From rationale to lessons learned in the cloud information security risk assessment: a study of organizations in Sweden

Purpose This study aims to address the issue of practicing information security risk assessment (ISRA) on cloud solutions by studying municipalities and large organizations in Sweden. Design/methodology/approach Four five that use services conduct ISRA adhere their management practices were studied. Data gathered qualitatively answer study’s research question: How is practiced cloud? The Coat Hanger model was used as a theoretical lens theorize practices. Findings results showed aimed follow guidelines, form frameworks or own experience, ISRA; furthermore, altered fit organizations’ needs. further indicated one main concerns with absence culture integrates management. Finally, findings also stressed importance good understanding well-written legal contract between providers using services. Originality/value As opposed previous research, which more inclined try out evaluate various ISRA, provides insights into practice experienced organizations. represents first attempt investigate managing security.