►
From YouTube: ESPA Module - Legal and Contracts
Description
Stu Berman (CTO) with PiKNiK discusses the legal and contractual considerations at the Enterprise Storage Provider Accelerator (ESPA) bootcamp week that took place in February 2022. This discussion includes general contractual elements, legality of storing data, SLAs, Service Organization Controls (SOC 2) audit standards and governance, and the right to be forgotten (RTBF).
Data is growing at an incredible speed and much of this data is archived and/or simply lost by enterprises. Our program will accelerate net-new Enterprise Storage Providers into the ecosystem, using a Web3 protocol with an impressive incentive model called Filecoin.
Learn more at:
Sign-up: https://web3espa.io
Landing Page: https://m.fil.org/espa-bootcamp
Follow ESPA:
Twitter: https://twitter.com/web3ESPA
LinkedIn: https://www.linkedin.com/company/web3espa/
A
During
the
inaugural
boot
camp
week
in
las
vegas
for
cohort
number,
one
jonathan
dotan
provided
his
view
on
the
future
of
web3
storage,
as
it
relates
to
legal
issues.
However,
this
presentation
is
supplementary
to
that
for
all
participants
to
cover
the
general
legal
aspects
of
storing
enterprise
data.
As
with
other
modules,
more
detailed
information
is
documented
and
linked
to
the
filecoin
website
of
our
learning
management
system.
A
Now
contracts
are
legal
agreements
between
two
parties
or
more
legally
binding
contracts
must
have
essential
elements
in
order
to
be
enforced
in
court.
Some
contracts
that
are
missing
one
or
two
of
these
essentials
will
still
hold
up
in
court,
but
it
is
best
to
have
all
of
them
covered,
get
professional
advice
from
a
contract
review
attorney
when
possible.
A
A
Your
contract
with
the
client
or
your
customers
should
include
provisions
about
the
type
of
data
stored
and
its
legality.
Data
that
is
legal
in
one
jurisdiction,
may
not
be
considered
legal
in
another.
One
example
might
be
data
with
a
protected
copyright,
even
if
a
customer
believes
the
data
is
not
illegal.
There
may
be
cases
where
a
copyright
holder
files
a
claim
against
your
customer,
which
then
compels
you
to
delete
the
data.
A
In
some
cases
you
may
be
in
a
position
where
the
complaint
is
in
one
legal
jurisdiction
and
the
customers
in
another
legal
jurisdiction
and
where
you
store
the
data
and
where
you
maintain
your
business,
is
in
a
third
jurisdiction
you're
going
to
need
a
professional
legal
advice
to
sort
this
out.
It
is
not
simply
a
matter
of
being
able
to
delete
the
data
at
a
customer's
request.
A
A
A
Now
I'll
refer
you
for
a
detailed
look
at
this
to
our
michael,
fair,
whose
present
presentation
on
marketing
and
acquiring
customers
gives
you
a
broader
scope,
but
in
a
nutshell,
we
want
to
look
at
the
client
broker
models
that
enterprise
service
providers
may
be
using
as
an
enterprise
storage
provider.
They're
going
to
be
cases
where
the
enterprise
storage
provider
deals
directly
with
an
enterprise
customer
seeking
to
have
their
data
stored.
A
A
In
these
cases,
the
enterprise
storage
provider
needs
to
fully
understand
the
relationship
and
expectations
of
those
brokers,
whether
in
terms
of
data
legality,
slas
and
any
negotiated
requirements
such
as
the
requirement
to
host
file
coin
storage
in
commercial
data.
Centers
other
broker
models
may
be
a
hybrid,
such
as
a
managed
service
provider
that
provides
hosting
services,
but
the
enterprise
storage
provider
provides
compute
services
such
as
ceiling
workers.
A
A
service
providers
to
enterprises
are
expected
to
provide
audit
documentation
of
process
controls.
The
sac2
standard
was
built
upon
the
older
sas
70
framework
by
the
international
auditing
and
assurance
standards
board.
It
has
since
been
updated
to
terms
such
as
isa,
3402
and
then
ssae,
16
or
now
commonly
known
as
soc2.
A
Most
enterprises
value
the
sock,
2
type
2
annual
report,
which
looks
at
both
design
controls,
or,
I
should
say,
controls
design
as
well
as
effectiveness
based
on
sampling
control
evidence
throughout
the
year.
It
is
important
to
note
that
soc2
is
a
controls
framework
and
is
not
a
security
certification.
A
However,
as
the
security
trust
service
principle
is
mandatory
in
any
sock
to,
there
is
an
expectation
of
an
underlying
security
control
framework
such
as
annual
penetration
testing
and,
ideally,
a
security
framework
such
as
iso
27001,
which
is
an
international
standard
or
the
nist.
Cyber
security
framework
and
cis
critical
security
controls-
these
are
federal
or
u.s
based
organizations
that
expect
to
have
cyber
security
insurance
will
also
find
that
insurance
carriers
expect
some
of
these
security
controls
to
be
in
place,
such
as
the
widespread
use
within
your
or
your
organization
of
multi-factor
authentication,
mfa
and
anti-virus
protection.
A
So
sock
2
is
the
abbreviation
for
system
and
organization
control
or
sometimes
you'll,
hear
it
service
organization,
control,
type
2.
It's
an
auditing
procedure
designed
to
ensure
that
a
third
party
service
providers
are
securely
managing
data
to
protect
the
privacy
and
the
interest
of
their
client
sock.
2
is
based
on
the
american
institute
for
certified
public
accountants,
trust
services
criteria
and
focuses
on
system
level
controls
of
the
organization.
A
This
specifies
three
types
of
reporting:
sock
1,
which
is
really
a
financial
report.
Sock
2,
which
is
what
we're
talking
about
here,
deals
with
protection
and
privacy
of
data
based
on
the
trust
services
criteria
and
then
there's
sock
3,
which
deals
with
the
same
information
as
sock,
2
report.
But
it's
intended
for
a
general
audience
and
can
be
published
publicly.
A
A
Sock
2
requires
your
organization,
have
security
policies
and
procedures
in
place
and
to
ensure
that
they
are
followed
by
everyone.
Your
policies
and
procedures
form
the
basis
of
the
review
which
will
be
carried
out
by
independent
auditors.
However,
it
is
important
to
note
that
sock
2
is
fundamentally
a
reporting
framework
and
not
a
security
framework.
Sock
2
demands
reports
on
your
policies
and
procedures
that
are
established
to
give
you
effective
control
over
your
infrastructure,
but
does
not
dictate
what
those
controls
should
be
or
how
they
ought
to
be
implemented.
A
The
policies
and
procedures
should
cover
the
controls
grouped
into
the
following
five
categories,
called
trust
service
principles.
Number
one
is
security.
Now
security
is
the
foundational
principle
of
your
sock,
two
audit.
It
refers
to
the
protection
of
your
system
against
unauthorized
access.
It's
a
mandatory
principle.
You
cannot
have
a
sock
too
without
having
the
security
principle.
A
The
second
principle
is:
availability
principle
of
availability
sure
requires
that
you're
ensure
your
system
and
data
will
be
available
to
the
customer
stipulated
in
your
contract
or
slas.
The
third
one
is
processing
integrity.
The
processing
integrity
principle
requires
that
you
protect
your
system
and
data
against
unauthorized
changes.
A
A
This
is
the
newest
principle,
one
that
is
still
being
worked
out
within
the
audit
community,
but
the
basic
principles
are
in
place
for
this
trust
principle.
It
deals
with
how
your
system
collects
retains,
discloses
and
disposes
of
personal
information
and
whether
it
conforms
to
your
privacy
policy,
as
well
as
the
aicpas
generally
accepted
privacy
principles.
A
A
This
was
in
order
to
give
european
union
citizens
and
residents
the
right
to
request
the
removal
of
their
personal
online
data
in
other
nations,
including
the
us,
similar
regulations
are
being
considered,
and
numerous
lawsuits
have
been
upheld
have
upheld
that
require
erasure
of
personal
data
as
an
enterprise
storage
provider.
You
may
be
storing
with
or
without
your
knowledge,
personal
information
that
may
be
subject
to
these
regulations
again.
This
is
something
that
you're
going
to
need,
an
attorney
for,
because
the
rules
are
complex
and
often
you
won't
know
who
that
end
user
is.