Cyber leaders must make better use of risk experts | Computer Weekly

"Clients should have clear expectations of a cloud SLA, and if a provider falls short, they must be held accountable. Equally, clients have a responsibility to understand what the SLA does and does not cover, so they know exactly what they are purchasing. Too often, disconnects arise when procurement teams negotiate contracts without fully understanding the operational requirements, leaving IT and security teams with an SLA that doesn't meet their needs."

"To avoid this, buyers must carry out proper due diligence and identify the SLA's true "must haves" versus "should haves." Overloading the SLA with every requirement risks demanding a "gold service" that few providers can meet. On the other hand, accepting too many compromises increases risk, so organisations need a clear understanding of their risk tolerance."

"This requires decision-makers to not only understand risk but also to articulate it effectively and plan how to manage it. Risk management doesn't always need to be technical-non-technical controls and governance can also play a major role. Often, this process highlights an organisational disconnect: procurement may be expected to eliminate risk, which is unrealistic. Eliminating risk is not the same as managing it."

Clients must set clear expectations for cloud SLAs and understand what coverage is being purchased. Procurement teams often negotiate without operational input, creating SLAs that fail IT and security needs. Outsourcing treated only as a cost-saving exercise drives superficial provider comparisons and risky compromises. Buyers must perform due diligence to separate SLA "must haves" from "should haves" and avoid demanding unattainable "gold service." SLAs should align with business objectives and the MVP. Decision-makers must articulate risk, plan controls and governance to manage it, and accept that eliminating risk is unrealistic.

Read at ComputerWeekly.com