# ERMOCTAVE: A Risk Management Framework for IT Systems Which Adopt Cloud Computing
## 2 Terminologies and Related Works
### Related Works  
The advantages of cloud computing over traditional networks are well known and they include fast deployment. However, identification of the risks in cloud computing is more difficult because of the lack of a dedicated framework. Such risks make businesses feel difficulty when adopting cloud technology. Over the last few years, a lot of documents have been written about risks and guidelines regarding cloud computing adoption. These documents rank highly as a security concern, but rank low across risks where a dedicated risk management framework is required. In that perspective, some organizations related with standardization frameworks have published risk management frameworks for cloud computing. The International Organization for Standardization (ISO/IEC JTC 1/SC 27) has developed a set of standards aiming to address risk management for cloud computing [7]. The standards are applied to new service models, such as Data as a Service (DaaS) and the cloud service brokers emergence, which offers intermediation, portability, governance, provisioning, and service integration, in addition to existing cloud services. However, the framework standards seem more like tools that enable understanding of the risks around cloud migration rather than an effective method to mitigate these risks. The European Network and Information Security Agency (ENISA) identified 35 types of risks by 19 contributors and lists eight top security risks based on indicative likelihood and impact [8]. The 35 risks are ranked from the lowest to the highest. Risk analysis proposed by ENISA is based on a real-life case study of a small- and medium-sized enterprise (SME) using cloud computing [9]. However, any risk management framework for mitigating risks in cloud computing is not included. Cloud Security Alliance (CSA) published \"Top Threats to Cloud Computing V1.0\", which includes the top seven threats as identified by its members [10]. The objective is to provide threat identification that can be updated, because dynamic and distributed properties are major natures of cloud computing [11]. The threat list roles more as managerial tool for higher strategic decisions in cloud adoption. Still, there is a lack of risk management framework in cloud computing. National Institute of Standards and Technology (NIST) published two drafts titled \"Cloud Computing Synopsis and Recommendations\" [12] and \"NIST Cloud Computing Standards Roadmap\" [13]. The drafts introduce a cloud-adopted risk management framework for services moved to the cloud. This framework enables federal organizations to develop a computer security plan based on risk tolerance and the information sensitivity. The provided set of standards and guidelines supports risk response strategies. However, the framework only allows analysis of risks in cloud computing than a comprehensive method to assess them. Information Systems Audit and Control Association (ISACA), published a document, \"IT Control Objectives for Cloud Computing: Controls and Assurance in the Cloud\", which introduces a guide to cloud controls taken from COBIT, Val IT, and Risk IT [14]. Its framework is not quite structured to identify and mitigate potential risks in cloud computing. A cloud risk assessment framework based on the ISO 31000 standard was introduced by Microsoft [15]. It has six steps that evaluate risks for cloud service candidates and focuses on decision-making for cloud-based computing. The framework provides value to decision-making process. However, it lacks mitigation plan after a specific risk has been identified and assessed. Since the above-mentioned risk management frameworks lack details on real application, ideas especially for risk assessment methods, have been proposed as follows. [PERSON] et al. proposed SEmi-quantitative BLO-driven Cloud Risk Assessment (SEBCRA) for the risk assessment process [16]. SEBCRA uses the impact of risk on a given business-level objective (BLO) and its probability to calculate its risk level estimation (RLE).