Secure use of cloud computing in the finance sector : good practices and recommendations

Cloud computing is gradually being adopted within the European financial industry. However, the adoption approach is not yet mature. The vast majority of Financial Institutions (FIs) still rely on in-house infrastructure. Finance sector Institutions and supervisory authorities seem to have a clear view of the financial and technical benefits connected to the adoption of both Public and Private Cloud deployment models, but they remain cautious about the risk of losing control over information assets. The most common approach used by FIs is a Hybrid of Private and Public Cloud. Even then, the services most often migrated to the cloud are test environments and email management. Financial Institutions consider that Private Cloud is a better overall fit for the financial market due to privacy and compliance concerns. Private Cloud is certainly favoured by the National Financial Supervisory Authorities (NFSAs), as it provides more control over data and operations. In creating this report we analysed input from a number of different sources to better understand the usage of cloud services in the finance sector. Based on the analysis we provide recommendations to financial institutions, regulators and cloud service providers about what we believe should be done to support secure adoption of cloud services in the finance sector.