"When there is a security incident, we assign an incident coordinator whose job is to triage that incident. And I think a big misnomer about this is if there is a security incident that affects customer data, we believe and contractually commit that it is our responsibility to notify those customers. There's an idea that if something happens to your data, you won't know. For sure - we will tell you."
He says for all the hand wringing about Cloud security, it's important to maintain perspective, even though he admits it is no panacea.
"We make headlines because we are Google," he says. "But the reality is worse stuff is happening in the traditional environment every day.
"Is Cloud computing perfect security? No. It's not. I'll be the first one to say that. I was in an intelligence community where we proved we could find out information about a computer that was not connected to a network and was in a secure room, using various technologies. But I think Cloud computing is as secure, if not more secure, than what most organisations are doing today."
Sign up for CIO Asia eNewsletters.