Workshop B — Operationalizing Clouds as Data Infrastructure Amid Complex Export Controls: Navigating Complex Data Outsourcing Needs, Creating Strategic Service Contracting Relationships

May 14, 2024 1:30pm – 05:00 PM

Zvonimir Bandic
Vice President, CPU R&D
Cadence Design Systems

Bob Bowen
Export and Trade Compliance Counsel
ServiceNow

Christopher Timura
Partner
Gibson Dunn & Crutcher LLP

Cloud service providers can help IT leaders set up for success – for instance, improving deployment speed and ensuring future flexibility. But how should IT and Compliance work together to prepare data to be outsourced? Where do export controls and IT intersect? This workshop will examine best practices from a variety of industry perspectives.

  • Materiality assessments prior to any outsourcing decision (which activities should be considered as material, and in what areas)
  • Security of data and systems: Obligations for the provider to protect the confidentiality of the outsourced information and key checks to be performed by the institution prior to outsourcing that should be then included in outsourcing agreements with third parties
    • Encrypting data prior to sending it to the cloud and requiring the cloud vendor to use encryption technology
  • Location of data and data transfers between controllers and processors
    • Retaining visibility of any date subcontracting arrangements
  • Supply chain outsourcing: Ensuring that service levels and oversight are not affected
  • Negotiating robust contractual provisions, including access and audit rights in outsourcing agreements
  • Contingency plans: Exiting cloud outsourcing without affecting export-controlled data