S2M1 Cloud Computing

Cloud computing

a computing model that uses shared resources over the internet

IaaS (Infrastructure-as-a-Service)

The CSP provides an entire virtual data center of resources, and organizations can outsource servers, storage, hardware, networking services, and networking components to third-party providers, which is generally billed on a per-use basis

IaaS (Infrastructure-as-a-Service)

The company is typically responsible for keeping the environment in which it operates consistently up and running for users, as well as virtually managing the performance of the physical infrastructure, while the CSP is responsible for the physical management of that infrastructure

PaaS (Platform-as-a-Service)

PaaS (Platform-as-a-Service)

The CSP provides proprietary tools or solutions remotely that are used to fulfill a specific business purpose.

PaaS (Platform-as-a-Service)

the tools facilitate the creation of programs and delivery of services, such as building an online platform to sell merchandise, advertise products, or build other websites, all of which run on a CSP's hosted infrastructure.

The CSP is responsible for keeping the application's uptime at an acceptable level by maintaining all of the back-end infrastructure required to run that application.

SaaS (Software-as-a-Service)

The CSP provides a business application or software that organizations use to perform specific functions or processes. In a SaaS model, customers generally purchase the service through licensing.

The CSP offers access to the application via the internet and is responsible for recurring upgrades, security enhancements, and other support functions.

BPAAS (Business Processes as a Service)

third parties use SaaS software to deliver specific business functions such as outsourced payroll, billing, or logistics services.

Public

The cloud in this model is owned and managed by a CSP that makes the cloud services available to people or organizations who want to use or purchase them.

Private

the cloud is created for a single organization and is managed by the organization or a managed service vendor. The cloud infrastructure can exist on or off the organization's premises. The organization typically owns the underlying infrastructure in this model

Hybrid

composed of two or more clouds, with at least one being a private cloud, that remain unique cloud entities but with technology in place that facilitates the portability of data and applications between each entity

Community

cloud infrastructure is shared by multiple organizations to support a common interest, such as companies banding together for regulatory compliance, a common mission, or collaboration with industry peers.

Cloud service provider (CSP)

A third party that provides cloud computing services such as application delivery, hosting, or monitoring to customers. The CSP performs all maintenance and tech support on the hardware. CSPs often have advanced skills and experience

Governance and Culture

COSO: Sets the company's tone and reinforces the importance of having oversight of enterprise risk management. Culture is related to the company's target behaviors and values and involves understanding risk

Strategy and Objective-Setting

COSO: This component is considered with enterprise risk management and strategy during the strategic planning process. A company's risk appetite should be aligned with its strategy, and business objectives should be put into place to help achieve that level of appetite through identifying risk, assessing it, and responding to it

Performance

COSO: This component requires that organizations prioritize their risks based on risk appetite so that business objectives are assessed, met, and reported to key stakeholders

Review and Revision

COSO: This component involves reviewing a company's performance over time and making revisions to functions when needed

Information, Communication, and Reporting

COSO: This component recommends that a continual process be in place that supports sharing both internal and external information throughout the organization

Objective-Setting

COSO CL: Management should understand how outsourcing technology functions will help it reach, or potentially hinder, its objectives.

Event Identification

COSO CL: Management must understand how adopting a CSP could make event identification more complex, or easier.

Risk Assessment

COSO CL: Management should understand the risks of its cloud strategy, understanding the impact to its risk profile, inherent and residual risk, and likelihood of the impact of all risks.

Risk Response

COSO CL: Management should determine whether its risk response will be to avoid a risk, reduce its likelihood, share the risk by transferring a portion of it to another entity, or accept the risk.

Control Activities

COSO CL: The organization should understand how traditional controls— such as detective, preventative, automated, and manual—as well as entity-level controls are modified in a cloud environment.

Information and Communication

COSO CL: Management should understand how operating in the cloud will affect the timeliness, availability, and dissemination of information and communication.

Monitoring

COSO CL: Management should modify its monitoring mechanisms to accommodate new complexities introduced by adopting a cloud solution.

Internal Environment

COSO CL: This serves as the foundation for a company's risk appetite, helping a company understand the level at which it wants to outsource technology functions.