Taking Compliance to the Cloud—Using ISO Standards (Tools and Techniques)

Risk assessment is an essential part of managing IT resources in nearly all applications, but successful risk management depends on adapting to the rapid changes in IT. One of the biggest changes in recent years has been the move to cloud computing to improve efficiency and reduce costs. The migration to cloud systems brings with it a need to update risk management practices as well. To help readers navigate this ever-changing landscape, this paper presents a risk-assessment approach for cloud computing software as a service applications derived from the ISO 27001 Information Security Management System (ISMS) standard and complemented by ISO practices for Cloud Security and Protecting Personal Information in the Cloud.