Governance of Cloud Computing

Abstract

With cloud computing, organizations delegate direct control of all or part of their ICT organization to an external party. The responsibility of governing the third party and its actions remains with the delegating organization. This aspect is particularly relevant in the case of financial institutions; the regulatory bodies (normally the central banks) still lay the responsibility for any wrongdoing on the financial institutions. Cloud services bring benefits; nevertheless, before using them, an organization should go through a conscious and active evaluation and, if necessary, remediation of any possible risk connected with this choice. Cloud computing does not mean purely and simply a transfer of assets to support a business; cloud computing is also a partnership relationship, in that the two parties intend to achieve common benefits, and the risks and opportunities are shared between them. As with any outsourcing relationship, cloud computing brings with it the serious issue of the procuring entity’s loss of knowledge of the activity outsourced. Such a partnership is always subject to the threats of the relationship not being an equal one; one of the parties is in a dominant position, due to the skills with which it handles certain processes. This is especially true in the case of cloud computing, since should problems arise it would be very difficult to insource the services moved to the cloud. Financial institutions should take particular care with the governance of the relationship of cloud computing.