Risk and compliance management for cloud computing services: Designing a reference model

Abstract

More and more companies are making use of Cloud Computing Services in order to reduce costs and to increase the flexibility of their IT infrastructures. Currently, the focus is shifting towards problems of risk and compliance which include as well the realm of Cloud Computing security. For instance, since the storage locations of data may shift or remain unknown to the user, the problem of the applicable jurisdiction arises and impede the adoption and management of Cloud Computing Services. Therefore, companies need new methods to avoid being fined for compliance violations, to manage risk factors as well as to manage processes and decision rights. This paper presents a reference model that serves to support companies in managing and reducing risk and compliance efforts. We developed the model on the solid basis of a systematic literature review and practical requirements by analyzing Cloud Computing Service offers.