IT decision makers often find themselves of two minds when considering a move to a shared, or cloud-based, infrastructure. While the promise of cost efficiencies, scalability, and rapid provisioning compel a move to a cloud-based computing model, anxiety over one factor—security—often delays the move.

This paper examines information security concerns in the cloud and challenges the misperception that a shared infrastructure introduces risk that can be neither quantified nor controlled. Information assurance (IA) in the cloud is achievable through a holistic approach to information security that integrates people, processes, and technology into solutions that are aligned with an organization’s business needs and risk threshold.