ECB guide on outsourcing cloud services to cloud service providers

The European Central Bank (ECB) acknowledges that the use of cloud services offers various benefits to supervised entities. Compared to internal information and communication technology (ICT) infrastructure, cloud services are cost efficient, scalable, secure due to providers using cutting-edge security technologies, resilient due to data backup solutions and disaster recovery options and provide supervised entities with access to innovative technologies. At the same time, as the cloud services market is highly concentrated, with many cloud service providers (CSPs) relying on proprietary technologies, especially for SaaS and PaaS procurement models, cloud services expose supervised entities to several risks resulting from the dependency on an ICT third-party service provider. Moreover, the nature of cloud services poses challenges regarding the management of cloud-specific risks as well as the monitoring and auditing of cloud services provided by CSPs.