Cloud reassurance: A framework to enhance resilience and trust

Society’s dependence on cloud computing has grown rapidly as the COVID-19 pandemic accelerated the digital transformation. Although cybersecurity incidents dominate discussions about risk, residual risks remain. Such risks might stem from natural disasters or operational issues. This paper takes a broad perspective to identify the potential for residual risks in the cloud beyond cybersecurity. Such events are low frequency but high impact, and they are difficult to predict or mitigate but could potentially render cloud facilities inoperable at the regional or system-wide level.

This inquiry explores the challenges associated with the concentration of cloud services, the risks that can result, and actions to manage those risks. The assessment focuses on resilience—that is, the ability to anticipate and prepare for hazards, reduce their impact, and recover from them. Its aim is to make the overall system more resilient and reassure stakeholders that extensive cloud dependence has not created significant unmanaged risk that presents an imminent challenge for national and economic well-being.