APRA warns of cloud risks
(17 November 2010 – Australia) The Australian Prudential Regulatory Authority (APRA) has urged the nation’s financial services firms to ensure they have the correct risk and governance processes for cloud computing, in relation to outsourcing and off-shoring.
In an open letter, APRA recognised that cloud computing in the financial services sector is not yet widespread, however noted that several firms were using, or considering using, the technology.
Cloud computing can be used for applications such as mail, instant messaging, CRM and scheduling.
APRA warned that while the technology seemed "innocuous" it could form an integral part of financial institutions core business processes.
The regulator added that some firms adopting the technology had failed to recognise the significance of cloud computing, failing to acknowledge their outsourcing and off-shoring elements.
This in-turn meant that these initiatives 'are not being subjected to the usual rigour of existing outsourcing and risk management frameworks'.
The watchdog says firms need to address concerns relating to their ability to continue operations if cloud computing services go down. It also raises worries about the confidentiality and integrity of sensitive data, especially in relation to customers.
'Regulated institutions are reminded that, under the prudential standards on outsourcing, they are required to consult with APRA prior to entering into any off-shoring agreement involving a material business activity,' warns the letter.
Companies are expected to provide a comprehensive risk assessment as part of the consultations, involving an assessment of the 'specific arrangements underlying the services offered, the service provider, the location from which the services are to be provided and the criticality and sensitivity of the IT assets involved'.
Cloud computing can be used for applications such as mail, instant messaging, CRM and scheduling.
APRA warned that while the technology seemed "innocuous" it could form an integral part of financial institutions core business processes.
The regulator added that some firms adopting the technology had failed to recognise the significance of cloud computing, failing to acknowledge their outsourcing and off-shoring elements.
This in-turn meant that these initiatives 'are not being subjected to the usual rigour of existing outsourcing and risk management frameworks'.
The watchdog says firms need to address concerns relating to their ability to continue operations if cloud computing services go down. It also raises worries about the confidentiality and integrity of sensitive data, especially in relation to customers.
'Regulated institutions are reminded that, under the prudential standards on outsourcing, they are required to consult with APRA prior to entering into any off-shoring agreement involving a material business activity,' warns the letter.
Companies are expected to provide a comprehensive risk assessment as part of the consultations, involving an assessment of the 'specific arrangements underlying the services offered, the service provider, the location from which the services are to be provided and the criticality and sensitivity of the IT assets involved'.
Subscribe