Cloud security guide for SMEs. Cloud computing security risks and opportunities for SMEs

This guide for SMEs updates the 2009 ENISA Cloud Computing Risk Assessment for SMEs and the 2009 ENISA Assurance Framework. We have deliberately consolidated the risks and reduced the number of security questions to make it more suitable for SMEs, with limited time and resources to go into a lot of details. It is important to stress that this guideline should not be seen as a replacement for the SME’s own risk assessment. Security measures should be appropriate to the risks; not always gold-plated solutions are necessary.

Since 2009 the cloud computing market has changed significantly. There are now many SMEs, enterprises and government organizations who use some form of cloud computing. Cloud computing has now become the backbone of the EU’s digital economy. Cloud services offered by providers are more mature, there is more choice, there is more information for customers and customers are more aware of the possibilities and limitations of cloud computing. At the same time a number of issues have remained problematic, such as personal data protection legislation and the impact of foreign jurisdiction. In 2012, the European Commission issued the EU cloud strategy aiming to address a number of these issues. The strategy is an important initiative and the first results are currently being delivered.