityArchitecture/physical-asset-security/ Third-party security audits and reviews]." IBM Cloud's approach to security audits is also demonstrated by its compliance credentials (e.g., see its trust center).

''Intrusion detection and reporting:'': IBM Cloud discusses intrusion detection and prevention in-depth in the "[https://www.ibm.com/cloud/architecture/architectures/securityArchitecture/security-for-network/#networkprotection Network Protection]" section of its security architecture documentation. They also note elsewhere<ref name="IBMMonitor">{{cite web |url=https://www.ibm.com/cloud/architecture/architectures/securityArchitecture/security-monitoring-and-intelligence/ |title=Monitoring and intelligence |work=Security architecture for cloud applications |publisher=IBM Cloud |accessdate=17 April 2021}}</ref>:

<blockquote>The IBM Cloud platform comes with built-in intrusion detection. Intrusion detection is enabled through a combination of IBM Cloud infrastructure capabilities at the perimeter level within the firewall or IBM Security Access Manager for DataPower, and by monitoring IBM Cloud security logs that are consolidated within the QRadar SIEM tool.</blockquote>

12. '''What data logging information is kept and acted upon in relation to our data?'''

While IBM Cloud offers customers tools like [https://www.ibm.com/cloud/log-analysis IBM Cloud Log Analysis] to analyze their own logs, it's not clear what data logging information IBM collects and uses in relation to customer data. The Privacy Shield documentation notes, however<ref name="IBMPrivacyShield">{{cite web |url=https://www.ibm.com/privacy/privacy-shield |title=IBM Privacy Shield Privacy Policy for Certified IBM Cloud Services |publisher=IBM |date=18 December 2020 |accessdate=17 April 2021}}</ref>:

<blockquote>The types of personal data that Privacy Shield-Certified Cloud Services collect will vary based on the type and nature of each offering, and is described in its offering documentation (searchable via [https://www-03.ibm.com/software/sla/sladb.nsf/sla/tou/ this link]) or as otherwise provided by IBM. IBM uses such personal data as needed to deliver the Cloud Service, along with additional purposes that may be described in the corresponding TD or Attachment.</blockquote>

It's possible the terms of use document for the service you're interested in may discuss data collection and use by IBM. However, you'll have to have this discussion with a representative to confirm.

13. '''How thorough are those logs and can we audit them on-demand?'''

Customers have the ability to audit the logs associated with their own activities. It also appears "interactions made by IBM Cloud infrastructure support staff" can also be captured and audited in those logs.<ref name="IBMAuditing21">{{cite web |url=https://cloud.ibm.com/docs/account?topic=account-audit-log |title=Auditing system events for classic infrastructure |work=IBM Cloud Docs - Managing your account, resources, and access |publisher=IBM Cloud |date=07 April 2021 |accessdate=17 April 2021}}</ref> However, it's not clear what logs, if any, are collected and maintained by IBM about your data, let alone whether or not you can access them. You'll have to have this discussion with a representative.

14. '''For HIPAA-eligible data (e-PHI) we may have, will you sign a business associate agreement?'''

Yes, IBM Cloud will sign a business associate agreement.<ref name="IBMCompianceInd">{{cite web |url=https://www.ibm.com/cloud/compliance/industry |title=IBM Cloud compliance programs |publisher=IBM Cloud |accessdate=17 April 2021}}</ref> Consult their [https://www.ibm.com/cloud/compliance/industry cloud compliance page] for more details on their approach to HIPAA compliance.

15. '''What happens to our data should the contract expire or be terminated?'''

Per the Cloud Services Agreement<ref name="IBMCSA18">{{cite web |url=https://www.ibm.com/support/customer/pdf/terms/csa_th.pdf |format=PDF |title=Cloud Services Agreement |publisher=IBM |date=March 2018 |accessdate=17 April 2021}}</ref>:

<blockquote>IBM will return or remove Content from IBM computing resources upon the expiration or cancellation of the Cloud Service, or earlier upon Client’s request. IBM may charge for certain activities performed at Client’s request (such as delivering Content in a specific format). IBM does not archive Content, however some Content may remain in Cloud Service backup files until expiration of such files as governed by IBM’s backup retention practices.</blockquote>

16. '''What happens to our data should you go out of business or suffer a catastrophic event?'''

It's not publicly clear how IBM Cloud would handle your data should they go out of business; consult with a representative about this topic. As for catastrophic events, like other cloud providers, IBM Cloud uses three zones per region (a multi-zone region or MZR) for redundancy: "The advantage of an MZR is that it provides consistent cloud services across different zones, better resiliency, availability, higher interconnect speed between data centers for your resources. These features can be critical to your applications. Deploying the application in an MZR rather than a [single-zone region] can increase the availability from 99.9% to 99.99% when deployed over three zones."<ref name="IBMLocationsRes21">{{cite web |url=https://cloud.ibm.com/docs/overview?topic=overview-locations&locale=en |title=Locations for resource deployment |work=IBM Cloud Docs - Getting Started with IBM Cloud |publisher=IBM Cloud |date=15 April 2021 |accessdate=16 April 2021}}</ref> It's highly unlikely that all three zones would be affected in an catastrophic event. However, if this is a concern, discuss further data redundancy with an IBM Cloud representative. (IBM provides some additional insight by discussing its [https://cloud.ibm.com/docs/overview?topic=overview-zero-downtime approach to availability and disaster recovery] in its documentation.)

17. '''Can we use your interface to extract our data when we want, and in what format will it be?'''

IBM does talk about [https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-region-copy moving data between buckets], but documentation about extracting data from their cloud service and moving it to your own private cloud or transferring it to another cloud service can't be found. IBM does note in a blog post that it is "active in the EU’s Switching Cloud Providers and Porting Data (SWIPO) initiative which lays out requirements for transparency at both infrastructure and software levels."<ref name="NottCloud20">{{cite web |url=https://www.ibm.com/blogs/think/fi-fi/2020/10/20/cloud-portability-and-interoperability/ |title=Cloud portability and interoperability |author=Nott, C. |work=IBM THINK Blog |publisher=IBM |date=20 October 2020 |accessdate=17 April 2020}}</ref> However, it's not clear if IBM Cloud has mapped their cloud processes to the voluntary SWIPO codes of conduct. You'll have to discuss the details of data export and migration—including data formats—from IBM Cloud with a representative.

18. '''Are your support services native or outsourced/offshored?'''

It is unclear if support personnel are local to the customer or if support is outsourced to another business and country. Discuss this with an IBM Cloud representative.

==Additional information==

===Documentation and other media===
* [https://cloud.ibm.com/docs/overview?topic=overview-zero-downtime Disaster recovery documentation]
* [https://www.ibm.com/downloads/cas/3NXVRXG9 HIPAA compliance guide]
* [https://www.ibm.com/cloud/architecture/files/ibm-cloud-security-white-paper.pdf Client security whitepaper]
* [https://www.ibm.com/support/customer/csol/terms/?cat=data-security#detail-document IBM security and privacy principles]

===External links===
* [https://www.ibm.com/cloud/architecture/architectures/ IBM Cloud architecture framework or description]
* [https://cloud.ibm.com/docs/overview?topic=overview-shared-responsibilities IBM Cloud shared responsibility model]
* [https://www.ibm.com/trust IBM Cloud trust center]

==References==
{{Reflist|colwidth=30em}}