## 2 The Framework
### Validation of the Framework by Experts
#### 2.2.1 Validation of the Items  
The details of the framework elements to be evaluated for validity (legal, technological, processual/organizational, cultural) needs separate groups of professionals in their respective fields. Hence, evaluation was carried out in separate processes that are defined for each field in the following. With respect to the detailed approach adopted to perform the validation, it is according to experts' workshops. The aim of these workshops is the validation of the questionnaire. \begin{table}
\begin{tabular}{c c c c} \hline \hline  & **Low** & **Medium** & **High** \\ \hline \multirow{4}{*}{Technical} & There is no significant & There is a single significant & There are several significant \\  & infrastructure or technology & infrastructure or technology & infrastructures or technologies \\  & impacted. No key & impacted. Single vulnerability & impacted. There are several \\  & assets involved. & of a standard infrastructural & vulnerabilities of standard \\  & & asset involved. & infrastructural assets involved. \\  & There is no or little impact on & There is expected negative & There is an expected negative \\  & cultural mentality in the & effects in 1-2 related aspects of & impact in more than two \\  & organization or the & the cultural mentality in the & related aspects of the cultural \\  & customer base. & organization or the & mentality in the organization \\  & The financial damage is & customer base. & or the customer base. \\  & substantial, but does not & significant, and could & The financial damage \\  & intimidate the existence of & intimidate the existence of & intimidates the existence of \\  & the organization. & the organization. & organization. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._The selection of experts was different for each item and was different to present information in a more reduced form. Table 2 includes the selection criteria of the four items:  
Moreover, the common requisite for all is the needed experience: Five years in a relevant area and two years in decision making. The selected experts were provided with a detailed description of the proposed framework in the item assessed. The workshop was facilitated and conducted by at least one researcher on site. Furthermore, they were given some particular questions that they were requested to answer at the workshop:  
* Whether the provided framework is an adequate tool to describe risks? * Whether there are other fields for affections or risks for cloud computing/cloud services? * If yes, what are these other fields? * What is the significance of each of the provided fields from the point of view of the experts? * Are questionnaires sufficient to find inputs in the certain subject area for the goal of risk evaluation of the framework? * Whether there are any questions that are imprecisely expressed or other explanations are necessary? * Whether there are any questions that are not essential or unnecessary and hence should be deleted from the questionnaire? * Are there any related questions that have not been taken into account until now and should therefore be added to the questionnaire? * Are there any more comments or recommendations. The result of this validation was a set of changes in the inclusion or exclusion of questions, clarifications of terms, and rewording. Generally, the process of validation gave the planned benefits for the framework. Along with the assessment and enhancement of elements in the various subject fields, it provided an essential and beneficial multi-disciplinary view of the framework. The particular worldviews of the experts in the various fields can be described as follows:  
* There is a need for concise description of the legal fields considered by the experts, e.g., the description of \"change\".