Don’t overlook risks as you shift business to the cloud

Despite the obvious advantages of a digital transformation — like creating an efficient, agile, and easily scalable organization — many transformations fail.

When it comes to risk management, “measure twice, cut once” is sound advice. Stopping to assess your desired outcomes and mapping a route to get there can help. Whether your organization has undergone a cloud migration that has missed the mark or has not begun that move at all, anticipating the common pitfalls can help you better plan and execute this shift. Here are some of the cases we see most often.

Threat blindness

Middle market companies may feel relatively insulated from cyber threats, but the numbers tell a different story. In the 2023 RSM US Middle Market Business Index Cybersecurity Special Report, 20% of middle market executives claimed their company experienced a data breach within the last year. Cybercriminals may target these organizations looking for systems that are easily exploited partly because they tend to have a less sophisticated cyber security regime.

Misplaced trust

Cloud providers and SaaS solutions suppliers emphasize their security features and take them seriously. But the security they are referencing is within their platform, not for your data. Many organizations misunderstand this distinction, leaving their data exposed.

The other commonly discounted risk is the one coming from inside your organization. Whether knowingly or because of increasingly ingenious phishing and deep fake attempts, your employees pose a real threat. In fact, 35% of cyberattacks come from inside organizations. And 64% of those attacks are successful compared with the success rate of 51% for external attacks.

Misconfigured security

While a do-it-yourself approach can work for some projects, a cloud migration isn’t always one of them. Security tools can be misconfigured and vulnerabilities can go unchecked out of inexperience or because your IT team is stretched too thin. Given the complexity of cloud architecture and the number of cloud environments that need to be managed, you may need an advisor to ensure your risks are mitigated.

Tackling risk based on your installation method

Technology is an essential element of a secure architecture, but the people planning, executing and maintaining your cloud security are just as important. There are three central approaches to moving your business to the cloud, all of which are dependent on the skills, knowledge and experience of your team.

Self-serve installation

As noted earlier, this can be a tall order. Your team will need to have the time and resources to find vendors, plan the migration and then manage security and maintenance. This may seem like the least expensive option at first glance, but the high cost of talent and the complexity of a cloud migration may be more than your team can reasonably handle. Many organizations that embark on a self-serve migration eventually end up calling a third party to complete the task.

Working with a vendor

Technology vendors are skilled at guiding their customers through the installation and usage phases of software implementation, and cloud services providers can assist in your migration. But while they have expertise in their products, they may not be as skilled at customizing the plan and framework for your digital migration. Compliance requirements, for example, might not be part of their process. These blind spots can limit the functionality and flexibility of your framework.

Teaming up with an advisor

Consultants skilled in the various phases of a digital transformation, from cloud assessments through software development, can help guide your team from planning through installation, management and security. After working through multiple cloud migrations, they will have a greater knowledge of what does and doesn’t work as well as tips for success.

Not all consultants are equal, and you should ask plenty of questions before engaging an advisor. Some of these include:

Do you have a standard approach to data migrations or is it customizable for our needs?

Does your team have experience in our industry?

What kind of qualifications does your team have?

---

This article was written by RSM US LLP and originally appeared on 2024-01-08.
2022 RSM US LLP. All rights reserved.
https://rsmus.com/insights/services/risk-fraud-cybersecurity/paying-attention-to-risks-as-you-shift-your-business-to-the-cloud.html

RSM US Alliance provides its members with access to resources of RSM US LLP. RSM US Alliance member firms are separate and independent businesses and legal entities that are responsible for their own acts and omissions, and each are separate and independent from RSM US LLP. RSM US LLP is the U.S. member firm of RSM International, a global network of independent audit, tax, and consulting firms. Members of RSM US Alliance have access to RSM International resources through RSM US LLP but are not member firms of RSM International. Visit rsmus.com/aboutus for more information regarding RSM US LLP and RSM International. The RSM(tm) brandmark is used under license by RSM US LLP. RSM US Alliance products and services are proprietary to RSM US LLP.