Where must an organisation's ownership rights over its data be established?

1. Possession of the hardware belongs to the provider. 2. Ownership of the data must be settled in writing. 3. Ownership rights over the data must be firmly established in the service contract. 4. That enables a basis for trust and privacy of data. _Source: NIST SP 800-144, 'Guidelines on Security and Privacy in Public Cloud Computing'_