An SME perspective on Cloud Computing

ENISA (the European Network and Information Security Agency) is conducting a security risk assessment of cloud computing technologies aimed at giving advice to (among others) SME's on the most important risks in adopting cloud computing technologies, as well as ways to address those risks.

As part of this study, we want to look in detail at the perspective of SME end-users of cloud computing infrastructures and applications (either current users or those considering adoption). As a first step, we have decided to base our study on a survey of the actual needs, requirements and expectations for cloud computing infrastructures.

The timeframe of the scenario based on ‘SME perspective on Cloud Computing’ goes from 2010 to 2012.

If you are an SME or if you are an organization representing SMEs please respond to the following short questionnaire.

NB: A basic knowledge about Cloud Computing is required to respond to the questionnaire.

About ENISA

The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of excellence for the European Member States and European institutions in network and information security, giving advice and recommendations and acting as a switchboard of information for good practices. Moreover, the agency facilitates contacts between the European institutions, the Member States and private business and industry actors.

Contact details:

For contacting ENISA or for general enquiries on EFR: Cloud Computing Risk Assessment, please use the following details:

Daniele Catteddu, Expert in Risk Management – daniele.catteddu@enisa.europa.eu
Giles Hogben, Expert in Security Policy - giles.hogben@enisa.europa.eu

Internet: http://www.enisa.europa.eu/

	Not Important	Medium Importance	Very Important	Showstopper
Privacy	What are your main concerns in your approach to Cloud Computing? Privacy Not Important	Medium Importance	Very Important	Showstopper
Availability of services and/or data	Availability of services and/or data Not Important	Medium Importance	Very Important	Showstopper
Integrity of services and/or data	Integrity of services and/or data Not Important	Medium Importance	Very Important	Showstopper
Confidentiality of corporate data	Confidentiality of corporate data Not Important	Medium Importance	Very Important	Showstopper
Repudiation	Repudiation Not Important	Medium Importance	Very Important	Showstopper
Loss of control of services and/or data	Loss of control of services and/or data Not Important	Medium Importance	Very Important	Showstopper
Lack of liability of providers in case of security incidents	Lack of liability of providers in case of security incidents Not Important	Medium Importance	Very Important	Showstopper
Inconsistency between trans national laws and regulations	Inconsistency between trans national laws and regulations Not Important	Medium Importance	Very Important	Showstopper
Unclear scheme in the pay per use approach	Unclear scheme in the pay per use approach Not Important	Medium Importance	Very Important	Showstopper
Uncontrolled variable cost	Uncontrolled variable cost Not Important	Medium Importance	Very Important	Showstopper
Cost and difficulty of migration to the cloud (legacy software etc...)	Cost and difficulty of migration to the cloud (legacy software etc...) Not Important	Medium Importance	Very Important	Showstopper
Intra-clouds (vendor lock-in) migration	Intra-clouds (vendor lock-in) migration Not Important	Medium Importance	Very Important	Showstopper

1. An SME perspective on Cloud Computing - Questionnaire

1. What is the size of the enterprise you represent

2. Please choose the country your SME is based in

3. What are the reasons behind your possible engagement in the Cloud Computing area?

4. Which solution do you see as the most suitable for an SME, according to this possible Cloud Computing taxonomy?

5. Which “layer” of the Cloud would you be most likely to approach?

6. Would you be willing to outsource to multiple providers?

7. Which of the following disaster recovery options are of interest to you?

8. Which IT services/Applications supporting business processes are most likely to be outsourced to a Cloud Computing service provider?

9. What are your main concerns in your approach to Cloud Computing?