User Risk Management Strategies and Models – Adaption for Cloud Computing

Abstract

Third party services are an alternative to in-house ICT production and widely engaged. But the use of such industrialized and standardized ICT services, especially cloud computing, seems to conflict with underlying principles of risk management and security. A schema for the classification of service delivery models is introduced to realize the situation. Sourcing is a rather linear sequence of actions, whereas risk management is highly recurring and iterative. In an adapted process user organisations will not decode every specific security control since that is no longer appropriate in industrialised ICT production markets. Users will concentrate on rating the vendor (“who”) and assessing the service (“what”). Then special issues (“how”) are considered. Detailed guidance is given for these three steps. In this paper an adapted approach to user risk management is described. By this means users can get the most out of novel ICT provisioning models.