Back 
How to measure risk
Ask any security professional how to effectively measure risk and many will give a simple answer…
Risk = Likelihood x Impact
Perhaps some professionals will take it a step further and include a variable to include a weighting on the asset value (that is calculated separately to impact value)…
Risk = Likelihood x Impact x Asset Value
A few might go further and cite FAIR, a well established framework on quantitative risk management, that expands to include many additional variables.
Masters of risk will perhaps even talk about running risk model calculations and risk simulations using empirical data to further understand risk and create more accurate predictions of risk.
However, while any form of risk identification, assessment, and acceptance mitigation / transfer is better than none, still too few organisations have applied this concept to assessing cloud risk. So what is the reasoning for this—is it that cloud risk management is the cloud service providers (CSP) job?…is it that assessing cloud risk is not important?…or is it that assessing cloud risk is too complex? The answer to the above questions typically is No, No, and Perhaps.
How to measure cloud risk
Assessing cloud risk starts by identifying the cloud services your organisation currently uses. With 79% of employees in organisations actively using cloud apps to upload, share, or store data, and the average organisation using more than 1,500 distinct cloud apps each month the need to identify the cloud app and the type of data being processed or stored is key to understanding the risk.
The following six risk variables are common in assessing cloud risks and should form part of the cloud risk management process:
Vendor/Third-party Risk
Identify the vendor and understand their service agreement, terms, and conditions, as well as your organisation’s association and reliance on them and their providers.
Data Risk
Identify the category of data being uploaded, shared, or stored. If the data is personal data, financial data, or intellectual property, ensure that the appropriate controls are in place to protect the data and limit exposure to avoid both data loss risk and regulatory risk. Managing a clear inventory of which vendor is processing what data is critical (and is a regulatory requirement for many types of data).
Technology Risk
Understand the technology, the architecture, and the shared responsibility model. Identify who is responsible for addressing certain risks, such as ensuring correct implementation and configuration of the technology to ensure the service is secure.
Operational Risk
Manage operational risk across the supply chain. In the event of a security incident or an outage, ensure operational risk is managed and communicated. Ensure the provider has a robust incident response programme and can effectively contact their customers in the event of a secur