Why the Cloud is Now a Board-Level ConcernPosted by skyhighnetworks on December 19th, 2013 Corporate boards are accountable for the company’s operations and compliance, and are under more scrutiny by investors and outsiders to audit the company’s strategy and operations. The move to the cloud represents a substantial shift in how information is created and manipulated for competitive advantage. Since it can also have significant financial and compliance ramifications if not managed properly it is increasingly coming under scrutiny by the board of directors. Historically, many information technology purchases were capital investments: complex on-premise software and databases, servers, mainframes, and networking equipment. With the shift to the cloud, these capabilities are delivered via a subscription cost model on a monthly or yearly basis.
With companies under pressure to operate more efficiently, board members are asking questions such as “our competitor reduced their overall costs by 2% by moving to the cloud, what’s our plan?” Eliminating or controlling the growth in computing hardware and datacenter costs can be a significant savings for the company. Moreover, the return on investment of cloud applications can often be higher. The leading customer relationship management (CRM) software is Salesforce, which also happens to be a cloud application accessible via an internet browser, or phone or tablet app. There’s a risk that are still using legacy CRM software like Siebel could fall behind.
Aside from financial considerations, as data moves to service providers, information moves out of the direct control of the company. It can move quickly to datacenters in other countries or on other continents. Suddenly, third parties are responsible for enforcing the company’s internal and external compliance policies. Directors have a duty to ensure the company is compliant with Sarbanes Oxley and other international, national, and state regulations. Audit teams reporting to committees of directors already have oversight over the company’s software purchases, which is a critical step of risk management for the organization. What they’re missing are employees using commonly available consumer applications available free or at low cost.
There are thousands of cloud services, and at a typical company employees use 545 different cloud services. Most of these are either free or purchased with an individual credit card without knowledge of IT. That means the audit and compliance team hasn’t vetted their security and compliance capabilities. “Shadow IT” can obscure the real risk and scope of what’s happening to the company’s information. Companies are unaware of which ones have breaches, which could lead to lawsuits or government fines if personal or sensitive data is lost during the breach. Cloud services also have outages, and boards need visibility into what business critical operations run on what cloud services.
The cloud offers many benefits to companies including higher productivity, lower operating costs, and greater agility. It can also represent significant compliance risk, and for both reasons boards are turning their attention to how cloud services are being managed by the organization. Directors are increasingly taking not of the cloud and assessing the benefits and risks Shadow IT usage poses to the organization.
Skyhigh Networks, the cloud access security company, enables companies to embrace Like it? Share it! More by this author |