We performed a high‐level review of seven agencies to understand the level and maturity of their cloud computing governance processes. We also looked at the extent of services and data that these agencies have moved to a cloud computing environment, the type of cloud service models used and the associated costs.
We found that the level of governance over cloud computing exercised by most of the agencies we reviewed could be improved in the following areas:
- some agencies do not perform risk assessments or relate with their ICT service team before engaging cloud computing service providers
- most agencies were not performing annual independent assessments of their cloud computing service provider arrangements
- some agencies had not developed or finalised cloud computing service level agreements for all established service provider engagements
- some agencies had not developed or finalised cloud computing policies and procedures to support their current arrangements.