compliance as a service (CaaS)

Compliance as a Service (CaaS) is a cloud service service level agreement (SLA) that specified how a managed service provider (MSP) will help an organization meet its regulatory compliance mandates. Compliance support services in the cloud are often used by large organizations that operate in highly-regulated industries such as healthcare, banking and finance. The goal of Compliance as a Service is to reduce an organization’s compliance burden by outsourcing compliance management tasks to a third-party that has the resources required to meet regulatory requirements in a more cost-effective manner. 

CaaS providers typically supply their customers with access to software and support materials that have been designed to be compliant with specific regulations. This is because compliance concerns manifest themselves in different ways, depending on the organization's line of business and location. For example:

• In healthcare, the Health Insurance Portability and Accountability Act (HIPAA) requires network administrators to create logical boundaries between protected and unprotected workflows.
• In finance, the Sarbanes-Oxley Act (SOX) requires specific encryption levels for different data types.
• In retail, PCI-DSS requires people and programming to have a business justification for accessing cardholder data.
• In Europe, the EU Data Protection Act requires European customer data to be stored on servers located in Europe. 

Typically, CaaS offerings include assessing an organization's current governance, risk and compliance (GRC) strategies and helping the organization's Chief Compliance Officer (CCO) create and manage policies that support best practices both on site and in the cloud. To be effective, a CaaS provider’s services must be transparent. Customers should be able to easily monitor the service and confirm their data is being handled in accordance with legal restrictions and corporate policies.