Managing Risk in a Shifting Regulatory Environment
Given the frequency of significant data breaches, organizations must be increasingly vigilant about data protection. Vibhav Agarwal, Director of Product Marketing at MetricStream, offers this primer on how enterprises can better secure their data in the cloud.
In today’s information age, a daunting challenge for enterprises of all sizes is determining the right approach to storing large volumes of data in a safe, cost-effective and easy-to-access manner. Deploying solutions on-premise can be complicated and put stress on budgets and infrastructure space, as the process would typically require extensive installations, configurations, updates and dedicated IT teams. Against this scenario, enterprises are pressured to transition toward the adoption of cloud computing to lower the total cost of ownership, increase time to value and achieve high performance and scalability.
It is evident that cloud computing enables enterprises to stay ahead in this digital world. However, despite many benefits, the flip side is that different types of risks can emerge if cloud computing is not implemented with the right approach. One of the main criticisms leveled against cloud computing (and SaaS) is the dependency on third parties for storing data. The other is the paucity in the availability of applications.
The four-point strategic plan detailed below can help businesses overcome these challenges.
1. Take a Risk-Based Approach to Cloud Computing
When it comes to cloud computing, the number one concern for companies is inadequate understanding of data. Prior to moving forward with any cloud computing adoption, enterprises need to understand the type of data moved to the cloud. A proper data risk assessment needs to be performed to analyze what and how important the data is. Part of this approach also means classifying what the potential risks are for enterprises if their data is stolen or lost, along with employing stronger controls to prevent any disasters from occurring. Other points to consider include:
- How to provide notifications to entities about data collected by your business
- Whether the PII or any other sensitive data is stored according to compliance requirements
- Who has access to sensitive data, and what are their responsibilities include
2. Select the Right Cloud Service Provider (CSP)
While transitioning to the cloud, enterprises face the major obstacle of choosing the right CSP that suits their business requirements. The first step to follow is to partner with an industry standard cloud vendor who adheres to security and privacy standards set by industry bodies. Conducting detailed research on a CSP will further ensure that the provider of your choice offers the best-in-class security controls needed to protect your business and data.
Most organizations feel they are secure if they have followed mitigation strategies, yet fail to perform constant checks to ensure compliance. Continuous evaluation is required to ensure the approach does not become obsolete. Evaluation includes:
- Performing a due diligence check of your CSP periodically to ensure continuous compliance
- Conducting a data sanity check of data stored on cloud to ensure data quality and integrity
- Outlining the roles and responsibilities between your enterprise and the managed CSP in case of any crisis
3. Leverage the Role of Governance, Risk and Compliance (GRC) on the Cloud
There has been a surge of new laws and regulations introduced by different governments to implement security and privacy measures for enterprises storing information in the cloud, due to the rising threat of cyber theft and a growing realization of the amount of data that can be compromised.
Developing a robust, cloud-based GRC program will enable enterprises to automate compliance by continuous control monitoring, improve visibility into organization risk exposure and achieve competitive benefits for regulatory and government controls. With a GRC framework on cloud, enterprises can achieve:
- Enhanced information security, compliance and risk management
- The highest levels of reliability and operational control
- Continuous transparency and confidence
- Proactive and risk-driven intelligence
- Adherence to regulatory compliance mandates
4. Monitor the Cloud Regularly
Enterprises today operate in a dynamic technological environment that requires the implementation of a wide variety of cloud applications to perform business-critical operations efficiently. It is of paramount importance to monitor these applications hosted on the cloud in real-time and on a continuous basis. With the advent of new and improved technologies, enterprises need a centralized platform to provide a comprehensive view of the health, performance and stability of their IT applications hosted on the cloud. In an age where a few minutes of downtime can translate into a revenue loss of hundreds of thousands of dollars, employing a real-time monitoring strategy ensures interruption-free data flow for maximum productivity.
With data breaches on the rise, businesses need to control where and how data is stored, shared and accessed. A risk-based approach to the cloud – and the use of a robust GRC program alongside it – can be effective in combating the barrage of constantly changing regulations leveled at businesses today.
Vibhav Agarwal is Director of Product Marketing at 
