Risk Management is an episodically executed process comprised of a set of coordinated activities for overseeing and controlling risks. The process targets the enhancement of strategic and tactical security and includes the execution of a Risk Assessment, the implementation of a risk mitigation strategy, and the engagement of risk control techniques and procedures for the continuous monitoring of the security state of the information system. Cloud-based information systems, as with traditional information systems, require that risks be managed throughout the system development lifecycle (SDLC).


The sensitivity of the stored information needs to be considered against the incurred security and privacy risks. Understanding your risk in the Public Cloud is paramount to a successful long-term relationship with the providers.
Due to economies of scale, Public Cloud Providers have the potential to offer state-of-the-art cloud solutions that are resilient and secure—far more secure than the environments of internally maintained (On-Premise) information systems which are managed by internal teams. Public Cloud options have the potential to greatly benefit many organizations.
Public Cloud solutions are exposed to threats that can have adverse effects on organizational operations (i.e., missions, functions, image, or reputation), organizational assets, individuals, and other organizations. Malicious entities can exploit both known and unknown vulnerabilities to compromise the confidentiality, integrity, or availability of the information being processed, stored, or transmitted by those systems.
There are many types of risk that organizations need to address: program management, investment, budget, legal liability, safety, inventory, supply chain, security, and more. A strong Risk Management and Cybersecurity engagement will have a strong impact on mitigating some of these risks.