Along with the need for tools and capabilities that support discovery needs, organisations are increasingly ensuring that they have worked with their cloud providers. In cloud environments, you will often have to consider: - **Right-to-audit clauses**, which are part of the contract between the cloud service and an organization. A right-to-audit clause provides either *a direct ability to audit the cloud provider or an agreement to use a third-party audit agency*. Many cloud providers use standard contracts and may not agree to right-to-audit clauses for smaller organisations. In those cases, they may instead provide access to regularly updated third-party audit statements, which may fit the needs of your organization. If you have specific audit requirements, you will need to address them in the contract if possible, and decide whether or not the ability to conduct the audit is a factor in your organisation's decision to adopt the cloud provider's services. - **Regulatory and jurisdiction concerns** are also a significant element in the adoption of cloud services. Regulatory requirements may vary depending on where the cloud service provider operates and where it is headquartered. *The law that covers your data, services, or infrastructure may not be the laws that you have in your locality, region, or country*. In addition, jurisdictional concerns may extend beyond which laws cover the overall organization. Cloud providers often have sites around the world, and *data replication and other service elements mean that your data or services may be stored or used in a similarly broad set of locations*. Local jurisdictions may claim rights to access that data with a search warrant or other legal instrument. Organisations with significant concerns about this, typically address them with contractual terms, through service choices that providers make available to only host data or systems in specific areas or countries and by technical controls such as handling their own encryption keys to ensure they know if the data is accessed. - **Data breach notification laws**, like other regulatory elements, also vary from country to country, and in the United States, notably from state to state. Contracts often cover the *maximum time that can elapse before customers are notified*, and ensuring that you have an appropriate breach notification clause in place that meets your needs can be important. Some vendors delay for days, weeks, or even months, potentially causing significant issues for customers who are unaware of the breach. Organisations that use cloud services must have a plan to handle potential incidents and investigations that doesn't rely on direct forensic techniques. ### Regulation and Jurisdiction Issues: Venue and Nexus Regulatory and jurisdictional issues also come into play with two other legal concepts. The first is **venue**, which is the *location where a case is heard*. Many contracts will specify venue for cases, typically in a way that is beneficial to the service provider. If you sign a contract and don't pay attention to venue, legal cases might have to be handled far away in another state. At the same time, **nexus** is the *concept of connection*. A common example of nexus is found in the decision of whether a company has nexus in a state or locality and must charge tax there. For years, nexus was decided on whether the company had a physical location, distribution centre, or otherwise did business physically in a state. Understanding how and why nexus may be decided can be important when you are *considering laws and regulations that may impact your organisation*.