Critical Privacy Questions to Ask an HCM/CRM SaaS Provider

Research Publication Date: 31 July 2009 ID Number: G00168488 Critical Privacy Questions to Ask an HCM/CRM SaaS Provider Carsten Casper, Thomas Otter, Arabella Hallawell The vast majority (probably greater than 90%) of personal data in most organizations is processed by human capital management (HCM) and customer relationship management (CRM) software. Such software is increasingly delivered via the softwareas-a-service (SaaS) model. The processing of personal data is crucial for these applications, making privacy controls extremely important, and a long series of security breaches involving the loss of huge amounts of personal data has increased public awareness of privacy concerns. Enterprises using SaaS HCM or CRM must include privacy requirements including some that do not apply to traditional software delivery in all provider evaluations. Key Findings Although there is a common perception that using SaaS creates new privacy risks, one should not forget that privacy requirements for SaaS providers are largely the same as those for traditional software delivery (for example, masking of test data, encryption and monitoring of access). SaaS-based delivery of HCM and CRM applications may make it necessary to implement additional privacy controls (for example, separation by country and contractual controls). Best practices for SaaS providers require encryption, access monitoring, and security and privacy audits, but most SaaS providers do not yet use the capabilities of data loss prevention (DLP) tools There are also differences between major providers and many much smaller vendors that often have fewer than 50 employees and are not strong on data privacy. Recommendations Request that SaaS providers of HCM and CRM applications perform log monitoring (especially for privileged users), encrypt data transmissions over public networks and conduct privacy audits. If your enterprise operates across international borders, ask your SaaS provider to segregate or tag customer data and employee data from different countries (for example, within the database schema, or via fine-grained access control at the application layer). If your provider processes personal data in a country other than yours, ensure that legal controls are in place to protect this data. For example, ask your provider to sign the Reproduction and distribution of this publication in any form without prior written permission is forbidden. The information contained herein has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Although Gartner's research may discuss legal issues related to the information technology business, Gartner does not provide legal advice or services and its research should not be construed or used as such. Gartner shall have no liability for errors, omissions or inadequacies in the information contained herein or for interpretations thereof. The opinions expressed herein are subject to change without notice.

European Union's (EU's) standard contractual clauses for privacy, or ask for certification under the U.S. Department of Commerce's Safe Harbor program, if possible. Use the questions outlined in this research when evaluating potential providers. Publication Date: 31 July 2009/ID Number: G00168488 Page 2 of 9

TABLE OF CONTENTS Analysis... 4 1.0 SaaS Providers and Privacy Considerations... 4 2.0 Regional Privacy Issues... 4 2.1 Personal Data in the U.S. and Europe... 4 2.2 Cross-Border Data Transfers... 5 2.3 The U.S. Patriot Act... 5 2.4 Geographical Isolation of Personal Data... 5 3.0 Operational Aspects of Privacy... 5 3.1 Data Masking... 5 3.2 Locating Personal Data... 6 3.3 Segregation of Client Data... 6 3.4 Monitoring of Access to Personal Data... 6 3.5 Encryption and DLP... 6 3.6 Vulnerability Scans and Security and Privacy Audits... 6 4.0 Privacy Questions to Ask an HCM/CRM SaaS Provider... 7 Recommended Reading... 8 LIST OF TABLES Table 1. Privacy Questions to Ask and Answers to Expect From Your HCM/CRM SaaS Provider. 7 Publication Date: 31 July 2009/ID Number: G00168488 Page 3 of 9

ANALYSIS 1.0 SaaS Providers and Privacy Considerations Today, privacy requirements are more important for HCM and CRM applications than five years ago, when security, performance, uptime and functionality were the dominant requirements. Nowadays, with the big HCM/CRM players and many of the smaller ones the technical security of the vendor is often better than the buyer's, and performance and uptime seem to be good enough for most clients. The issues that matter more to buyers now are integration and legal compliance, and privacy has risen to be one of the few remaining "showstoppers" for some buyers particularly in Europe and in some specific industries, like healthcare, banking, defense and some government functions. Gartner surveyed a number of providers that offer HCM SaaS (talent management, recruitment, workforce administration, performance management, time management and payroll) or CRM SaaS (marketing automation, customer service and support) about their privacy practices. Most SaaS providers' privacy practices are not fundamentally different from the traditional approach taken in IT infrastructure and business process outsourcing relationships. A few providers salesforce.com among them differentiate between SaaS privacy policy and standard website or hosting privacy policy. A provider's privacy program may be managed by the information security organization, a chief security officer or a dedicated privacy officer, and in some cases, a governance risk and compliance department or a global quality assurance manager is in charge. This diversity in management and reporting structures reflects industry trends. Responsibility for privacy is typically shared by the provider and the customer. Few providers are willing to state explicitly that the customer is ultimately responsible for privacy. Providers typically assume responsibility for implementing organizational, technical and procedural privacy controls on their end, and they help to maintain and improve information security within the client enterprise and minimize its exposure to risks. However, the client is typically held accountable by regulatory authorities under the law. The details of privacy responsibilities are sometimes specified in a data controller (client) to data processor (provider) contract. 2.0 Regional Privacy Issues 2.1 Personal Data in the U.S. and Europe SaaS can be provided from any location and can be consumed in any location, but most of the data centers used by the HCM/CRM SaaS providers consulted in the creation of this document are located in either the U.S. or the EU. However, many HCM/CRM SaaS providers do not, regrettably, make a meaningful distinction among U.S., EU and other regions' requirements. Providers typically claim that they can take a global approach to privacy and are still able to address any country-specific requirements. Clients must verify whether a specific provider can, in fact, meet national regulatory requirements for privacy (for example, whether the provider truly understands varying personal data notification requirements in different European countries, varying breach notification requirements in the U.S., and the impact that e-discovery obligations and national surveillance legislation, such as the U.S. Patriot Act and the EU Data Retention Directive, have on privacy). Publication Date: 31 July 2009/ID Number: G00168488 Page 4 of 9

2.2 Cross-Border Data Transfers To legalize cross-border transfers of personal data and especially for transatlantic transfers SaaS providers use the U.S./EU Safe Harbor framework, the EU's standard contractual clauses, or both. U.S. providers are quick to point to their Safe Harbor compliance as a valuable element of their approach to privacy, despite the agreement's limited applicability (financial services, insurance and other industries are not eligible for Safe Harbor certification) and enforcement concerns expressed by privacy advocates. The Safe Harbor dispute resolution mechanism often resides in Europe a requirement for the processing of HR data and escalation can be done via agencies such as the U.K. Information Commissioners Office. HCM/CRM SaaS providers are already used to signing standard contractual clauses (for example, data-controller-to-data-processor contracts) in addition to security clauses required by clients. This is particularly relevant when the provider uses a thirdparty external service provider. If this is the case, then that third party must be contractually required to adhere to the SaaS provider's security and privacy practices. For more details on transfers of personal data between countries, see "Tutorial for Navigating Privacy Legislation in Europe," especially Figure 2. 2.3 The U.S. Patriot Act The SaaS providers that Gartner has surveyed report that they have not yet received requests for data based on the U.S. Patriot Act. They indicate that they would evaluate such a request on a client-by-client basis, would work with both government authorities and the client, and would typically escalate the request to legal counsel. In any case, access could be granted for legal purposes only. The legal department would always be involved and would need to confirm the granting of access. One provider, MrTed, goes so far as to say that it would not disclose any data unless the client approved the request. 2.4 Geographical Isolation of Personal Data Given the different regulatory regimes in the U.S. and in Europe, the segregation of data from different regions would be helpful. Some European providers, such as MrTed, Patersons and NorthgateArinso, can isolate personal data to a specific geography. This can be implemented with database segmentation or by restricting access to the data based on a user's geographic location. U.S. providers such as Authoria and Workday are less worried about regional separation and typically cannot isolate the hosting of personal data to a specific geography. They point to their data-handling policies, their SafeHarbor certification and to model contract clauses as protective measures. Interestingly, the U.S.-based Ultimate Software is considering opening a data center in Canada to address the needs of Canadian clients subject to that country's strict privacy requirements (which are very similar to EU requirements). 3.0 Operational Aspects of Privacy HCM/CRM SaaS providers must address privacy concerns similar to those that affect traditional HCM/CRM software vendors. However, because the client is not in control of the application environment, the provider should be required to answer additional questions about privacy practices before any contract is signed. 3.1 Data Masking The use of personal data for testing purposes is a significant security concern, regardless of the software delivery model. SaaS providers have found different ways of using test data (for example, deploying data masking technologies). Some have their own scrambling tools for Publication Date: 31 July 2009/ID Number: G00168488 Page 5 of 9

transferring personal data to test and development environments, with all test data anonymized and held on separate servers. All access to such data is segregated by access control and is monitored and audited monthly by the compliance department. Some providers use applications that have the capability to mask fields or encrypt data values in a database. Others store unscrambled information in the database, but any data removed from the database is scrambled via a customer script. And other providers operate a production environment that is completely separate from the development and quality assurance (QA) testing environment, and do not need to use or scrub customer data for development or QA testing purposes, because they do not use real data for testing. 3.2 Locating Personal Data Finding personal data in applications and data stores is not a problem that HCM/CRM SaaS providers address with technology. The providers Gartner has surveyed emphasize that their policies dictate where personal data is stored (typically on dedicated servers, sometimes with hard copy maintained in a separate, locked room). The location of personal data is reviewed during internal privacy assessments and audits. Providers do not currently use additional tools to find personal data that they may not be aware of. 3.3 Segregation of Client Data Segregation of data from different clients a key concern for all HCM/CRM SaaS providers is addressed at the database or application layer. Some providers segregate clients within the database, use separate database schemata, or implement logical and physical database segregation. Others use different SAP environments or deploy a multitenant SaaS architecture or a multitenant data model. Moreover, some providers allow clients to further segregate control to prevent one subset of their own employees from accessing information in another client-owned location. 3.4 Monitoring of Access to Personal Data HCM/CRM providers do not generally monitor employees' access to personal data differently from any other form of access to sensitive information. Typically, every employee logs in using a named account with a unique identifier. Authorization and application profiles determine logical access rights. Access must be appropriate, based on business needs. All access is recorded, and transaction logs are monitored, with some providers using Tripwire or intrusion detection systems to detect security breaches. Some providers (for example, Patersons) review access reports weekly, compiling them into monthly reports that are audited as part of a larger compliance monitoring effort. 3.5 Encryption and DLP The HCM/CRM SaaS providers most commonly encrypt data on their notebook computers, and some providers also encrypt data in transit and data at rest in applications and databases. However, very few providers use DLP tools. (Ultimate Software uses DLP in the e-mail infrastructure in monitoring mode and MrTed plans some disclosure control to track transported media and verify who has received data in transported media.) 3.6 Vulnerability Scans and Security and Privacy Audits Vulnerability scans and internal and external penetration tests (including unexpected audits and operation center intrusion tests) are quite common for HCM/CRM SaaS providers. Many allow clients to conduct audits themselves (although audits may be limited in frequency, for example, to Publication Date: 31 July 2009/ID Number: G00168488 Page 6 of 9

once a year). A third-party audit (for example, a Statement on Auditing Standards [SAS] 70 Type II audit on the service every six month or an International Organization for Standardization [ISO] 27001 audit on security every year) is a more common approach, used by providers such as NorthgateArinso, Patersons, Ultimate Software and Workday. This does not necessarily mean that providers also scan their websites for privacy-related vulnerabilities or for privacy policy compliance. Among the providers Gartner surveyed, only Authoria has received a TRUSTe privacy seal, following a dedicated privacy assessment. Others consider privacy compliance to be sufficiently enforced via third-party audits, internal audits, internal privacy impact assessments or an annual renewal of Safe Harbor certification. Providers also conduct privacy training to varying degrees. Sometimes, it is part of new hire training; sometimes it is part of IT security training. Paterson also uses privacy training material from the U.K.'s Information Commissioners, followed by periodic refresher training. 4.0 Privacy Questions to Ask an HCM/CRM SaaS Provider Use the questions in Table 1 to find out more about the way your HCM/CRM SaaS provider protects personal data. Compare the provider's response to the answer that you can reasonably expect. Table 1. Privacy Questions to Ask and Answers to Expect From Your HCM/CRM SaaS Provider Question How do you gather privacy requirements? How do you monitor compliance with privacy requirements? How do you monitor compliance with security requirements? Do you sign EU model contracts on privacy? Are you Safe Harbor certified? How do you test your applications with personal data? How do you locate personal data? How do you segregate data from different clients? Expected Answers Providers should point to country-specific privacy legislation (and industry-specific legislation in the U.S.), in addition to client-specific requirements. A global approach to privacy ("one size fits all") is unlikely to be sufficient. They should also refer to expert legal advice. Expect different answers, including privacy audits, privacy impact assessments, security audits, establishment of a privacy officer's position and website privacy scans. Privacy training for employees is desirable, but is not the norm. In most cases, the provider will conduct vulnerability scans and penetration tests. SAS Type II certification is common, and ISO 27001 certification is increasing worldwide. Signing these model contracts (after legal review) is standard business practice. Safe Harbor certification is a weak alternative. If the provider does none of this, the client can only accept the compliance risk (or choose another provider). See "Tutorial for Navigating Privacy Legislation in Europe" for details and seek legal advice. Various solutions exist, and what is most important is that the provider gives a plausible answer. Masking can happen in the database or when data is transferred, using commercial tools or homegrown scripts. Automated solutions are not common, and providers will likely refer to their data location policies. Use of DLP technology can be considered a plus. Various solutions exist. Segregation can happen in the database, in the application or at infrastructure level. It can also be part of the SaaS architecture. Publication Date: 31 July 2009/ID Number: G00168488 Page 7 of 9

Question How do you monitor access to personal data? Where do you use encryption? Did you obtain a privacy certification? How long do you retain personal data after the contract terminates? Source: Gartner (August 2009) Expected Answers Do not expect a privacy-specific answer. However, the provider should have some access logging and monitoring in place, especially for privileged users. Most likely, the provider will claim to have encrypted sensitive data where necessary. Focus your attention on information stored on mobile devices and data in transit. Safe Harbor is a legal requirement, but does not guarantee sound privacy. Privacy seals are an additional plus, but there are also no guarantees, and they are not very common. A "No" answer to this question may be acceptable, too. The answer will depend on local regulatory requirements, but strict privacy laws typically request that data be deleted immediately. RECOMMENDED READING "Critical Security Questions to Ask a SaaS Provider" "Data Masking Best Practices" "Gartner for IT Leaders Overview: The Privacy Officer" "Top Five Issues and Research Agenda, 2009-2010: The Privacy Officer" "Testing Times for HR Systems and EU Data Protection Law" "Tutorial for Navigating Privacy Legislation in Europe" "Web Site Trust Seals: Less Than Meets the Eye" Publication Date: 31 July 2009/ID Number: G00168488 Page 8 of 9

REGIONAL HEADQUARTERS Corporate Headquarters 56 Top Gallant Road Stamford, CT 06902-7700 U.S.A. +1 203 964 0096 European Headquarters Tamesis The Glanty Egham Surrey, TW20 9AW UNITED KINGDOM +44 1784 431611 Asia/Pacific Headquarters Gartner Australasia Pty. Ltd. Level 9, 141 Walker Street North Sydney New South Wales 2060 AUSTRALIA +61 2 9459 4600 Japan Headquarters Gartner Japan Ltd. Aobadai Hills, 6F 7-7, Aobadai, 4-chome Meguro-ku, Tokyo 153-0042 JAPAN +81 3 3481 3670 Latin America Headquarters Gartner do Brazil Av. das Nações Unidas, 12551 9 andar World Trade Center 04578-903 São Paulo SP BRAZIL +55 11 3443 1509 Publication Date: 31 July 2009/ID Number: G00168488 Page 9 of 9