# A Resilience Engineering Approach for the Risk Assessment of IT Services
## 4 Discussion  
The capabilities of providers of IT services represent a critical factor for a company that depends on their reliability and effectiveness in guaranteeing the proper functioning of the IT platform. Such a situation has been largely investigated in the literature, especially in the case of the migration from legacy applications to updated ones [54]. However, most studies focused on the quality features of the services provided in terms of Infrastructure as a Service (IaaS), Software as a Service (SaaS), and Platform as a Service (PaaS) [55]. Other research has fostered cyber risk assessment, which is mainly aimed at dealing with supply chain vulnerabilities and inadequate implementation of security controls [56]. Hence, in the former case, several multi-criteria decision-making (MCDM) approaches have been proposed for suppliers' selection [57], while in the latter, different supply chain cyber risk assessment models can be found [56; 58; 59]. However, in spite of these noteworthy studies, little research has been carried out on the specific analysis of the cloud migration process and its risks. Thus, the current study certainly can contribute to augmenting knowledge on this issue, which is of paramount importance for avoiding the interruption or malfunctioning of the services that the company offers to its customers. Actually, as noted by [PERSON] et al. [60], the inaccessibility of these  
Figure 8: Application of the FRAM model to the new transfer procedure. services due to platform malfunctioning may lead both to severe penalty costs due to the infringement of availability clauses as well as to the loss of market reputation. The proposed procedure integrates tools for highlighting customer priorities and risk management to better design and carry out migration processes. This is in line with the research hints by [PERSON] et al. [61], who hoped for more research on developing resilient software systems. Moreover, consistent with [PERSON] [24], the proposed approach allowed us to customize the risk assessment of the migration process, providing mitigation measures for risks that cannot be properly managed using traditional risk assessment approaches. Thus, the proposed procedure has proven advantageous in simplifying the system screening and enabling a more reliable migration process compared to the existing risk assessment methods for cloud migration relying on \"Safety I\" tools, as well as allowing IT engineers to concentrate on important aspects and system serviceability. According to them, this FRAM-based procedure can be considered an effective tool for the management of complex systems, such as cloud migration processes involving multiple stakeholders. However, they also outlined that the unfamiliarity with the FRAM approach makes its application time-consuming and more complex than traditional risk assessment tools. The application of the proposed approach to a real-life case study resulted in very promising results since it provided us with information about critical issues that need adequate attention when implementing a migration process. In particular, the inclusion of an additional control phase during the migration process as well as the use of an \"alias\" domain contributed to reducing the vulnerability of the process. Hence, at the practical level, such an approach entails a twofold benefit: on the one hand, the analysis of performance requirements allows the company to make a more sound selection of suppliers for platform migration and maintenance. On the other hand, the use of FRAM allowed us to perform the variability analysis of the migration procedure, and the new scheme resulted in being less critical than before, while the risks related to the unavailability of the services were satisfactorily reduced. This reflects the method's capabilities, as underlined by [PERSON] et al. [62], who stressed the effectiveness of FRAM in better managing and mitigating risks from system weaknesses and brittleness.