COSO ERM Framework related to Cloud computing

Internal Environment

This serves as the foundation for a company's risk appetite, helping a company understand the level at which it wants to outsource technology functions.

Objective-Setting

Management should understand how outsourcing technology functions will help it reach, or potentially hinder, its objectives.

Event Identification

Management must understand how adopting a CSP could make event identification more complex, or easier.

Risk Assessment

Management should understand the risks of its cloud strategy, including the impact to its risk profile, inherent and residual risk, and likelihood of impact.

Risk Response

Management should determine whether its risk response will be to avoid a risk, reduce its likelihood, share the risk by transferring a portion of it, or accept the risk.

Control Activities

The organization should understand how traditional controls—detective, preventative, automated, manual, and entity-level—are modified in a cloud environment.

Information and Communication

Management should understand how operating in the cloud will affect the timeliness, availability, and dissemination

Monitoring

Management should modify its monitoring mechanisms to accommodate new complexities introduced by adopting a cloud solution.