Gartner Says Organizations More Likely to Use SaaS for Sensitive Data Than Mission-Critical Data
August 23, 2012
Share this

Avoiding the use of software as a service (SaaS) for critical or sensitive data remains a significant form of risk control for many organizations, according to Gartner, Inc. But those that do use SaaS for such data are more likely to use it for sensitive data than for mission-critical data.

These findings are based on Gartner's latest annual survey of the state of risk management programs globally, which questioned 425 respondents from IT risk management disciplines in the U.S., U.K., Germany and Canada from December 2011 to January 2012.

The survey results show that organizations take different approaches to risk management when confronted with a need or opportunity to share data with different types of external party.

Assessment Practices for External Parties

Survey respondents were asked if they had processes in place to assess external party security, risk management, compliance, privacy and BCP/DR for four different situations. Respondents answered: “Do not allow use for sensitive data or processes" almost twice as often in the case of business partners (38 percent) as for platform as a service (PaaS) and infrastructure as a service (IaaS) (20 percent).

Compared with PaaS/IaaS, organizations are about 30 percent more likely to have a policy against putting sensitive data into SaaS (26 percent), and about 45 percent more likely to have a policy against putting it into outsourced data centers (29 percent).

"These results make sense, given that sharing data with a partner almost certainly means that one or more of its employees will be accessing the data, while in a SaaS scenario, the data is typically only accessible to the primary customer," said Jay Heiser, Research VP at Gartner. "This year we asked about both data availability and data confidentiality policies. Survey respondents indicated 10 percent less willingness to place mission-critical data into a SaaS offering than to place sensitive data into it. They were even less willing to place mission-critical data into outsourced data centers, with over one-third of respondents saying that they do not allow it."

Platform-as-a-Service/Infrastructure-as-a-Service Risk Assessment Practices

Only 57 percent of IaaS/PaaS buyers are using a questionnaire to support their risk assessment, and unlike for SaaS, the questionnaire is more likely to be a proprietary one, unique to the buyer's organization, and less likely to be based on standards. As in the case of SaaS, 26 percent are also evaluating information from the provider. The most dramatic change over the past three years is the increased willingness to use IaaS and PaaS for sensitive processes.

Outsourced Data Center Risk Assessment Practices

Thirty-six percent of respondents said they had a policy against putting mission-critical data into an outsourced data center, making avoidance the most chosen mechanism for dealing with data center risk. The level of response for this choice is significantly higher than for either of the other two service models. Twenty-nine percent said this policy applied to SaaS, and only 22 percent said it applied to IaaS/PaaS.

"One of the biggest drivers is probably an expectation that the packaged service offerings, which typically claim to be based on cloud computing, are more reliable," said Mr Heiser. "While fault tolerance is a feature of many such offerings, we consider it premature to assume that mission-critical data is safer in a cloud than in a traditional data center in which buyers usually make very specific choices about how data will be backed up."

The most significant reduction in the use of risk assessment practices has been in the practice of sending company staff to evaluate a partner's controls on-site, which has dropped by over 40 percent over three years. Use of standards-based questionnaires has increased, while the use of proprietary surveys has dropped by the same degree, leaving the prevalence of questionnaires virtually the same.

Share this

The Latest

September 17, 2020
One of the benefits of doing the <span style="font-style: italic;">EMA Radar Report: AIOps- A Guide for Investing in Innovation</span> was getting data from all 17 vendors on critical areas ranging from deployment and adoption challenges, to cost and pricing, to architectural and functionality insights across everything from heuristics, to automation, and data assimilation ...
September 16, 2020

When you consider that the average end-user interacts with at least 8 applications, then think about how important those applications are in the overall success of the business and how often the interface between the application and the hardware needs to be updated, it's a potential minefield for business operations. Any single update could explode in your face at any time ...

September 15, 2020

Despite the efforts in modernizing and building a robust infrastructure, IT teams routinely deal with the application, database, hardware, or software outages that can last from a few minutes to several days. These types of incidents can cause financial losses to businesses and damage its reputation ...

September 14, 2020

In Episode 7, Will Cappelli, Field CTO of Moogsoft and Former Gartner Research VP, joins the AI+ITOPS Podcast to discuss the future of APM, AIOps and Observability ...

September 11, 2020

Mark Thiele on the AI+ITOPS Podcast: "I believe AIOps will be everywhere, or you will be failing if you're attempting to do scale ..."

September 10, 2020

How is the AIOps market evolving? The answer in five words is: "Toward increasing levels of diversity." In the EMA Radar Report AIOps: A Guide for Investing in Innovation, EMA examined 17 vendors with cross-domain AIOps capabilities, along with doing 31 deployment interviews, and discovered a high degree of variety in design, functionality and purpose ...

September 09, 2020

In 2020, our society is undergoing massive upheaval and businesses are being forced to adapt on the fly. During this period of crisis, the companies that make the necessary adjustments the quickest will succeed. We're already seeing it happen in the accelerated push toward digitization, as companies that smoothly digitize their customer experiences move forward and those that don't get left behind ...

September 08, 2020

In Episode 6, Mark Thiele, Co-Founder and CEO of Edgevana, joins the AI+ITOPS Podcast to discuss taking AIOps to the edge ...

September 04, 2020

Bhanu Singh on the AI+ITOPS Podcast: "AIOps is an enabler for us to manage the complex digital world that we are stepping in at lightning speed ..."

September 03, 2020
Businesses — in order to remain competitive, agile, innovative, secure, and profitable — are embracing digital transformation. However, achieving success has often been a pipedream for many given the need to usher in cultural change and upgrade of the legacy systems. So, even when business leaders are in agreement with the need for embracing enterprise digital transformation, why is it that only a few have implemented it? What are the biggest barriers to a successful digital transformation initiative? Let us find out ...