Cloud computing has become a major growth area in IT spending, and enterprises must adapt to the changes it brings to maximise the return on investment. To help organisations worldwide get the most value from the cloud, global IT association ISACA has issued a new guide outlining how to implement effective controls and governance for cloud computing.
Titled IT Control Objectives for Cloud Computing: Controls and Assurance in the Cloud, it is now available at www.isaca.org/ITCOcloud.
According to the ISACA guide, when enterprises decide to use cloud computing for IT services, business processes are impacted and governance becomes critical to:
· manage increasing risk
· ensure continuity of critical business processes that now extend beyond the data center
· communicate enterprise objectives internally and to third parties
· Adapt effectively
· Facilitate continuity of IT knowledge, which is essential to sustain and grow the business; and
· Handle myriad regulations.
โCloud computing is not a hype, but a normal evolution in changing the relationship between the IT and business departments on using digital information. Cloud computing delivers many advantages to any type of organization in the world,โ said Marc Vael, CISA, CISM, CGEIT, CISSP, director of the Knowledge Board at ISACA and chairman of the Cloud Computing Task Force at ISACA. โOn the other side, when implementing cloud computing solutions, specific attention points still must be asked and dealt with, but in my personal opinion these are very similar to the already known control objectives for IT outsourcing of processes and systems,โ according to Marc Vael.
โTo get the most benefit from their cloud initiatives, enterprises must develop a clear governance strategy and management plan that sets the direction and objectives for cloud computing and executes on the plan,โ said Phil Lageschulte, CGEIT, CPA, member of ISACAโs Knowledge Board and leader of KPMGโs Global IT Audit Services. โIT has historically been viewed as a cost center, but the cloud presents the opportunity to fully align it with the goals of the enterprise as a whole and add value to the organization.โ
IT Control Objectives for Cloud Computing notes that enterprises must ask the following key questions for proper governance of cloud computing:
· What is the enterpriseโs expected availability?
· How are identity and access managed in the cloud?
· Where will the enterpriseโs data be located?
· What are the cloud service providerโs disaster recovery capabilities?
· How is the security of the enterpriseโs data managed?
· How is the whole system protected from Internet threats?
· How are activities monitored and audited?
· What type of certification or assurances can the enterprise expect from the provider?
The book also outlines business case development, how standards and good practices assist with cloud governance, how to establish business goals for the cloud, risk considerations and responsibilities, and a cloud computing management audit/assurance program.
IT Control Objectives for Cloud Computing is the third book in ISACAโs IT Control Objectives series. The first, IT Control Objectives for Sarbanes-Oxley, was downloaded more than a quarter of a million times. IT Control Objectives for Cloud Computing is available in print (US $60) and e-book (US $50) form. ISACA members can download the e-book free of charge and purchase the print book for US $35. For additional information on cloud computing, including a white paper and survey data, visit –
