Governance Risk & Compliance

The fundamental issues of governance and enterprise risk management in Cloud Computing concern the identification and implementation of the appropriate organizational structures, processes, and controls to maintain effective information security governance, risk management and compliance.

GRC encompasses, integrates and aligns activities such as corporate governance, enterprise risk management and corporate compliance with applicable laws and regulations. Components include compliance management (which assures compliance with all internal information security policies and standards), vendor management (to ensure that service providers and outsourcers adhere to intended and contractual information security policies applying concepts of ownership and custody), audit management (to highlight areas for improvement), IT risk management (to ensure that risk of all types are identified, understood, communicated, and either accepted, remediated, transferred, or avoided), and policy management (to maintain an organizational structure and process that supports the creation, implementation, exception handling and management of policy that represent business requirements), and technical awareness and training (to increase the ability to select and implement effective technical security mechanisms, products, process and tools).