Cloud Service Risk Assestment

This super fund is dedicated to people working in Australia’s higher education and research sector. With over 400,000 members and over $65 billion in net funds under management, is one
of Australia’s largest super funds.

They recently engaged NetSkope to perform a Cloud Risk assessment, including a report andrecommendations, in preparation for a PwC Cloud Governance internal audit and review. While this audit
has highlighted a large number of cloud services currently being used (2,236), and a largenumber of subsequent critical/high-risk services (1,924), they requested Cloud9 Consulting to assistwith providing further, more detailed context on these findings in order to action the risks according totheir level of actual severity e.g. High, Medium and Low.

They requested Cloud9 to contextualise these findings in line with Technology’s FY19 security priorities and initiatives, 3 key ones being:
1. Cloud Access Brokers (CASB) Solution
2. Privileged Access Management Solution
3. Identity & Access Management Solution

The intention is for Cloud9’s report and recommendations to be shared among the relevant Technologystakeholders, and an Executive Summary prepared for Board Members.

Cloud9 proposes a ‘mini-squad’ team to work on the priorities below:

1. An initial assessment of the actual ‘As-Is’ situation, developed through:

• Review of NetSkope’s Cloud Risk Assessment Report
• Review of PwC’s Internal Audit Report (Cloud Governance and Footprint Review)
• Direct investigations of the technology environment
• Interviews and meetings with key stakeholders
• Review of documentation, policies, reports and other relevant information e.g. FY19 priorities
• An informal discussion with key stakeholders regarding draft findings, culminating in
• A Situation Analysis report summarising the key findings.

2. The formation of a high-level ‘To-Be’ vision of the security objectives, developed through:

• Workshops with key Technology stakeholders
• Validation of the high-level vision with business participants (as appropriate)
• A document depicting the Technology Security Vision at a high-level.

3. The development of a Technology Security Roadmap required to attain the Vision defined above, by

• Leveraging the technical expertise from the broader Cloud9 team
• A draft presentation and working group discussion with nominated stakeholders
• A final presentation of the Roadmap to a defined stakeholder group
• A report collating the three stages outlined here.