Cloud doubters often raise compliance requirements as a barrier to cloud adoption, but in fact cloud providers have many tools to ease compliance with regulations and industry standards. They can help you maintain compliance with the least amount of resources.
There are cloud systems for PCI compliance (for credit card processing), HIPAA compliance (for health care information security and portability), and Sarbanes-Oxley compliance (for process logging at publicly traded companies), as well as systems to handle similar European regulations.
Compliance should be managed as a set of rules and regulations that change over time, not as adherence at a specific in time for a specific regulation. And the cloud is great at managing items that change.
The mechanism is simple: Link in whatever compliance services you need, such as logging and encryption. With that step, you place the compliance volatility in the domain of the cloud provider. As regulations change and evolve, so do the services that the cloud provider delivers.
Be aware that it takes a significant effort on your part to link these services into your on-premises and cloud-based platforms. You have to modify existing systems or build these services into new applications.
Also, most of these compliance services come from specialized providers that may run on a different cloud system, or perhaps on a hosted system, than you use. That also adds complexity to their integration. The good news is that the major cloud providers are starting to offer compliance services directly, so your integration options will grow over time.
But that investment in integration is well worth it. The result is you’re no longer treading water keeping up with the execution legalities that drive compliance. The cloud provider will deal with most of that on your behalf, perhaps even automatically.