## 2 The Framework
### Rationale and Summary
#### 2.1.2 Organizational and Processual  
In this case, taking into account that the cloud is based on service oriented architecture (SOA), the questionnaire is designed combining SOA governance models and SAM [6]. The questionnaire presents this set of questions that includes in this case a set of sub questions:1. Are there regulations for the introduction of the alteration in processes and in their steps?
* What effects do the alterations have over other processes?
* What effects do these alterations have over the corporate strategy?
* Whether the consideration of security concepts is assured when the alterations are taking place?
* Whether the changes are well planned, evaluated, accepted, and documented?
* Whether the alternative solutions are produced before the development of the changes?
* Whether the information security management is taken into consideration in all the alterations?  
2. Whether the significant organizational processes are impacted?
* What is the level of data availability?
* What is its influence on other activities?  
3. Whether there are any alterations in responsibilities and roles due to the changes?  
4. Plan for emergency.
* Evaluation of the most recent emergency tests documents.
* Security aspects.
* Regular security valuations at the Content Security Policy (CSP) and other suppliers by a qualified third party.
* Authentication, authorization, administration, inspections, and attentiveness access control.
* Processing the data is only permitted based on the guidelines of the cloud user and the usage of data by the CSP for their own purposes is not allowed.
* Test of influence of the CSP and other providers.
* The cloud user should be able to monitor and they should be able to prove the service level agreement (SLA) fulfilment.
* The administrative processes should be monitored and logged.
* Four-eyes-principle at the time of significant administration processes.
* CSP preparation of log files.
* Information about security events.
* Round the clock response group available for security event management and troubleshooting.
* Round the clock handling of cloud services and a rapid response to security events.
* Employment of appropriate measures in contradiction of domestic intimidations that are characteristic of a multi-tenant architecture.
* Formation of transparency and trust by the establishment of thorough information anticipated for the cloud user.
* Measures at the employees' level.
* Police certificate/clean criminal record.
* Educational history, qualifications, and present and previous affiliations.
* Personal setting (e.g., party membership).
* IT security courses.
* Social engineering courses.
* Control and education for the purpose of understanding.
* Assessment of workers (e.g., technicians, facility managers).
* Agreement for data security and non-disclosure.  
5. What are the processes influenced?
* Corresponding to their fields, e.g., \"governance activities\",\" customer-facing activities\", \"core activities\", and \"support activities\";* Corresponding to their inevitability and significance, e.g., \"must do\", \"nice-to-have\", \"delighter\".
6. Are business affected analyses carried out?
7. Are there explicit described approaches and connected key performance indicator (KPI)s for them at the procedure level?