Hosted services (cloud services, e.g. platform, software, data storage, archiving, backup or processes as a service) should be treated like any other supplier service and require written agreements describing the roles and responsibilities of each party. It is the responsibility of test facility management to evaluate the relevant service and to estimate risks to data integrity and data availability. Test facility management should be aware of potential risks resulting from the uncontrolled use of hosted services. (OECD Document No 17, paragraph 39). Written agreements (contracts) should exist between the test facility and the supplier. These agreements should include clear statements outlining the responsibilities of the supplier as well as clear statements about data ownership. (OECD Document No 17, paragraph 34).
