## 2 Literature Review
### Information Security, Privacy, and Their Development Implications  
Information security refers to the procedures to protect an information asset while sustaining its confidentiality, integrity, and availability characteristics [34]. Similarly, [PERSON], [PERSON] [35] regards it as a process that is adopted for safeguarding information assets. [PERSON] [36] refers to information security as a security chain that is as strong as its weakest link. Without proper techniques and a strategy to hold the chain together, there are always weaknesses that will be exploited by threats to organisational business objectives and service delivery. While there is no commonly adopted definition of information security, one can argue that the NIST definition has been widely accepted [37]. Therefore, the research adopts the [PERSON] [37] definition in the NIST glossary of key information security terms as \"protecting information and information systems from unauthorised access, use, disclosure, disruption, modifications, or destruction to provide confidentiality, integrity, and availability\".  
In the context of development, information security takes on additional significance beyond organisational risk management. As [PERSON] and [PERSON] [38] and [PERSON] [39] argue, robust information security is essential for building citizen trust in digital governance, a precondition for achieving development outcomes through IT initiatives. In economies with limited institutional trust, such as many developing nations, security breaches in government systems can severely undermine development efforts by eroding public confidence and participation in digital initiatives [40].  
The tremendous increase in personal data generated daily due to social networks, modern communications channels, and a wide range of analytics engines that provide insights into unique individual movements, interests, and activities has elevated the risk to individuals' privacy. The increased risks to citizens' personal information from various cloud activities necessitated safeguards and privacy protection. For example, [PERSON] [17] described the structural characteristics of the cloud computing environment as the leading cause of security problems, attributed to the privacy disclosure risk posed by cloud service providers (CSPs) when outsourcing information transmission, processing, and storage processes. According to [PERSON], [PERSON] [23], there is no universally acceptable definition of privacy, though it has been discussed in various forms and contexts. This research refers to privacy as a substantive citizen's right to data protection. [PERSON] and [PERSON] [41] identified significant challenges for multinational corporations in cloud computing related to data protection and privacy.  
There has been an ongoing discussion about information security and privacy in cloud computing at various levels, be it industry or academia [21; 22; 23; 42; 43; 44]. Information security and privacy issues around cloud storage and computational security have been researched extensively [17; 45; 46; 47; 48]. However, scientific contributions that have been published in conference proceedings and international journals [43; 49] indicate a clear understanding of security and privacy risks in cloud computing.  
Despite the potential achievement of various cloud computing services and deployment models through technology, security, compliance, privacy, and legal matters are challenges that still hinder its adoption in government. The authors of [21] identified security and privacy as open issues in cloud computing adoption due to the outsourced data, dynamic abstraction, and scalability that have unlimited security boundaries and infrastructure. The information security and privacy issues of cloud computing have become increasingly important due to the sensitive information processed and stored in a cloud environment [50].