Cloud Service Risk and Continual Improvement
Domain 6 tests risk management and continual improvement across cloud sourcing and operations.
Core rules
- ISO 31000 process: establish scope and context, identify, analyze, evaluate, treat, and monitor/communicate risk.
- Record risks with owner, cause, event, impact, likelihood, rating, treatment, and review date. Treatment options are avoid, reduce, transfer, and accept.
- Cloud-specific risks include lock-in, data residency, multi-tenancy, supply-chain concentration, misconfiguration, and provider exit.
- Continual improvement uses a baseline, measurable gap, prioritized backlog, and PDCA. Post-incident reviews and service reviews feed it.
Worked example
A company runs 70% of production with one provider. The risk register entry scores likelihood 3 and impact 5, giving 15. Treatment: move the payment service to a second provider, test failover quarterly, and keep exit runbooks. Residual risk is accepted at 8. Reasoning: the score prioritizes action, and treatment changes likelihood or impact; acceptance must be explicit and owned.
Traps
Risk registers without owners or review dates; treating compliance as a one-time audit; confusing risk transfer with risk elimination; improvement without baseline measurement; and blaming individuals instead of fixing system conditions.