Cloud 101CircleEventsBlog
Get 50% off the Cloud Infrastructure Security training bundle with code 'unlock50advantage'

Download Publication

Measuring Risk and Risk Governance
Measuring Risk and Risk Governance
Who it's for:
  • C-Suite
  • Decision-makers
  • Risk managers
  • Security professionals

Measuring Risk and Risk Governance

Release Date: 06/21/2022

Adapting to the cloud presents a new challenge to enterprises. The shared responsibility model, used to distinguish responsibilities between cloud providers and end users, adds multiple layers of ownership in the supply chain. The COVID-19 pandemic has added another element, accelerating the use of virtual tools and cloud services, causing risk management practices to also need to adapt quickly. However, as enterprises shift toward a heavier reliance on cloud services, it’s clear that the enterprise risk management process doesn’t always shift with them.

Google commissioned CSA to develop a survey to add to the industry’s knowledge about enterprise cloud computing risk and to prepare this report of the survey’s findings. The survey’s key areas of interest included:
  • Assessing the maturity of public cloud consumption and risk management in enterprises
  • Understanding current challenges and perceived effectiveness of risk management in public cloud
  • Analyzing the challenges of measuring risk in the cloud
  • Identifying best practices to reduce risk and address risk tolerance in the cloud
Respondents were asked questions about public cloud usage, cloud inventory management, risk management, and their methods and satisfaction with quantifying risk. Read this report for the full rundown of respondent demographics, their responses, and what it all means.

Key Takeaways:
  • 70% of organizations reported not effective or somewhat effective processes for assigning risk to cloud assets
  • The majority of respondents use 2 or more IaaS platforms (59%)
  • The top security concern when running applications in the public cloud was loss of sensitive data
  • When asked about the vendors or tools used to quantify risk, the most common response was “None” (51%)

Download this Resource

Prefer to access this resource without an account? Download it now.

Bookmark
Share
Related resources
NIST CSF v2 Cloud Community Profile - Based on CCM v4
NIST CSF v2 Cloud Community Profile - Based on ...
Informative Reference Details for the Mapping of CCM v4 to NIST CSF v2
Informative Reference Details for the Mapping o...
Cloud Controls Matrix and CAIQ v4
Cloud Controls Matrix and CAIQ v4
Modern Day Vendor Security Compliance Begins with the STAR Registry
Modern Day Vendor Security Compliance Begins with the STAR Registry
Published: 12/20/2024
Texas Attorney General’s Landmark Victory Against Google
Texas Attorney General’s Landmark Victory Against Google
Published: 12/20/2024
Winning at Regulatory Roulette: Innovations Shaping the Future of GRC
Winning at Regulatory Roulette: Innovations Shaping the Future of GRC
Published: 12/19/2024
The EU AI Act and SMB Compliance
The EU AI Act and SMB Compliance
Published: 12/18/2024

Acknowledgements

Alex Kaluza
Alex Kaluza
Research Analyst, CSA

Alex Kaluza

Research Analyst, CSA

Nick Godfrey Headshot Missing
Nick Godfrey

Nick Godfrey

MK Palmore Headshot Missing
MK Palmore

MK Palmore

Hillary Baron
Hillary Baron
Senior Technical Director - Research, CSA

Hillary Baron

Senior Technical Director - Research, CSA

Chris Rezek
Chris Rezek
Product Manager for Security and Privacy at Google

Chris Rezek

Product Manager for Security and Privacy at Google

Phil Venables
Phil Venables
Google Cloud

Phil Venables

Google Cloud

Catherine Nelson Headshot Missing
Catherine Nelson

Catherine Nelson

Josh Buker
Josh Buker
Research Analyst, CSA

Josh Buker

Research Analyst, CSA

Etienne De Burgh Headshot Missing
Etienne De Burgh

Etienne De Burgh

John Yeoh
John Yeoh
Global Vice President of Research, CSA

John Yeoh

Global Vice President of Research, CSA

With over 15 years of experience in research and technology, John excels at executive-level leadership, relationship management, and strategy development. He is a published author, technologist, and researcher with areas of expertise in cybersecurity, cloud computing, information security, and next generation technology (IoT, Big Data, SecaaS, Quantum). John specializes in risk management, third party assessment, GRC, data protection, incid...

Read more

Taylor Lehmann Headshot Missing
Taylor Lehmann

Taylor Lehmann

Are you a research volunteer? Request to have your profile displayed on the website here.

Related Certificates & Training