Högskolan i Skövde

Cloud computing has steadily increased in popularity in the last 20 years, with organizations increasingly choosing cloud-based solutions. However, cloud supply chains are associated with their own unique challenges and risks. Particularly within the Software-as-a-Service (SaaS) delivery model as a result of the shared responsibilities between several parties such as cloud service providers, hosting infrastructure providers, and cloud customers. Current industry tends to choose non-cloud specified information security risk assessment methods, despite the existence of cloud-specified standards. In parallel, the regulatory landscape of the European Union is changing with acts such as the Cybersecurity Act. This research conducts two iterations of the Design Science Research paradigm to develop a proposed method for cloud supply chain risk assessment. The proposed method aims to solve the challenges mentioned above by synthesizing existing knowledge within academia and industry to create a novel approach. The result identified several activities, resources, and processes for Information Security Risk Assessment (ISRA) in the cloud supply chains, namely supply chain mapping, data criticality assessments, data flow identification, and multi-consequence analysis. Data collection included several methods, such as systematic literature review, interviews with stakeholder experts, workshops to apply the method in a real-world context, and evaluation frameworks for method benchmarking. This study identified key cloud supply chain information security risks and five key design objectives for ISRA, namely applicability, compatibility, relevance, clarity, and transferability. Lastly, the study contributes to several academic discussions, such as difficulties in reliance on historical data, difficulties in quantifying probabilities, addressing the limitations of generic ISRA methods such as ISO/IEC 27005, and showed a limitation in inflexible risk formulas when aiming to achieve interoperability.