BREAKING: FTC Votes to Issue Final Noncompete Rule
The Federal Trade Commission (FTC) adopted a controversial rule for noncompete ...
News
2 min read
Five Questions Boards of Directors Need to Ask About Cloud Governance
9 May, 2013
New ISACA Guidance Calls for BoD Involvement
Rolling Meadows, IL, USA (1 May 2013)—The many benefits of cloud computing include helping enterprises become more efficient, agile, innovative and flexibile, but achieving those benefits depends on a number of factors, including the involvement of the board of directors. ISACA, a nonprofit, independent association of more than 100,000 governance, risk, security and assurance professionals worldwide, has issued new guidance outlining key questions for boards of directors to ask to ensure their enterprise’s cloud initiative is in line with business objectives and the organization’s risk tolerance. “Board members need a clear understanding of cloud computing benefits and how to maximize them through effective governance practices,” said Marc Vael, CISA, CISM, CGEIT, CISSP, an ISACA board member and chief IT audit executive at Smals. “This requires the board to see cloud computing not as an IT project, but rather as a business strategy.” According to ISACA’s Cloud Governance: Questions Boards of Directors Need to Ask, boards should address the following five questions to determine the strategic value that cloud services are expected to provide and the impact that the cloud may have on resources and controls:- Do management teams have a plan for cloud computing? Have they weighed the value and opportunity costs?
- How do current cloud plans support the enterprise’s mission?
- Have executive teams systematically evaluated organizational readiness? For example, are the right skills available? Do cloud processes conflict with other established processes? Do cloud plans conflict with enterprise culture?
- Have management teams considered what existing investments might be lost in their cloud planning? Does the adoption of a cloud service nullify already-made technology investments that have not reached their planned end date, and is that noted and approved?
- Do management teams have strategies for measuring and tracking the value of cloud return vs. risk?
