News
New Cloud Computing Guidance From ISACA Helps Increase Value and Manage Risk
July 2011 by ISACA
Cloud computing has become a major growth area in IT spending, and enterprises must adapt to the changes it brings to maximise the return on investment. To help organisations worldwide get the most value from the cloud, global IT association ISACA has issued a new guide outlining how to implement effective controls and governance for cloud computing. Titled IT Control Objectives for Cloud Computing: Controls and Assurance in the Cloud, it is now available at www.isaca.org/ITCOcloud.
According to the ISACA guide, when enterprises decide to use cloud computing for IT services, business processes are impacted and governance becomes critical to:
– Effectively manage increasing risk
– Ensure continuity of critical business processes that now extend beyond the data center
– Communicate clear enterprise objectives internally and to third parties
– Adapt effectively
– Facilitate continuity of IT knowledge, which is essential to sustain and grow the business
– Handle myriad regulations
“Cloud computing is not a hype, but a normal evolution in changing the relationship between the IT and business departments on using digital information. Cloud computing delivers many advantages to any type of organization in the world,” said Marc Vael, CISA, CISM, CGEIT, CISSP, director of the Knowledge Board at ISACA and chairman of the Cloud Computing Task Force at ISACA. “On the other side, when implementing cloud computing solutions, specific attention points still must be asked and dealt with, but in my personal opinion these are very similar to the already known control objectives for IT outsourcing of processes and systems,” according to Marc Vael.
“To get the most benefit from their cloud initiatives, enterprises must develop a clear governance strategy and management plan that sets the direction and objectives for cloud computing and executes on the plan,” said Phil Lageschulte, CGEIT, CPA, member of ISACA’s Knowledge Board and leader of KPMG’s Global IT Audit Services. “IT has historically been viewed as a cost center, but the cloud presents the opportunity to fully align it with the goals of the enterprise as a whole and add value to the organization.”
IT Control Objectives for Cloud Computing notes that enterprises must ask the following key questions for proper governance of cloud computing:
– What is the enterprise’s expected availability?
– How are identity and access managed in the cloud?
– Where will the enterprise’s data be located?
– What are the cloud service provider’s disaster recovery capabilities?
– How is the security of the enterprise’s data managed?
– How is the whole system protected from Internet threats?
– How are activities monitored and audited?
– What type of certification or assurances can the enterprise expect from the provider?
The book also outlines business case development, how standards and good practices assist with cloud governance, how to establish business goals for the cloud, risk considerations and responsibilities, and a cloud computing management audit/assurance program.
IT Control Objectives for Cloud Computing is the third book in ISACA’s IT Control Objectives series. The first, IT Control Objectives for Sarbanes-Oxley, was downloaded more than a quarter of a million times. IT Control Objectives for Cloud Computing is available in print (US $60) and e-book (US $50) form. ISACA members can download the e-book free of charge and purchase the print book for US $35.
