GRC for Cloud-Based Applications and Data: Are you Prepared? by John Boruvka

According to the Ponemon Institute's 2014 Cost of Data Breach Study, the average cost of a data breach to a business is $3.5 million and the corresponding cost of lost business is $3 million.

With cloud computing being rapidly adopted in the enterprise, there are additional concerns about risk. IT and security professionals expect cloud services to multiply the likelihood and economic impact of data breaches by as much as 3x as they pervade the enterprise.

Enterprises cannot ignore the cloud. You need to be able to secure information on the cloud like you would any other software platform. The benefits of moving to the cloud can significantly outweigh the costs only if companies demonstrate due diligence and audit the risk associated with their cloud service providers.

The rise in the need for cloud security goes hand in hand with the rise in the need for adequate Governance, Risk, and Compliance (GRC) solutions within a company. Moving to the cloud gives up control and visibility of information which makes it harder to manage. The goal for GRC is to diligently analyze how a company is performing in terms of risk and compliance and decide if adjustments need to be made.

In order to maintain visibility and control as a software subscriber, you should be demonstrating due diligence from the beginning. Asking questions about disaster recovery, encryption levels, and compliance to industry regulations is just a start. Consider all of the facts and risks associated with the software to give you better insight into what exactly you are signing up for.

However, signing the contract is not where you end your due diligence. Auditing controls and conditions throughout the life of the cloud application is crucial. Compare this to buying a used car. You do your research and look for certified pre-owned cars that guarantee a level of inspection and backing by the manufacturer. Similarly, you can't sign a contract for a cloud service and skip the due diligence and hope it's okay. Auditing your information security and risk is important no matter what stage you are at with the software.

On September 16th and 17th, Iron Mountain will be exhibiting at and attending The Summit on IT Governance, Risk, and Compliance hosted by the MIS Training Institute. The MIS Training Institute is an international leader in audit and information security training.

Key topics covered at the IT GRC Summit include:

Addressing growing cyber risk in your IT GRC program

Discovering current and emerging trends in GRC

Developing a cohesive approach to governance of your organization's information

Incorporating IT Governance and Compliance into the Enterprise Function

I'll be speaking on Hot Topics in GRC in the panel discussion on Tuesday, September 16 at 3:45 pm, so if you'll be at the conference, please mark this session on your calendar, and come up and introduce yourself afterwards.

You can also stop by our booth, or take a look at this solution brief on protecting your SaaS applications and data to learn more about how Iron Mountain's SaaSProtect can help manage the risk associated with your information in the cloud.

LINK:	http://blogs.ironmountain.com/2014/service-lines/technology-escrow/grc...
	See more stories from ironmountain

Most recent headlines