If we use cloud hosted servers do they need to be qualified in the same way as our local datacentre servers?
Can we leverage vendor documentation to prove these are suitable?
Tx
M
In my opinioun, yes you would qualify a cloud hosting environment using the same methodology you would use for any vendor and a hosting data center is a good example. While I’m not that familiar with any particular cloud service, we are looking at them for back up services to support both the back up and restore process as well as DR in the long run. I can hear our internal auditors now asking me, “how did you qualify them”. If you have an existing SOP or policy or vendor qualification process, going through that process should satisfy your the qualification. Leveraging vendor documentation if it falls within your SOP would probably be suitable.