{"text_format":"1","workbook":"xlsx","n_sheets":9,"sheets":["Disclaimer","Likelihood Definition","Impact Definition","Ent Risk Appetite","Cloud candidate template  Sheet","As is template sheet","Summary dashboard","A worked example-Hybrid","VLookup"],"not_rendered":{"charts":0,"images":1,"macros":1,"external_links":1,"defined_names":70,"comments":2,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Disclaimer","index":0,"n_rows":15,"n_cols":2,"rows_kept":15,"cut":false,"hidden":false,"merged":[]}
[]
[null,"Disclaimer"]
[null,"This document has been prepared by Microsoft to provide an overarching risk-management framework to allow organisations to conduct a risk-based assessment of a move to the cloud."]
[null,"This document is provided on an “as is” basis and to the maximum extent permitted by law Microsoft disclaims all conditions, warranties and guarantees, express or implied, including but not limited to any warranty or guarantee that the use of the framework set out in this document will not infringe any rights or any warranty or guarantee of merchantability or fitness for a particular purpose. Before using the framework set out in this document, you should evaluate its suitability for your organisation. In particular, if you choose to act upon the output of the framework, then you do so at your own risk."]
[null,"© Microsoft"]
[null,"Apart from any use permitted under the Copyright Act 1968, and the rights explicitly granted below, all rights are reserved."]
[]
[null,"Licence: This document is licensed under a Creative Commons Attribution Non-Commercial 3.0 licence. You are free to copy, distribute and transmit the work as long as you attribute the authors. You may not use this work for commercial purposes. "]
[null,"To view a copy of this licence, visit http://creativecommons.org/licenses/by-nc/3.0/au/legalcode"]
[]
[]
[null,"Authors:  "]
[null,"Greg Stone - Chief Technology Officer, Microsoft Austrtalia"]
[null,"Pierre Noel - Chief Security Advisor, Microsoft Asia"]
[null,"James Kavanagh - Chief Security Advisor, Microsoft Australia"]

{"sheet":"Likelihood Definition","index":1,"n_rows":11,"n_cols":6,"rows_kept":11,"cut":false,"hidden":false,"merged":[[4,1,4,2],[4,3,4,5]]}
[]
[]
[]
[]
[null,null,null,"Definition"]
[null,"Score","Likelihood Rating","Consideration","Probability","Frequency"]
[null,5,"Expected","The risk event or circumstance is relatively certain to occur, or has occurred within the past 6 months","90-100%","Almost Quarterly"]
[null,4,"Highly Likely","The risk event or circumstance is highly likely to occur","70-90%","Yearly"]
[null,3,"Likely","The risk event or circumstance is more likely to occur than not","50-70%","Every 2 to 4 Years"]
[null,2,"Not Likely","The risk event or circumstance occurring is possible","10-50%","Every 4 to 6 Years"]
[null,1,"Slight","The risk event or circumstance is only remotely probable","< 10%","Every 7 Years and Beyond"]

{"sheet":"Impact Definition","index":2,"n_rows":13,"n_cols":8,"rows_kept":13,"cut":false,"hidden":false,"merged":[[6,1,7,1],[6,2,7,2],[6,3,7,3],[6,4,6,7],[12,4,12,7]]}
[]
[]
[]
[]
[]
[]
[null,"Score","Rating","Definition","                  Description of Impact"]
[null,null,null,null,"Duration","Organizational and operational scope","Reputational impact on stakeholders (i.e., citizens, civil servants )","Legal/ Compliance/ Environmental Impact"]
[null,5,"Catastrophic","Severe or complete damage to asset or reputation e.g. externally visible and affects department's operation and citizen's confidence. Substantial support costs or business commitments canceled.","Significant Recovery Period","Government-wide: Inability to continue operation globally","Permanent loss of  stakeholder confidence  resulting in legal action, interruption in  operations as a whole","Global restrictions on performing activities across agencies and departments"]
[null,4,"Severe","Serious but not complete damage to asset or reputation e.g. externally visible and affects department's operation and citizen's confidence. Substantial support costs or business commitments canceled.","Recoverable in the Long Term (i.e., 12-24 months)","2 or more departments/agencies Significant, ongoing interruptions to  operations within 2 or more departments/agencies","Sustained operation degradation for citizens or preventing civil servant from meeting their SLA","Prohibited from conducting operations  in certain departments or geographies."]
[null,3,"Serious","Moderate damage or loss, e.g. affects internal operation, cause increase in operational costs or reduction of SLA performance. Noticeable impact to support costs and productivity. No measurable business impact.","Recoverable in the Short Term (i.e., 6-12 months)","1 or more department or agency:  Moderate impact within 1 or more department","Moderate loss in 1 or more stakeholder groups","Significant fines or limitations in conducting operations  in certain departments or geographies."]
[null,2,"Mild","Little damage or loss, e.g. affects internal operations  cannot measure increase in costs. No measurable impact, minor increases in support or infrastructure costs.","Temporary (i.e., less than 6 months)","1 department or agency affected ","Limited to minor/short-term loss in 1 stakeholder group","Limited actions against the government with limited effects on operations."]
[null,1,"Low","Minor or no change in asset. Absorbed by normal business operations - No measurable impact to support costs, productivity, or business commitments.","Minimal Impact"]

{"sheet":"Ent Risk Appetite","index":3,"n_rows":54,"n_cols":36,"rows_kept":54,"cut":false,"hidden":false,"merged":[[46,1,51,1],[5,1,5,3],[7,1,16,1],[18,1,25,1],[27,1,44,1]]}
[]
[]
[]
[]
[]
[null,"Enterprise Risk Appetite",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Ranking calcs"]
[null,null,"Risk Control Area","Description","Risk Likelihood","Risk Impact","Risk product"]
[null,"Compliance Risks","Governance & Entreprise Risk Management","Lack of effective internal information security governance, risk management and compliance, and alignment with the  provider own security governance","Expected","Serious",{"$f":"IF(ISNUMBER(AB8),VLOOKUP(AB8,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E8),VLOOKUP(E8,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":5},{"$f":"IF(ISTEXT(F8),VLOOKUP(F8,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},{"$f":"IF(AND(ISTEXT(E8),ISTEXT(F8)),(Z8*AA8),\"\")","v":15},null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH8*AI8),\"\")","v":""}]
[null,null,"Legal Issues : Contracts and Electronic Discovery","Storage, processing, disclosure to third-party, transfer to other legal jurisdictions of personal data and the risk for the provider not being able to produce business data in case of subpoena.","Highly Likely","Low",{"$f":"IF(ISNUMBER(AB9),VLOOKUP(AB9,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Very low"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E9),VLOOKUP(E9,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":4},{"$f":"IF(ISTEXT(F9),VLOOKUP(F9,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":1},4,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH9*AI9),\"\")","v":""}]
[null,null,"Incident Response","Failure for the provider to detect, handle incidents and report them to the DoCE with data that can be analyzed easily to satisfy legal requirements in case of forensic investigations","Likely","Serious",{"$f":"IF(ISNUMBER(AB10),VLOOKUP(AB10,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E10),VLOOKUP(E10,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F10),VLOOKUP(F10,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH10*AI10),\"\")","v":""}]
[null,null,"Storage of data in multiple jurisdictions and lack of transparency","Mirroring data for delivery and redundant storage without actualized information as to where the data is stored. DoCE may unknowingly violate regulations especially if clear information is not provided about the jurisdiction of storage","Slight","Low",{"$f":"IF(ISNUMBER(AB11),VLOOKUP(AB11,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Very low"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E11),VLOOKUP(E11,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":1},{"$f":"IF(ISTEXT(F11),VLOOKUP(F11,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":1},1,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH11*AI11),\"\")","v":""}]
[null,null,"Compliance and Audit Management","Risk of failing to comply with government-mandated and industry-specific regulations and standards, and failure to get audit information from the  provider","Likely","Mild",{"$f":"IF(ISNUMBER(AB12),VLOOKUP(AB12,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E12),VLOOKUP(E12,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F12),VLOOKUP(F12,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":2},6,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH12*AI12),\"\")","v":""}]
[null,null,"Data Protection Risks","Risk of adequate Data Protection no longer being maintained to a compliant level","Likely","Catastrophic",{"$f":"IF(ISNUMBER(AB13),VLOOKUP(AB13,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E13),VLOOKUP(E13,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F13),VLOOKUP(F13,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":5},15,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH13*AI13),\"\")","v":""}]
[null,null,"Sensitive Media Sanitization","Media cannot be physically destroyed, cannot be properly identified or no adequate procedure in place","Highly Likely","Serious",{"$f":"IF(ISNUMBER(AB14),VLOOKUP(AB14,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E14),VLOOKUP(E14,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":4},{"$f":"IF(ISTEXT(F14),VLOOKUP(F14,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},12,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH14*AI14),\"\")","v":""}]
[null,null,"Audit or Certification unavailable","The system cannot be audited and/or certified as it should","Likely","Severe",{"$f":"IF(ISNUMBER(AB15),VLOOKUP(AB15,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E15),VLOOKUP(E15,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F15),VLOOKUP(F15,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},12,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH15*AI15),\"\")","v":""}]
[null,null,"Compliance Degradation","Failure in achieving or maintaining  Compliance (to regulation, governance, standards)","Expected","Severe",{"$f":"IF(ISNUMBER(AB16),VLOOKUP(AB16,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"High"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E16),VLOOKUP(E16,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":5},{"$f":"IF(ISTEXT(F16),VLOOKUP(F16,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},20,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH16*AI16),\"\")","v":""}]
[null,null,"Governance Degradation","The DoCE might cede control to the provider on a number of issues which may affect overall governance","Not Likely","Severe",{"$f":"IF(ISNUMBER(AB17),VLOOKUP(AB17,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E17),VLOOKUP(E17,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(F17),VLOOKUP(F17,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},8,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH17*AI17),\"\")","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E18),VLOOKUP(E18,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F18),VLOOKUP(F18,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH18*AI18),\"\")","v":""}]
[null,"Strategic Risks","Information Management and Data Security ","Loose identification of sensitive data or protection of data in transit or stored in the cloud, and prevention of data leakage",null,null,{"$f":"IF(ISNUMBER(AB19),VLOOKUP(AB19,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E19),VLOOKUP(E19,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F19),VLOOKUP(F19,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH19*AI19),\"\")","v":""}]
[null,null,"Interoperability and Portability","Unable to make business applications interoperate between providers and lack of standards to minimize the risk of vendor lock-in",null,null,{"$f":"IF(ISNUMBER(AB20),VLOOKUP(AB20,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E20),VLOOKUP(E20,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F20),VLOOKUP(F20,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH20*AI20),\"\")","v":""}]
[null,null,"Poor Provider Selection","Selection of technology or service provide sub-optimal, resulting in system operational degradation",null,null,{"$f":"IF(ISNUMBER(AB21),VLOOKUP(AB21,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E21),VLOOKUP(E21,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F21),VLOOKUP(F21,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH21*AI21),\"\")","v":""}]
[null,null,"Organizational Readiness","Unable to achieve strategic alignment, cultural and workforce readiness, championship, and stakeholder buy-in",null,null,{"$f":"IF(ISNUMBER(AB22),VLOOKUP(AB22,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E22),VLOOKUP(E22,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F22),VLOOKUP(F22,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH22*AI22),\"\")","v":""}]
[null,null,"Lack of Supplier Redundancy","Unable to identify / contract an alternative supplier source",null,null,{"$f":"IF(ISNUMBER(AB23),VLOOKUP(AB23,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E23),VLOOKUP(E23,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F23),VLOOKUP(F23,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH23*AI23),\"\")","v":""}]
[null,null,"Lock-In","Risk associated with the migration from an in-house IT environment to an external Provider, and from one provider to another",null,null,{"$f":"IF(ISNUMBER(AB24),VLOOKUP(AB24,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E24),VLOOKUP(E24,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F24),VLOOKUP(F24,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH24*AI24),\"\")","v":""}]
[null,null,"Data classification on DoCE side","Inappropriate data classification and definition of mitigating controls leading to being unable to define requirements towards the  provider",null,null,{"$f":"IF(ISNUMBER(AB25),VLOOKUP(AB25,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E25),VLOOKUP(E25,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F25),VLOOKUP(F25,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH25*AI25),\"\")","v":""}]
[null,null,"Data migration from on-premise into the cloud (regardless whether public, private or hybrid)","Difficulty to move legacy data into a cloud based environment",null,null,{"$f":"IF(ISNUMBER(AB26),VLOOKUP(AB26,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E26),VLOOKUP(E26,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F26),VLOOKUP(F26,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH26*AI26),\"\")","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E27),VLOOKUP(E27,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F27),VLOOKUP(F27,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH27*AI27),\"\")","v":""}]
[null,"Operational Risks","Data Center Operations","Failure for the  provider to respect management standards and best practices and implement security controls in accordance to sensitivity of business services",null,null,{"$f":"IF(ISNUMBER(AB28),VLOOKUP(AB28,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E28),VLOOKUP(E28,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F28),VLOOKUP(F28,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH28*AI28),\"\")","v":""}]
[null,null,"Log & Tracing failure","Loss or Compromise of Operational Logs (including Security Logs)",null,null,{"$f":"IF(ISNUMBER(AB29),VLOOKUP(AB29,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E29),VLOOKUP(E29,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F29),VLOOKUP(F29,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH29*AI29),\"\")","v":""}]
[null,null,"Backup Failure","Misplacement or theft of Backup information",null,null,{"$f":"IF(ISNUMBER(AB30),VLOOKUP(AB30,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E30),VLOOKUP(E30,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F30),VLOOKUP(F30,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH30*AI30),\"\")","v":""}]
[null,null,"Information Management and Data Security ","Loose identification of sensitive data or protection of data in transit or stored in the cloud, and prevention of data leakage",null,null,{"$f":"IF(ISNUMBER(AB31),VLOOKUP(AB31,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E31),VLOOKUP(E31,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F31),VLOOKUP(F31,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH31*AI31),\"\")","v":""}]
[null,null,"Impact on current internal operational procedures","Review of existing operational procedures regarding change management, incident/problem management, business continuity management",null,null,{"$f":"IF(ISNUMBER(AB32),VLOOKUP(AB32,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E32),VLOOKUP(E32,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F32),VLOOKUP(F32,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH32*AI32),\"\")","v":""}]
[null,null,"Inaccurate Modeling of Resource Usage / Resource Exhaustion","Temporary failure to provide additional capacity and/or to meet Service Level Agreement. ",null,null,{"$f":"IF(ISNUMBER(AB33),VLOOKUP(AB33,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E33),VLOOKUP(E33,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F33),VLOOKUP(F33,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH33*AI33),\"\")","v":""}]
[null,null,"Integration into existing business solutions","Difficulty of Integration into legacy/current environment (interfaces)",null,null,{"$f":"IF(ISNUMBER(AB34),VLOOKUP(AB34,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E34),VLOOKUP(E34,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F34),VLOOKUP(F34,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH34*AI34),\"\")","v":""}]
[null,null,"Malicious Activities from an Insider","Privileged users (e.g. Administrator) performing unauthorized activities on the system (data theft, tampering…)",null,null,{"$f":"IF(ISNUMBER(AB35),VLOOKUP(AB35,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E35),VLOOKUP(E35,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F35),VLOOKUP(F35,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH35*AI35),\"\")","v":""}]
[null,null,"Sensitive Information Leakage","Accidental or Malicious activity leading to sensitive information being exposed to otherwise unauthorised group",null,null,{"$f":"IF(ISNUMBER(AB36),VLOOKUP(AB36,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E36),VLOOKUP(E36,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F36),VLOOKUP(F36,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH36*AI36),\"\")","v":""}]
[null,null,"Operations management","Provider performs operations in a manner not meeting compliance requirements (e.g. Change management, patch management)",null,null,{"$f":"IF(ISNUMBER(AB37),VLOOKUP(AB37,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E37),VLOOKUP(E37,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F37),VLOOKUP(F37,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH37*AI37),\"\")","v":""}]
[null,null,"Subpoena and e-discovery","Confiscation of critical system as a result of subpoena by law-enforcement agencies or civil suits",null,null,{"$f":"IF(ISNUMBER(AB38),VLOOKUP(AB38,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E38),VLOOKUP(E38,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F38),VLOOKUP(F38,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH38*AI38),\"\")","v":""}]
[null,null,"Unauthorized access to premises","Unauthorized access to premises Including physical acccess to machines and other facilities",null,null,{"$f":"IF(ISNUMBER(AB39),VLOOKUP(AB39,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E39),VLOOKUP(E39,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F39),VLOOKUP(F39,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH39*AI39),\"\")","v":""}]
[null,null,"Theft of Computer Equipment","Systems or Data be stolen",null,null,{"$f":"IF(ISNUMBER(AB40),VLOOKUP(AB40,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E40),VLOOKUP(E40,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F40),VLOOKUP(F40,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH40*AI40),\"\")","v":""}]
[null,null,"Security of the endpoint (e.g. laptop, pc, smartphone, slate) from which the cloud service is consumed.","Inability to provide adequate policies/controls to secure the end-point ",null,null,{"$f":"IF(ISNUMBER(AB41),VLOOKUP(AB41,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E41),VLOOKUP(E41,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F41),VLOOKUP(F41,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH41*AI41),\"\")","v":""}]
[null,null,"Human Resource Constraints","Inability to find and retain the right resources to ensure service and support",null,null,{"$f":"IF(ISNUMBER(AB42),VLOOKUP(AB42,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E42),VLOOKUP(E42,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F42),VLOOKUP(F42,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH42*AI42),\"\")","v":""}]
[null,null,"Natural Disasters","Unable to handle Natural Disaster Situations (Business Continuity Management)",null,null,{"$f":"IF(ISNUMBER(AB43),VLOOKUP(AB43,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E43),VLOOKUP(E43,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F43),VLOOKUP(F43,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH43*AI43),\"\")","v":""}]
[null,null,"Licensing Risks","Licensing and intellectual property right conditions are not met",null,null,{"$f":"IF(ISNUMBER(AB44),VLOOKUP(AB44,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E44),VLOOKUP(E44,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F44),VLOOKUP(F44,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH44*AI44),\"\")","v":""}]
[null,null,"Traditional Security, Business Continuity and Disaster Recovery","Failure for the  provider to  implement datacenters security, business continuity and disaster recovery plans",null,null,{"$f":"IF(ISNUMBER(AB45),VLOOKUP(AB45,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E45),VLOOKUP(E45,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F45),VLOOKUP(F45,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH45*AI45),\"\")","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E46),VLOOKUP(E46,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F46),VLOOKUP(F46,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH46*AI46),\"\")","v":""}]
[null,"Market & Finance","Loss of reputation","In-house system: risk of some significant and public incidents / In the Cloud: risk with  Cloud Provider or co-tenant activities",null,null,{"$f":"IF(ISNUMBER(AB47),VLOOKUP(AB47,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E47),VLOOKUP(E47,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F47),VLOOKUP(F47,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH47*AI47),\"\")","v":""}]
[null,null,"Service Termination or Failure","The Service can no longer be provided as assumed",null,null,{"$f":"IF(ISNUMBER(AB48),VLOOKUP(AB48,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E48),VLOOKUP(E48,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F48),VLOOKUP(F48,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH48*AI48),\"\")","v":""}]
[null,null,"Isolation Failure","Access to the Service is temporarily denied, possibly leading to reputational, critical or financial issues",null,null,{"$f":"IF(ISNUMBER(AB49),VLOOKUP(AB49,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E49),VLOOKUP(E49,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F49),VLOOKUP(F49,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH49*AI49),\"\")","v":""}]
[null,null,"Capacity Management","Inadequate Resource Provisioning and Investment in Infrastructure",null,null,{"$f":"IF(ISNUMBER(AB50),VLOOKUP(AB50,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E50),VLOOKUP(E50,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F50),VLOOKUP(F50,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH50*AI50),\"\")","v":""}]
[null,null,"Environment Agility / Time to Market","Latency or overall difficulty in being able to adjust the systems' characteristics (performance, architecture, segregation) to address dynamic environment",null,null,{"$f":"IF(ISNUMBER(AB51),VLOOKUP(AB51,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E51),VLOOKUP(E51,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F51),VLOOKUP(F51,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH51*AI51),\"\")","v":""}]
[null,null,"Incident Response","The  provider could not detect, handle incidents and report them to the DoCE with data that can be analyzed easily to satisfy legal requirements in case of forensic investigations",null,null,{"$f":"IF(ISNUMBER(AB52),VLOOKUP(AB52,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E52),VLOOKUP(E52,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F52),VLOOKUP(F52,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AH52*AI52),\"\")","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E53),VLOOKUP(E53,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F53),VLOOKUP(F53,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""}]
[null,{"$f":"IF(A54=1,IF(#REF!<43,\"Please complete the mandatory questions - \" &#REF!,\"\"),\"\")","v":""}]

{"sheet":"Cloud candidate template  Sheet","index":4,"n_rows":53,"n_cols":31,"rows_kept":53,"cut":false,"hidden":false,"merged":[[4,28,4,30],[4,24,4,26],[4,1,4,3],[45,1,50,1],[4,8,4,10],[4,12,4,13],[6,1,15,1],[17,1,24,1],[26,1,43,1]]}
[]
[]
[null,"Cloud Candidate Risk Assessment - [ name of proposed cloud option here]"]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Ranking calcs"]
[null,"Enterprise Cloud Risk Dashboard",null,null,null,null,null,null,"Compensating Controls",null,null,null,"Residual Risks",null,null,"Results",null,null,null,null,null,null,null,null,"RAW INPUT CALCS",null,null,null,"RAW+COMP CALCS"]
[null,null,"Risk Control Area","Description","Risk Likelihood","Risk Impact","Risk product",null,"Mitigation Description","Risk Likelihood","Risk Impact",null,"Risk Likelihood","Risk Impact",null,"Final Risk position",null,null,null,null,null,null,null,null,"Liklihood number","Impact number","Factored result",null,"Liklihood number","Impact number","Factored result"]
[null,"Compliance Risks","Governance & Entreprise Risk Management","Lack of effective internal information security governance, risk management and compliance, and alignment with the  provider own security governance","Not Likely","Catastrophic",{"$f":"IF(ISNUMBER(AA7),VLOOKUP(AA7,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,{"$f":"IF(ISBLANK(J7),IF(ISBLANK(E7),\"\",E7),J7)","v":"Not Likely"},{"$f":"IF(ISBLANK(K7),IF(ISBLANK(F7),\"\",F7),K7)","v":"Catastrophic"},null,{"$f":"IF(ISNUMBER(AE7),VLOOKUP(AE7,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E7),VLOOKUP(E7,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(F7),VLOOKUP(F7,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":5},{"$f":"IF(AND(ISTEXT(M7),ISTEXT(N7)),(Y7*Z7),\"\")","v":10},null,{"$f":"IF(ISTEXT(M7),VLOOKUP(M7,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(N7),VLOOKUP(N7,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":5},{"$f":"IF(AND(ISTEXT(M7),ISTEXT(N7)),(AC7*AD7),\"\")","v":10}]
[null,null,"Legal Issues : Contracts and Electronic Discovery","Storage, processing, disclosure to third-party, transfer to other legal jurisdictions of personal data and the risk for the provider not being able to produce business data in case of subpoena.",null,null,{"$f":"IF(ISNUMBER(AA8),VLOOKUP(AA8,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,{"$f":"IF(ISBLANK(J8),IF(ISBLANK(E8),\"\",E8),J8)","v":""},{"$f":"IF(ISBLANK(K8),IF(ISBLANK(F8),\"\",F8),K8)","v":""},null,{"$f":"IF(ISNUMBER(AE8),VLOOKUP(AE8,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E8),VLOOKUP(E8,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F8),VLOOKUP(F8,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(E8),ISTEXT(F8)),(Y8*Z8),\"\")","v":""},null,{"$f":"IF(ISTEXT(M8),VLOOKUP(M8,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N8),VLOOKUP(N8,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(AND(ISTEXT(M8),ISTEXT(N8)),(AC8*AD8),\"\")","v":{"$error":"#N/A"}}]
[null,null,"Incident Response","Failure for the provider to detect, handle incidents and report them to the DoCE with data that can be analyzed easily to satisfy legal requirements in case of forensic investigations",null,null,{"$f":"IF(ISNUMBER(AA9),VLOOKUP(AA9,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,{"$f":"IF(ISBLANK(G9), B9, G9)","v":""},null,null,{"$f":"IF(ISBLANK(J9),IF(ISBLANK(E9),\"\",E9),J9)","v":""},{"$f":"IF(ISBLANK(K9),IF(ISBLANK(F9),\"\",F9),K9)","v":""},null,{"$f":"IF(ISNUMBER(AE9),VLOOKUP(AE9,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E9),VLOOKUP(E9,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F9),VLOOKUP(F9,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M9),VLOOKUP(M9,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N9),VLOOKUP(N9,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Storage of data in multiple jurisdictions and lack of transparency","Mirroring data for delivery and redundant storage without actualized information as to where the data is stored. DoCE may unknowingly violate regulations especially if clear information is not provided about the jurisdiction of storage",null,null,{"$f":"IF(ISNUMBER(AA10),VLOOKUP(AA10,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE10),VLOOKUP(AE10,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E10),VLOOKUP(E10,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F10),VLOOKUP(F10,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M10),VLOOKUP(M10,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N10),VLOOKUP(N10,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Compliance and Audit Management","Risk of failing to comply with government-mandated and industry-specific regulations and standards, and failure to get audit information from the  provider",null,null,{"$f":"IF(ISNUMBER(AA11),VLOOKUP(AA11,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE11),VLOOKUP(AE11,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E11),VLOOKUP(E11,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F11),VLOOKUP(F11,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M11),VLOOKUP(M11,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N11),VLOOKUP(N11,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Data Protection Risks","Risk of adequate Data Protection no longer being maintained to a compliant level",null,null,{"$f":"IF(ISNUMBER(AA12),VLOOKUP(AA12,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE12),VLOOKUP(AE12,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E12),VLOOKUP(E12,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F12),VLOOKUP(F12,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M12),VLOOKUP(M12,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N12),VLOOKUP(N12,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Sensitive Media Sanitization","Media cannot be physically destroyed, cannot be properly identified or no adequate procedure in place",null,null,{"$f":"IF(ISNUMBER(AA13),VLOOKUP(AA13,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE13),VLOOKUP(AE13,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E13),VLOOKUP(E13,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F13),VLOOKUP(F13,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M13),VLOOKUP(M13,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N13),VLOOKUP(N13,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Audit or Certification unavailable","The system cannot be audited and/or certified as it should",null,null,{"$f":"IF(ISNUMBER(AA14),VLOOKUP(AA14,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE14),VLOOKUP(AE14,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E14),VLOOKUP(E14,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F14),VLOOKUP(F14,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M14),VLOOKUP(M14,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N14),VLOOKUP(N14,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Compliance Degradation","Failure in achieving or maintaining  Compliance (to regulation, governance, standards)",null,null,{"$f":"IF(ISNUMBER(AA15),VLOOKUP(AA15,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE15),VLOOKUP(AE15,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E15),VLOOKUP(E15,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F15),VLOOKUP(F15,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M15),VLOOKUP(M15,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N15),VLOOKUP(N15,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Governance Degradation","The DoCE might cede control to the provider on a number of issues which may affect overall governance",null,null,{"$f":"IF(ISNUMBER(AA16),VLOOKUP(AA16,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE16),VLOOKUP(AE16,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E16),VLOOKUP(E16,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F16),VLOOKUP(F16,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M16),VLOOKUP(M16,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N16),VLOOKUP(N16,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISBLANK(J17),\"\",J17)","v":""},{"$f":"IF(ISBLANK(K17),\"\",K17)","v":""},null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E17),VLOOKUP(E17,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F17),VLOOKUP(F17,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M17),VLOOKUP(M17,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N17),VLOOKUP(N17,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,"Strategic Risks","Information Management and Data Security ","Loose identification of sensitive data or protection of data in transit or stored in the cloud, and prevention of data leakage",null,null,{"$f":"IF(ISNUMBER(AA18),VLOOKUP(AA18,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,{"$f":"IF(ISBLANK(G18), B18, G18)","v":""},null,null,{"$f":"IF(ISBLANK(J18),IF(ISBLANK(E18),\"\",E18),J18)","v":""},{"$f":"IF(ISBLANK(K18),IF(ISBLANK(F18),\"\",F18),K18)","v":""},null,{"$f":"IF(ISNUMBER(AE18),VLOOKUP(AE18,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E18),VLOOKUP(E18,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F18),VLOOKUP(F18,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M18),VLOOKUP(M18,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N18),VLOOKUP(N18,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Interoperability and Portability","Unable to make business applications interoperate between providers and lack of standards to minimize the risk of vendor lock-in",null,null,{"$f":"IF(ISNUMBER(AA19),VLOOKUP(AA19,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE19),VLOOKUP(AE19,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E19),VLOOKUP(E19,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F19),VLOOKUP(F19,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M19),VLOOKUP(M19,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N19),VLOOKUP(N19,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Poor Provider Selection","Selection of technology or service provide sub-optimal, resulting in system operational degradation",null,null,{"$f":"IF(ISNUMBER(AA20),VLOOKUP(AA20,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE20),VLOOKUP(AE20,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E20),VLOOKUP(E20,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F20),VLOOKUP(F20,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M20),VLOOKUP(M20,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N20),VLOOKUP(N20,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Organizational Readiness","Unable to achieve strategic alignment, cultural and workforce readiness, championship, and stakeholder buy-in",null,null,{"$f":"IF(ISNUMBER(AA21),VLOOKUP(AA21,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE21),VLOOKUP(AE21,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E21),VLOOKUP(E21,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F21),VLOOKUP(F21,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M21),VLOOKUP(M21,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N21),VLOOKUP(N21,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Lack of Supplier Redundancy","Unable to identify / contract an alternative supplier source",null,null,{"$f":"IF(ISNUMBER(AA22),VLOOKUP(AA22,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE22),VLOOKUP(AE22,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E22),VLOOKUP(E22,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F22),VLOOKUP(F22,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M22),VLOOKUP(M22,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N22),VLOOKUP(N22,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Lock-In","Risk associated with the migration from an in-house IT environment to an external Provider, and from one provider to another",null,null,{"$f":"IF(ISNUMBER(AA23),VLOOKUP(AA23,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE23),VLOOKUP(AE23,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E23),VLOOKUP(E23,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F23),VLOOKUP(F23,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M23),VLOOKUP(M23,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N23),VLOOKUP(N23,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Data classification on DoCE side","Inappropriate data classification and definition of mitigating controls leading to being unable to define requirements towards the  provider",null,null,{"$f":"IF(ISNUMBER(AA24),VLOOKUP(AA24,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE24),VLOOKUP(AE24,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E24),VLOOKUP(E24,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F24),VLOOKUP(F24,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M24),VLOOKUP(M24,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N24),VLOOKUP(N24,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Data migration from on-premise into the cloud (regardless whether public, private or hybrid)","Difficulty to move legacy data into a cloud based environment",null,null,{"$f":"IF(ISNUMBER(AA25),VLOOKUP(AA25,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE25),VLOOKUP(AE25,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E25),VLOOKUP(E25,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F25),VLOOKUP(F25,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M25),VLOOKUP(M25,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N25),VLOOKUP(N25,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,null,null,null,null,null,null,null,null,null,null,"","",null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E26),VLOOKUP(E26,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F26),VLOOKUP(F26,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M26),VLOOKUP(M26,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N26),VLOOKUP(N26,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,"Operational Risks","Data Center Operations","Failure for the  provider to respect management standards and best practices and implement security controls in accordance to sensitivity of business services",null,null,{"$f":"IF(ISNUMBER(AA27),VLOOKUP(AA27,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,{"$f":"IF(ISBLANK(G27), B27, G27)","v":""},null,null,{"$f":"IF(ISBLANK(J27),IF(ISBLANK(E27),\"\",E27),J27)","v":""},{"$f":"IF(ISBLANK(K27),IF(ISBLANK(F27),\"\",F27),K27)","v":""},null,{"$f":"IF(ISNUMBER(AE27),VLOOKUP(AE27,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E27),VLOOKUP(E27,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F27),VLOOKUP(F27,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M27),VLOOKUP(M27,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N27),VLOOKUP(N27,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Log & Tracing failure","Loss or Compromise of Operational Logs (including Security Logs)",null,null,{"$f":"IF(ISNUMBER(AA28),VLOOKUP(AA28,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE28),VLOOKUP(AE28,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E28),VLOOKUP(E28,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F28),VLOOKUP(F28,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M28),VLOOKUP(M28,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N28),VLOOKUP(N28,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Backup Failure","Misplacement or theft of Backup information",null,null,{"$f":"IF(ISNUMBER(AA29),VLOOKUP(AA29,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE29),VLOOKUP(AE29,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E29),VLOOKUP(E29,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F29),VLOOKUP(F29,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M29),VLOOKUP(M29,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N29),VLOOKUP(N29,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Information Management and Data Security ","Loose identification of sensitive data or protection of data in transit or stored in the cloud, and prevention of data leakage",null,null,{"$f":"IF(ISNUMBER(AA30),VLOOKUP(AA30,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE30),VLOOKUP(AE30,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E30),VLOOKUP(E30,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F30),VLOOKUP(F30,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M30),VLOOKUP(M30,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N30),VLOOKUP(N30,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Impact on current internal operational procedures","Review of existing operational procedures regarding change management, incident/problem management, business continuity management",null,null,{"$f":"IF(ISNUMBER(AA31),VLOOKUP(AA31,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE31),VLOOKUP(AE31,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E31),VLOOKUP(E31,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F31),VLOOKUP(F31,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M31),VLOOKUP(M31,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N31),VLOOKUP(N31,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Inaccurate Modeling of Resource Usage / Resource Exhaustion","Temporary failure to provide additional capacity and/or to meet Service Level Agreement. ",null,null,{"$f":"IF(ISNUMBER(AA32),VLOOKUP(AA32,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE32),VLOOKUP(AE32,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E32),VLOOKUP(E32,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F32),VLOOKUP(F32,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M32),VLOOKUP(M32,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N32),VLOOKUP(N32,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Integration into existing business solutions","Difficulty of Integration into legacy/current environment (interfaces)",null,null,{"$f":"IF(ISNUMBER(AA33),VLOOKUP(AA33,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE33),VLOOKUP(AE33,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E33),VLOOKUP(E33,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F33),VLOOKUP(F33,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M33),VLOOKUP(M33,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N33),VLOOKUP(N33,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Malicious Activities from an Insider","Privileged users (e.g. Administrator) performing unauthorized activities on the system (data theft, tampering…)",null,null,{"$f":"IF(ISNUMBER(AA34),VLOOKUP(AA34,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE34),VLOOKUP(AE34,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E34),VLOOKUP(E34,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F34),VLOOKUP(F34,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M34),VLOOKUP(M34,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N34),VLOOKUP(N34,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Sensitive Information Leakage","Accidental or Malicious activity leading to sensitive information being exposed to otherwise unauthorised group",null,null,{"$f":"IF(ISNUMBER(AA35),VLOOKUP(AA35,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE35),VLOOKUP(AE35,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E35),VLOOKUP(E35,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F35),VLOOKUP(F35,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M35),VLOOKUP(M35,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N35),VLOOKUP(N35,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Operations management","Provider performs operations in a manner not meeting compliance requirements (e.g. Change management, patch management)",null,null,{"$f":"IF(ISNUMBER(AA36),VLOOKUP(AA36,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE36),VLOOKUP(AE36,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E36),VLOOKUP(E36,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F36),VLOOKUP(F36,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M36),VLOOKUP(M36,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N36),VLOOKUP(N36,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Subpoena and e-discovery","Confiscation of critical system as a result of subpoena by law-enforcement agencies or civil suits",null,null,{"$f":"IF(ISNUMBER(AA37),VLOOKUP(AA37,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE37),VLOOKUP(AE37,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E37),VLOOKUP(E37,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F37),VLOOKUP(F37,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M37),VLOOKUP(M37,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N37),VLOOKUP(N37,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Unauthorized access to premises","Unauthorized access to premises Including physical acccess to machines and other facilities",null,null,{"$f":"IF(ISNUMBER(AA38),VLOOKUP(AA38,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE38),VLOOKUP(AE38,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E38),VLOOKUP(E38,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F38),VLOOKUP(F38,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M38),VLOOKUP(M38,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N38),VLOOKUP(N38,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Theft of Computer Equipment","Systems or Data be stolen",null,null,{"$f":"IF(ISNUMBER(AA39),VLOOKUP(AA39,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE39),VLOOKUP(AE39,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E39),VLOOKUP(E39,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F39),VLOOKUP(F39,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M39),VLOOKUP(M39,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N39),VLOOKUP(N39,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Security of the endpoint (e.g. laptop, pc, smartphone, slate) from which the cloud service is consumed.","Inability to provide adequate policies/controls to secure the end-point ",null,null,{"$f":"IF(ISNUMBER(AA40),VLOOKUP(AA40,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE40),VLOOKUP(AE40,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E40),VLOOKUP(E40,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F40),VLOOKUP(F40,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M40),VLOOKUP(M40,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N40),VLOOKUP(N40,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Human Resource Constraints","Inability to find and retain the right resources to ensure service and support",null,null,{"$f":"IF(ISNUMBER(AA41),VLOOKUP(AA41,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE41),VLOOKUP(AE41,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E41),VLOOKUP(E41,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F41),VLOOKUP(F41,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M41),VLOOKUP(M41,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N41),VLOOKUP(N41,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Natural Disasters","Unable to handle Natural Disaster Situations (Business Continuity Management)",null,null,{"$f":"IF(ISNUMBER(AA42),VLOOKUP(AA42,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE42),VLOOKUP(AE42,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E42),VLOOKUP(E42,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F42),VLOOKUP(F42,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M42),VLOOKUP(M42,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N42),VLOOKUP(N42,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Licensing Risks","Licensing and intellectual property right conditions are not met",null,null,{"$f":"IF(ISNUMBER(AA43),VLOOKUP(AA43,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE43),VLOOKUP(AE43,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E43),VLOOKUP(E43,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F43),VLOOKUP(F43,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M43),VLOOKUP(M43,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N43),VLOOKUP(N43,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Traditional Security, Business Continuity and Disaster Recovery","Failure for the  provider to  implement datacenters security, business continuity and disaster recovery plans",null,null,{"$f":"IF(ISNUMBER(AA44),VLOOKUP(AA44,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE44),VLOOKUP(AE44,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E44),VLOOKUP(E44,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F44),VLOOKUP(F44,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M44),VLOOKUP(M44,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N44),VLOOKUP(N44,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,null,null,null,null,null,null,null,null,null,null,"","",null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E45),VLOOKUP(E45,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F45),VLOOKUP(F45,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M45),VLOOKUP(M45,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N45),VLOOKUP(N45,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,"Market & Finance","Loss of reputation","In-house system: risk of some significant and public incidents / In the Cloud: risk with  Cloud Provider or co-tenant activities",null,null,{"$f":"IF(ISNUMBER(AA46),VLOOKUP(AA46,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,{"$f":"IF(ISBLANK(G46), B46, G46)","v":""},null,null,{"$f":"IF(ISBLANK(J46),IF(ISBLANK(E46),\"\",E46),J46)","v":""},{"$f":"IF(ISBLANK(K46),IF(ISBLANK(F46),\"\",F46),K46)","v":""},null,{"$f":"IF(ISNUMBER(AE46),VLOOKUP(AE46,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E46),VLOOKUP(E46,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F46),VLOOKUP(F46,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M46),VLOOKUP(M46,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N46),VLOOKUP(N46,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Service Termination or Failure","The Service can no longer be provided as assumed",null,null,{"$f":"IF(ISNUMBER(AA47),VLOOKUP(AA47,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE47),VLOOKUP(AE47,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E47),VLOOKUP(E47,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F47),VLOOKUP(F47,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M47),VLOOKUP(M47,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N47),VLOOKUP(N47,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Isolation Failure","Access to the Service is temporarily denied, possibly leading to reputational, critical or financial issues",null,null,{"$f":"IF(ISNUMBER(AA48),VLOOKUP(AA48,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE48),VLOOKUP(AE48,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E48),VLOOKUP(E48,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F48),VLOOKUP(F48,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M48),VLOOKUP(M48,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N48),VLOOKUP(N48,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Capacity Management","Inadequate Resource Provisioning and Investment in Infrastructure",null,null,{"$f":"IF(ISNUMBER(AA49),VLOOKUP(AA49,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE49),VLOOKUP(AE49,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E49),VLOOKUP(E49,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F49),VLOOKUP(F49,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M49),VLOOKUP(M49,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N49),VLOOKUP(N49,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Environment Agility / Time to Market","Latency or overall difficulty in being able to adjust the systems' characteristics (performance, architecture, segregation) to address dynamic environment",null,null,{"$f":"IF(ISNUMBER(AA50),VLOOKUP(AA50,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE50),VLOOKUP(AE50,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E50),VLOOKUP(E50,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F50),VLOOKUP(F50,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M50),VLOOKUP(M50,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N50),VLOOKUP(N50,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,"Incident Response","The  provider could not detect, handle incidents and report them to the DoCE with data that can be analyzed easily to satisfy legal requirements in case of forensic investigations",null,null,{"$f":"IF(ISNUMBER(AA51),VLOOKUP(AA51,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,"",null,null,"","",null,{"$f":"IF(ISNUMBER(AE51),VLOOKUP(AE51,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E51),VLOOKUP(E51,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F51),VLOOKUP(F51,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,{"$f":"IF(ISTEXT(M51),VLOOKUP(M51,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":{"$error":"#N/A"}},{"$f":"IF(ISTEXT(N51),VLOOKUP(N51,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":{"$error":"#N/A"}},{"$error":"#N/A"}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E52),VLOOKUP(E52,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F52),VLOOKUP(F52,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""}]
[null,{"$f":"IF(A53=1,IF(#REF!<43,\"Please complete the mandatory questions - \" &#REF!,\"\"),\"\")","v":""}]

{"sheet":"As is template sheet","index":5,"n_rows":54,"n_cols":29,"rows_kept":54,"cut":false,"hidden":false,"merged":[[46,1,51,1],[5,1,5,3],[7,1,16,1],[18,1,25,1],[27,1,44,1]]}
[]
[]
[]
[null,"Optional Risk Assessment for existing capability (if any exists) - [ name of existing capability here]"]
[]
[null,"Target Risk Dashboard",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Ranking calcs"]
[null,null,"Risk Control Area","Description","Risk Likelihood","Risk Impact","Risk product"]
[null,"Compliance Risks","Governance & Entreprise Risk Management","Lack of effective internal information security governance, risk management and compliance, and alignment with the  provider own security governance","Likely","Serious",{"$f":"IF(ISNUMBER(U8),VLOOKUP(U8,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E8),VLOOKUP(E8,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F8),VLOOKUP(F8,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},{"$f":"IF(AND(ISTEXT(E8),ISTEXT(F8)),(S8*T8),\"\")","v":9},null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA8*AB8),\"\")","v":""}]
[null,null,"Legal Issues : Contracts and Electronic Discovery","Storage, processing, disclosure to third-party, transfer to other legal jurisdictions of personal data and the risk for the provider not being able to produce business data in case of subpoena.","Expected","Serious",{"$f":"IF(ISNUMBER(U9),VLOOKUP(U9,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E9),VLOOKUP(E9,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":5},{"$f":"IF(ISTEXT(F9),VLOOKUP(F9,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},15,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA9*AB9),\"\")","v":""}]
[null,null,"Incident Response","Failure for the provider to detect, handle incidents and report them to the DoCE with data that can be analyzed easily to satisfy legal requirements in case of forensic investigations","Likely","Severe",{"$f":"IF(ISNUMBER(U10),VLOOKUP(U10,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E10),VLOOKUP(E10,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F10),VLOOKUP(F10,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},12,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA10*AB10),\"\")","v":""}]
[null,null,"Storage of data in multiple jurisdictions and lack of transparency","Mirroring data for delivery and redundant storage without actualized information as to where the data is stored. DoCE may unknowingly violate regulations especially if clear information is not provided about the jurisdiction of storage","Expected","Severe",{"$f":"IF(ISNUMBER(U11),VLOOKUP(U11,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"High"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E11),VLOOKUP(E11,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":5},{"$f":"IF(ISTEXT(F11),VLOOKUP(F11,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},20,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA11*AB11),\"\")","v":""}]
[null,null,"Compliance and Audit Management","Risk of failing to comply with government-mandated and industry-specific regulations and standards, and failure to get audit information from the  provider","Likely","Severe",{"$f":"IF(ISNUMBER(U12),VLOOKUP(U12,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E12),VLOOKUP(E12,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F12),VLOOKUP(F12,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},12,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA12*AB12),\"\")","v":""}]
[null,null,"Data Protection Risks","Risk of adequate Data Protection no longer being maintained to a compliant level","Likely","Severe",{"$f":"IF(ISNUMBER(U13),VLOOKUP(U13,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E13),VLOOKUP(E13,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F13),VLOOKUP(F13,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},12,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA13*AB13),\"\")","v":""}]
[null,null,"Sensitive Media Sanitization","Media cannot be physically destroyed, cannot be properly identified or no adequate procedure in place","Highly Likely","Serious",{"$f":"IF(ISNUMBER(U14),VLOOKUP(U14,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E14),VLOOKUP(E14,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":4},{"$f":"IF(ISTEXT(F14),VLOOKUP(F14,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},12,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA14*AB14),\"\")","v":""}]
[null,null,"Audit or Certification unavailable","The system cannot be audited and/or certified as it should","Likely","Serious",{"$f":"IF(ISNUMBER(U15),VLOOKUP(U15,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E15),VLOOKUP(E15,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F15),VLOOKUP(F15,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA15*AB15),\"\")","v":""}]
[null,null,"Compliance Degradation","Failure in achieving or maintaining  Compliance (to regulation, governance, standards)","Likely","Serious",{"$f":"IF(ISNUMBER(U16),VLOOKUP(U16,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E16),VLOOKUP(E16,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F16),VLOOKUP(F16,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA16*AB16),\"\")","v":""}]
[null,null,"Governance Degradation","The DoCE might cede control to the provider on a number of issues which may affect overall governance","Highly Likely","Serious",{"$f":"IF(ISNUMBER(U17),VLOOKUP(U17,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E17),VLOOKUP(E17,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":4},{"$f":"IF(ISTEXT(F17),VLOOKUP(F17,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},12,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA17*AB17),\"\")","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E18),VLOOKUP(E18,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F18),VLOOKUP(F18,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA18*AB18),\"\")","v":""}]
[null,"Strategic Risks","Information Management and Data Security ","Loose identification of sensitive data or protection of data in transit or stored in the cloud, and prevention of data leakage","Likely","Serious",{"$f":"IF(ISNUMBER(U19),VLOOKUP(U19,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E19),VLOOKUP(E19,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F19),VLOOKUP(F19,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA19*AB19),\"\")","v":""}]
[null,null,"Interoperability and Portability","Unable to make business applications interoperate between providers and lack of standards to minimize the risk of vendor lock-in","Likely","Serious",{"$f":"IF(ISNUMBER(U20),VLOOKUP(U20,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E20),VLOOKUP(E20,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F20),VLOOKUP(F20,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA20*AB20),\"\")","v":""}]
[null,null,"Poor Provider Selection","Selection of technology or service provide sub-optimal, resulting in system operational degradation","Not Likely","Serious",{"$f":"IF(ISNUMBER(U21),VLOOKUP(U21,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E21),VLOOKUP(E21,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(F21),VLOOKUP(F21,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},6,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA21*AB21),\"\")","v":""}]
[null,null,"Organizational Readiness","Unable to achieve strategic alignment, cultural and workforce readiness, championship, and stakeholder buy-in","Not Likely","Mild",{"$f":"IF(ISNUMBER(U22),VLOOKUP(U22,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Very low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E22),VLOOKUP(E22,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(F22),VLOOKUP(F22,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":2},4,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA22*AB22),\"\")","v":""}]
[null,null,"Lack of Supplier Redundancy","Unable to identify / contract an alternative supplier source","Highly Likely","Mild",{"$f":"IF(ISNUMBER(U23),VLOOKUP(U23,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E23),VLOOKUP(E23,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":4},{"$f":"IF(ISTEXT(F23),VLOOKUP(F23,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":2},8,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA23*AB23),\"\")","v":""}]
[null,null,"Lock-In","Risk associated with the migration from an in-house IT environment to an external Provider, and from one provider to another","Likely","Mild",{"$f":"IF(ISNUMBER(U24),VLOOKUP(U24,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E24),VLOOKUP(E24,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F24),VLOOKUP(F24,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":2},6,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA24*AB24),\"\")","v":""}]
[null,null,"Data classification on DoCE side","Inappropriate data classification and definition of mitigating controls leading to being unable to define requirements towards the  provider","Highly Likely","Serious",{"$f":"IF(ISNUMBER(U25),VLOOKUP(U25,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E25),VLOOKUP(E25,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":4},{"$f":"IF(ISTEXT(F25),VLOOKUP(F25,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},12,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA25*AB25),\"\")","v":""}]
[null,null,"Data migration from on-premise into the cloud (regardless whether public, private or hybrid)","Difficulty to move legacy data into a cloud based environment","Likely","Serious",{"$f":"IF(ISNUMBER(U26),VLOOKUP(U26,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E26),VLOOKUP(E26,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F26),VLOOKUP(F26,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA26*AB26),\"\")","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E27),VLOOKUP(E27,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F27),VLOOKUP(F27,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA27*AB27),\"\")","v":""}]
[null,"Operational Risks","Data Center Operations","Failure for the  provider to respect management standards and best practices and implement security controls in accordance to sensitivity of business services","Likely","Severe",{"$f":"IF(ISNUMBER(U28),VLOOKUP(U28,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E28),VLOOKUP(E28,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F28),VLOOKUP(F28,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},12,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA28*AB28),\"\")","v":""}]
[null,null,"Log & Tracing failure","Loss or Compromise of Operational Logs (including Security Logs)","Not Likely","Severe",{"$f":"IF(ISNUMBER(U29),VLOOKUP(U29,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E29),VLOOKUP(E29,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(F29),VLOOKUP(F29,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},8,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA29*AB29),\"\")","v":""}]
[null,null,"Backup Failure","Misplacement or theft of Backup information","Likely","Severe",{"$f":"IF(ISNUMBER(U30),VLOOKUP(U30,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E30),VLOOKUP(E30,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F30),VLOOKUP(F30,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},12,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA30*AB30),\"\")","v":""}]
[null,null,"Information Management and Data Security ","Loose identification of sensitive data or protection of data in transit or stored in the cloud, and prevention of data leakage","Likely","Severe",{"$f":"IF(ISNUMBER(U31),VLOOKUP(U31,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E31),VLOOKUP(E31,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F31),VLOOKUP(F31,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},12,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA31*AB31),\"\")","v":""}]
[null,null,"Impact on current internal operational procedures","Review of existing operational procedures regarding change management, incident/problem management, business continuity management","Likely","Mild",{"$f":"IF(ISNUMBER(U32),VLOOKUP(U32,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E32),VLOOKUP(E32,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F32),VLOOKUP(F32,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":2},6,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA32*AB32),\"\")","v":""}]
[null,null,"Inaccurate Modeling of Resource Usage / Resource Exhaustion","Temporary failure to provide additional capacity and/or to meet Service Level Agreement. ","Not Likely","Mild",{"$f":"IF(ISNUMBER(U33),VLOOKUP(U33,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Very low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E33),VLOOKUP(E33,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(F33),VLOOKUP(F33,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":2},4,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA33*AB33),\"\")","v":""}]
[null,null,"Integration into existing business solutions","Difficulty of Integration into legacy/current environment (interfaces)","Likely","Serious",{"$f":"IF(ISNUMBER(U34),VLOOKUP(U34,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E34),VLOOKUP(E34,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F34),VLOOKUP(F34,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA34*AB34),\"\")","v":""}]
[null,null,"Malicious Activities from an Insider","Privileged users (e.g. Administrator) performing unauthorized activities on the system (data theft, tampering…)","Likely","Serious",{"$f":"IF(ISNUMBER(U35),VLOOKUP(U35,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E35),VLOOKUP(E35,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F35),VLOOKUP(F35,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA35*AB35),\"\")","v":""}]
[null,null,"Sensitive Information Leakage","Accidental or Malicious activity leading to sensitive information being exposed to otherwise unauthorised group","Likely","Serious",{"$f":"IF(ISNUMBER(U36),VLOOKUP(U36,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E36),VLOOKUP(E36,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F36),VLOOKUP(F36,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA36*AB36),\"\")","v":""}]
[null,null,"Operations management","Provider performs operations in a manner not meeting compliance requirements (e.g. Change management, patch management)","Likely","Serious",{"$f":"IF(ISNUMBER(U37),VLOOKUP(U37,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E37),VLOOKUP(E37,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F37),VLOOKUP(F37,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA37*AB37),\"\")","v":""}]
[null,null,"Subpoena and e-discovery","Confiscation of critical system as a result of subpoena by law-enforcement agencies or civil suits","Likely","Serious",{"$f":"IF(ISNUMBER(U38),VLOOKUP(U38,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E38),VLOOKUP(E38,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F38),VLOOKUP(F38,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA38*AB38),\"\")","v":""}]
[null,null,"Unauthorized access to premises","Unauthorized access to premises Including physical acccess to machines and other facilities","Likely","Serious",{"$f":"IF(ISNUMBER(U39),VLOOKUP(U39,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E39),VLOOKUP(E39,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F39),VLOOKUP(F39,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA39*AB39),\"\")","v":""}]
[null,null,"Theft of Computer Equipment","Systems or Data be stolen","Likely","Severe",{"$f":"IF(ISNUMBER(U40),VLOOKUP(U40,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E40),VLOOKUP(E40,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F40),VLOOKUP(F40,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},12,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA40*AB40),\"\")","v":""}]
[null,null,"Security of the endpoint (e.g. laptop, pc, smartphone, slate) from which the cloud service is consumed.","Inability to provide adequate policies/controls to secure the end-point ","Not Likely","Serious",{"$f":"IF(ISNUMBER(U41),VLOOKUP(U41,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E41),VLOOKUP(E41,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(F41),VLOOKUP(F41,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},6,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA41*AB41),\"\")","v":""}]
[null,null,"Human Resource Constraints","Inability to find and retain the right resources to ensure service and support","Slight","Mild",{"$f":"IF(ISNUMBER(U42),VLOOKUP(U42,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Very low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E42),VLOOKUP(E42,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":1},{"$f":"IF(ISTEXT(F42),VLOOKUP(F42,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":2},2,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA42*AB42),\"\")","v":""}]
[null,null,"Natural Disasters","Unable to handle Natural Disaster Situations (Business Continuity Management)","Likely","Catastrophic",{"$f":"IF(ISNUMBER(U43),VLOOKUP(U43,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E43),VLOOKUP(E43,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F43),VLOOKUP(F43,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":5},15,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA43*AB43),\"\")","v":""}]
[null,null,"Licensing Risks","Licensing and intellectual property right conditions are not met","Not Likely","Severe",{"$f":"IF(ISNUMBER(U44),VLOOKUP(U44,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E44),VLOOKUP(E44,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(F44),VLOOKUP(F44,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},8,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA44*AB44),\"\")","v":""}]
[null,null,"Traditional Security, Business Continuity and Disaster Recovery","Failure for the  provider to  implement datacenters security, business continuity and disaster recovery plans","Likely","Severe",{"$f":"IF(ISNUMBER(U45),VLOOKUP(U45,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E45),VLOOKUP(E45,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F45),VLOOKUP(F45,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},12,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA45*AB45),\"\")","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E46),VLOOKUP(E46,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F46),VLOOKUP(F46,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},"",null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA46*AB46),\"\")","v":""}]
[null,"Market & Finance","Loss of reputation","In-house system: risk of some significant and public incidents / In the Cloud: risk with  Cloud Provider or co-tenant activities","Highly Likely","Serious",{"$f":"IF(ISNUMBER(U47),VLOOKUP(U47,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E47),VLOOKUP(E47,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":4},{"$f":"IF(ISTEXT(F47),VLOOKUP(F47,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},12,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA47*AB47),\"\")","v":""}]
[null,null,"Service Termination or Failure","The Service can no longer be provided as assumed","Likely","Catastrophic",{"$f":"IF(ISNUMBER(U48),VLOOKUP(U48,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E48),VLOOKUP(E48,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F48),VLOOKUP(F48,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":5},15,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA48*AB48),\"\")","v":""}]
[null,null,"Isolation Failure","Access to the Service is temporarily denied, possibly leading to reputational, critical or financial issues","Likely","Catastrophic",{"$f":"IF(ISNUMBER(U49),VLOOKUP(U49,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E49),VLOOKUP(E49,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F49),VLOOKUP(F49,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":5},15,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA49*AB49),\"\")","v":""}]
[null,null,"Capacity Management","Inadequate Resource Provisioning and Investment in Infrastructure","Likely","Mild",{"$f":"IF(ISNUMBER(U50),VLOOKUP(U50,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E50),VLOOKUP(E50,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F50),VLOOKUP(F50,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":2},6,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA50*AB50),\"\")","v":""}]
[null,null,"Environment Agility / Time to Market","Latency or overall difficulty in being able to adjust the systems' characteristics (performance, architecture, segregation) to address dynamic environment","Slight","Mild",{"$f":"IF(ISNUMBER(U51),VLOOKUP(U51,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Very low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E51),VLOOKUP(E51,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":1},{"$f":"IF(ISTEXT(F51),VLOOKUP(F51,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":2},2,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA51*AB51),\"\")","v":""}]
[null,null,"Incident Response","The  provider could not detect, handle incidents and report them to the DoCE with data that can be analyzed easily to satisfy legal requirements in case of forensic investigations","Likely","Serious",{"$f":"IF(ISNUMBER(U52),VLOOKUP(U52,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E52),VLOOKUP(E52,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(F52),VLOOKUP(F52,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9,null,null,null,null,null,{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(#REF!),VLOOKUP(#REF!,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},{"$f":"IF(AND(ISTEXT(#REF!),ISTEXT(#REF!)),(AA52*AB52),\"\")","v":""}]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(E53),VLOOKUP(E53,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(F53),VLOOKUP(F53,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""}]
[null,{"$f":"IF(A54=1,IF(#REF!<43,\"Please complete the mandatory questions - \" &#REF!,\"\"),\"\")","v":""}]

{"sheet":"Summary dashboard","index":6,"n_rows":52,"n_cols":12,"rows_kept":52,"cut":false,"hidden":false,"merged":[[5,1,14,1],[16,1,23,1],[25,1,42,1],[44,1,49,1]]}
[]
[]
[]
[]
[null,null,"Risk Control Area",null,"Ent Risk Tolerance",null,null,"As is",null,"Cloud proposal",null,"Alternative B"]
[null,"Compliance Risks","Governance & Entreprise Risk Management",null,{"$f":"'Ent Risk Appetite'!G8","v":"Moderate"},null,null,{"$f":"'As is template sheet'!G8","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P7","v":"Low"}]
[null,null,"Legal Issues : Contracts and Electronic Discovery",null,{"$f":"'Ent Risk Appetite'!G9","v":"Very low"},null,null,{"$f":"'As is template sheet'!G9","v":"Moderate"},null,{"$f":"'Cloud candidate template  Sheet'!P8","v":""}]
[null,null,"Incident Response",null,{"$f":"'Ent Risk Appetite'!G10","v":"Low"},null,null,{"$f":"'As is template sheet'!G10","v":"Moderate"},null,{"$f":"'Cloud candidate template  Sheet'!P9","v":""}]
[null,null,"Storage of data in multiple jurisdictions and lack of transparency",null,{"$f":"'Ent Risk Appetite'!G11","v":"Very low"},null,null,{"$f":"'As is template sheet'!G11","v":"High"},null,{"$f":"'Cloud candidate template  Sheet'!P10","v":""}]
[null,null,"Compliance and Audit Management",null,{"$f":"'Ent Risk Appetite'!G12","v":"Low"},null,null,{"$f":"'As is template sheet'!G12","v":"Moderate"},null,{"$f":"'Cloud candidate template  Sheet'!P11","v":""}]
[null,null,"Data Protection Risks",null,{"$f":"'Ent Risk Appetite'!G13","v":"Moderate"},null,null,{"$f":"'As is template sheet'!G13","v":"Moderate"},null,{"$f":"'Cloud candidate template  Sheet'!P12","v":""}]
[null,null,"Sensitive Media Sanitization",null,{"$f":"'Ent Risk Appetite'!G14","v":"Moderate"},null,null,{"$f":"'As is template sheet'!G14","v":"Moderate"},null,{"$f":"'Cloud candidate template  Sheet'!P13","v":""}]
[null,null,"Audit or Certification unavailable",null,{"$f":"'Ent Risk Appetite'!G15","v":"Moderate"},null,null,{"$f":"'As is template sheet'!G15","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P14","v":""}]
[null,null,"Compliance Degradation",null,{"$f":"'Ent Risk Appetite'!G16","v":"High"},null,null,{"$f":"'As is template sheet'!G16","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P15","v":""}]
[null,null,"Governance Degradation",null,{"$f":"'Ent Risk Appetite'!G17","v":"Low"},null,null,{"$f":"'As is template sheet'!G17","v":"Moderate"},null,{"$f":"'Cloud candidate template  Sheet'!P16","v":""}]
[]
[null,"Strategic Risks","Information Management and Data Security ",null,{"$f":"'Ent Risk Appetite'!G19","v":""},null,null,{"$f":"'As is template sheet'!G19","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P18","v":""}]
[null,null,"Interoperability and Portability",null,{"$f":"'Ent Risk Appetite'!G20","v":""},null,null,{"$f":"'As is template sheet'!G20","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P19","v":""}]
[null,null,"Poor Provider Selection",null,{"$f":"'Ent Risk Appetite'!G21","v":""},null,null,{"$f":"'As is template sheet'!G21","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P20","v":""}]
[null,null,"Organizational Readiness",null,{"$f":"'Ent Risk Appetite'!G22","v":""},null,null,{"$f":"'As is template sheet'!G22","v":"Very low"},null,{"$f":"'Cloud candidate template  Sheet'!P21","v":""}]
[null,null,"Lack of Supplier Redundancy",null,{"$f":"'Ent Risk Appetite'!G23","v":""},null,null,{"$f":"'As is template sheet'!G23","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P22","v":""}]
[null,null,"Lock-In",null,{"$f":"'Ent Risk Appetite'!G24","v":""},null,null,{"$f":"'As is template sheet'!G24","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P23","v":""}]
[null,null,"Data classification on DoCE side",null,{"$f":"'Ent Risk Appetite'!G25","v":""},null,null,{"$f":"'As is template sheet'!G25","v":"Moderate"},null,{"$f":"'Cloud candidate template  Sheet'!P24","v":""}]
[null,null,"Data migration from on-premise into the cloud (regardless whether public, private or hybrid)",null,{"$f":"'Ent Risk Appetite'!G26","v":""},null,null,{"$f":"'As is template sheet'!G26","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P25","v":""}]
[]
[null,"Operational Risks","Data Center Operations",null,{"$f":"'Ent Risk Appetite'!G28","v":""},null,null,{"$f":"'As is template sheet'!G28","v":"Moderate"},null,{"$f":"'Cloud candidate template  Sheet'!P27","v":""}]
[null,null,"Log & Tracing failure",null,{"$f":"'Ent Risk Appetite'!G29","v":""},null,null,{"$f":"'As is template sheet'!G29","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P28","v":""}]
[null,null,"Backup Failure",null,{"$f":"'Ent Risk Appetite'!G30","v":""},null,null,{"$f":"'As is template sheet'!G30","v":"Moderate"},null,{"$f":"'Cloud candidate template  Sheet'!P29","v":""}]
[null,null,"Information Management and Data Security ",null,{"$f":"'Ent Risk Appetite'!G31","v":""},null,null,{"$f":"'As is template sheet'!G31","v":"Moderate"},null,{"$f":"'Cloud candidate template  Sheet'!P30","v":""}]
[null,null,"Impact on current internal operational procedures",null,{"$f":"'Ent Risk Appetite'!G32","v":""},null,null,{"$f":"'As is template sheet'!G32","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P31","v":""}]
[null,null,"Inaccurate Modeling of Resource Usage / Resource Exhaustion",null,{"$f":"'Ent Risk Appetite'!G33","v":""},null,null,{"$f":"'As is template sheet'!G33","v":"Very low"},null,{"$f":"'Cloud candidate template  Sheet'!P32","v":""}]
[null,null,"Integration into existing business solutions",null,{"$f":"'Ent Risk Appetite'!G34","v":""},null,null,{"$f":"'As is template sheet'!G34","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P33","v":""}]
[null,null,"Malicious Activities from an Insider",null,{"$f":"'Ent Risk Appetite'!G35","v":""},null,null,{"$f":"'As is template sheet'!G35","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P34","v":""}]
[null,null,"Sensitive Information Leakage",null,{"$f":"'Ent Risk Appetite'!G36","v":""},null,null,{"$f":"'As is template sheet'!G36","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P35","v":""}]
[null,null,"Operations management",null,{"$f":"'Ent Risk Appetite'!G37","v":""},null,null,{"$f":"'As is template sheet'!G37","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P36","v":""}]
[null,null,"Subpoena and e-discovery",null,{"$f":"'Ent Risk Appetite'!G38","v":""},null,null,{"$f":"'As is template sheet'!G38","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P37","v":""}]
[null,null,"Unauthorized access to premises",null,{"$f":"'Ent Risk Appetite'!G39","v":""},null,null,{"$f":"'As is template sheet'!G39","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P38","v":""}]
[null,null,"Theft of Computer Equipment",null,{"$f":"'Ent Risk Appetite'!G40","v":""},null,null,{"$f":"'As is template sheet'!G40","v":"Moderate"},null,{"$f":"'Cloud candidate template  Sheet'!P39","v":""}]
[null,null,"Security of the endpoint (e.g. laptop, pc, smartphone, slate) from which the cloud service is consumed.",null,{"$f":"'Ent Risk Appetite'!G41","v":""},null,null,{"$f":"'As is template sheet'!G41","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P40","v":""}]
[null,null,"Human Resource Constraints",null,{"$f":"'Ent Risk Appetite'!G42","v":""},null,null,{"$f":"'As is template sheet'!G42","v":"Very low"},null,{"$f":"'Cloud candidate template  Sheet'!P41","v":""}]
[null,null,"Natural Disasters",null,{"$f":"'Ent Risk Appetite'!G43","v":""},null,null,{"$f":"'As is template sheet'!G43","v":"Moderate"},null,{"$f":"'Cloud candidate template  Sheet'!P42","v":""}]
[null,null,"Licensing Risks",null,{"$f":"'Ent Risk Appetite'!G44","v":""},null,null,{"$f":"'As is template sheet'!G44","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P43","v":""}]
[null,null,"Traditional Security, Business Continuity and Disaster Recovery",null,{"$f":"'Ent Risk Appetite'!G45","v":""},null,null,{"$f":"'As is template sheet'!G45","v":"Moderate"},null,{"$f":"'Cloud candidate template  Sheet'!P44","v":""}]
[]
[null,"Market & Finance","Loss of reputation",null,{"$f":"'Ent Risk Appetite'!G47","v":""},null,null,{"$f":"'As is template sheet'!G47","v":"Moderate"},null,{"$f":"'Cloud candidate template  Sheet'!P46","v":""}]
[null,null,"Service Termination or Failure",null,{"$f":"'Ent Risk Appetite'!G48","v":""},null,null,{"$f":"'As is template sheet'!G48","v":"Moderate"},null,{"$f":"'Cloud candidate template  Sheet'!P47","v":""}]
[null,null,"Isolation Failure",null,{"$f":"'Ent Risk Appetite'!G49","v":""},null,null,{"$f":"'As is template sheet'!G49","v":"Moderate"},null,{"$f":"'Cloud candidate template  Sheet'!P48","v":""}]
[null,null,"Capacity Management",null,{"$f":"'Ent Risk Appetite'!G50","v":""},null,null,{"$f":"'As is template sheet'!G50","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P49","v":""}]
[null,null,"Environment Agility / Time to Market",null,{"$f":"'Ent Risk Appetite'!G51","v":""},null,null,{"$f":"'As is template sheet'!G51","v":"Very low"},null,{"$f":"'Cloud candidate template  Sheet'!P50","v":""}]
[null,null,"Incident Response",null,{"$f":"'Ent Risk Appetite'!G52","v":""},null,null,{"$f":"'As is template sheet'!G52","v":"Low"},null,{"$f":"'Cloud candidate template  Sheet'!P51","v":""}]
[]
[null,{"$f":"IF(A52=1,IF(#REF!<43,\"Please complete the mandatory questions - \" &#REF!,\"\"),\"\")","v":""}]

{"sheet":"A worked example-Hybrid","index":7,"n_rows":51,"n_cols":29,"rows_kept":51,"cut":false,"hidden":false,"merged":[[2,26,2,28],[43,1,48,1],[2,7,2,9],[2,11,2,12],[4,1,13,1],[15,1,22,1],[24,1,41,1]]}
[null,"Example analysis based on the worked example of Department of Citizen Engagement in the \"Cloud Risk Decision Framework\" fieldbook",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,"Ranking calcs"]
[]
[null,null,null,null,null,null,null,"Compensating Controls",null,null,null,"Residual Risks",null,null,null,null,null,null,null,null,null,null,null,null,null,null,"RAW INPUT CALCS"]
[null,null,"Risk Control Area","Description","Risk Likelihood","Risk Impact",null,"Mitigation Description","Risk Likelihood","Risk Impact",null,"Risk Likelihood","Risk Impact","RISK PRODUCT",null,null,null,null,null,null,null,null,null,null,null,null,"Liklihood number","Impact number","Factored result"]
[null,"Compliance Risks","Governance & Entreprise Risk Management","Lack of effective internal information security governance, risk management and compliance, and alignement with the  provider own security governance","Likely","Mild",null,"Cloud Solution  ISO27001 certified and externally audited","Likely","Mild",null,{"$f":"IF(ISBLANK(I5), E5, I5)","v":"Likely"},{"$f":"IF(ISBLANK(J5), F5, J5)","v":"Mild"},{"$f":"IF(ISNUMBER(AA5),VLOOKUP(AC5,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L5),VLOOKUP(L5,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(J5),VLOOKUP(J5,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":2},{"$f":"IF(AND(ISTEXT(L5),ISTEXT(M5)),(AA5*AB5),\"\")","v":6}]
[null,null,"Legal Issues : Contracts and Electronic Discovery","Storage, processing, disclosure to third-party, transfer to other legal jurisdictions of personal data and the risk for the provider not being able to produce business data in case of subpoena.","Expected","Severe",null,"Can be addressed by segmenting the mails systems that need to remain on-premice or on private cloud","Slight","Severe",null,{"$f":"IF(ISBLANK(I6), E6, I6)","v":"Slight"},"Severe",{"$f":"IF(ISNUMBER(AA6),VLOOKUP(AC6,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Very low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L6),VLOOKUP(L6,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":1},{"$f":"IF(ISTEXT(J6),VLOOKUP(J6,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},{"$f":"IF(AND(ISTEXT(L6),ISTEXT(M6)),(AA6*AB6),\"\")","v":4}]
[null,null,"Incident Response","Failure for the provider to detect, handle incidents and report them to the DoCE with data that can be analyzed easily to satisfy legal requirements in case of forensic investigations","Likely","Serious",null,"Cloud Solution  ISO27001 certified and externally audited + Contractual SLA","Highly likely","Mild",null,"Highly likely","Mild",{"$f":"IF(ISNUMBER(AA7),VLOOKUP(AC7,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L7),VLOOKUP(L7,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":4},{"$f":"IF(ISTEXT(J7),VLOOKUP(J7,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":2},8]
[null,null,"Storage of data in multiple jurisdictions and lack of transparency","Mirroring data for delivery and redundant storage without actualized information as to where the data is stored. DoCE may unknowingly violate regulations especially if clear information is not provided about the jurisdiction of storage","Expected","Serious",null,"Can be addressed by segmenting the mails systems that need to remain on-premice or on private cloud","Not Likely","Mild",null,"Not Likely","Mild",{"$f":"IF(ISNUMBER(AA8),VLOOKUP(AC8,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Very low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L8),VLOOKUP(L8,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J8),VLOOKUP(J8,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":2},4]
[null,null,"Compliance and Audit Management","Risk of failing to comply with government-mandated and industry-specific regulations and standards, and failure to get audit information from the  provider","Likely","Serious",null,"Cloud Solution complianf with regulations ABC and XYZ in DoCE Country","Not Likely","Mild",null,"Not Likely","Mild",{"$f":"IF(ISNUMBER(AA9),VLOOKUP(AC9,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Very low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L9),VLOOKUP(L9,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J9),VLOOKUP(J9,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":2},4]
[null,null,"Data Protection Risks","Risk of adequate Data Protection no longer being maintained to a compliant level","Likely","Serious",null,"Cloud Solution  ISO27001 certified and externally audited + Contractual SLA","Not Likely","Serious",null,"Not Likely","Serious",{"$f":"IF(ISNUMBER(AA10),VLOOKUP(AC10,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L10),VLOOKUP(L10,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J10),VLOOKUP(J10,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},6]
[null,null,"Sensitive Media Sanitization","Media cannot be physically destroyed, cannot be properly identified or no adequate procedure in place","Highly Likely","Serious",null,"Contractual SLA and specific agreement on retention and destruction policy compliant with DoCE regulation","Not Likely","Serious",null,"Not Likely","Serious",{"$f":"IF(ISNUMBER(AA11),VLOOKUP(AC11,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L11),VLOOKUP(L11,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J11),VLOOKUP(J11,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},6]
[null,null,"Audit or Certification unavailable","The system cannot be audited and/or certified as it should","Likely","Serious",null,"Cloud Solution  ISO27001 certified and externally audited","Likely","Serious",null,"Likely","Serious",{"$f":"IF(ISNUMBER(AA12),VLOOKUP(AC12,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L12),VLOOKUP(L12,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(J12),VLOOKUP(J12,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9]
[null,null,"Compliance Degradation","Failure in achieving or maintaining  Compliance (to regulation, governance, standards)","Likely","Serious",null,"Quarterly Compliance Check + external Audit","Likely","Serious",null,"Likely","Serious",{"$f":"IF(ISNUMBER(AA13),VLOOKUP(AC13,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L13),VLOOKUP(L13,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(J13),VLOOKUP(J13,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9]
[null,null,"Governance Degradation","The DoCE might cede control to the provider on a number of issues which may affect overall governance","Highly Likely","Serious",null,"Mail systems under high/specific governance could remain on private cloud","Not Likely","Serious",null,"Not Likely","Serious",{"$f":"IF(ISNUMBER(AA14),VLOOKUP(AC14,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L14),VLOOKUP(L14,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J14),VLOOKUP(J14,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},6]
[null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISNUMBER(AA15),VLOOKUP(AB15,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L15),VLOOKUP(L15,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(J15),VLOOKUP(J15,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},""]
[null,"Strategic Risks","Information Management and Data Security ","Loose identification of sensitive data or protection of data in transit or stored in the cloud, and prevention of data leakage","Likely","Serious",null,"Transition Procedure and Data Classification inheritance","Highly likely","Serious",null,{"$f":"IF(ISBLANK(I16), E16, I16)","v":"Highly likely"},"Serious",{"$f":"IF(ISNUMBER(AA16),VLOOKUP(AC16,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L16),VLOOKUP(L16,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":4},{"$f":"IF(ISTEXT(J16),VLOOKUP(J16,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},12]
[null,null,"Interoperability and Portability","Unable to make business applications interoperate between providers and lack of standards to minimize the risk of vendor lock-in","Likely","Serious",null,"DoCE uses Microsoft Technologies in-house extensively","Highly likely","Serious",null,"Highly likely","Serious",{"$f":"IF(ISNUMBER(AA17),VLOOKUP(AC17,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L17),VLOOKUP(L17,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":4},{"$f":"IF(ISTEXT(J17),VLOOKUP(J17,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},12]
[null,null,"Poor Provider Selection","Selection of technology or service provide sub-optimal, resulting in system operational degradation","Not Likely","Serious",null,"Selection of Microsoft Office 365 considered best-of-breed","Not Likely","Serious",null,"Not Likely","Serious",{"$f":"IF(ISNUMBER(AA18),VLOOKUP(AC18,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L18),VLOOKUP(L18,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J18),VLOOKUP(J18,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},6]
[null,null,"Organizational Readiness","Unable to achieve strategic alignment, cultural and workforce readiness, championship, and stakeholder buy-in","Not Likely","Serious",null,"Require specifc ramp-up phase with agreed-upon SLA","Slight","Serious",null,"Slight","Serious",{"$f":"IF(ISNUMBER(AA19),VLOOKUP(AC19,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Very low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L19),VLOOKUP(L19,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":1},{"$f":"IF(ISTEXT(J19),VLOOKUP(J19,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},3]
[null,null,"Lack of Supplier Redundancy","Unable to identify / contract an alternative supplier source","Highly Likely","Serious",null,null,"Slight","Serious",null,"Slight","Serious",{"$f":"IF(ISNUMBER(AA20),VLOOKUP(AC20,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Very low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L20),VLOOKUP(L20,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":1},{"$f":"IF(ISTEXT(J20),VLOOKUP(J20,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},3]
[null,null,"Lock-In","Risk associated with the migration from an in-house IT environment to an external Provider, and from one provider to another","Likely","Serious",null,"DoCE uses Microsoft Technologies in-house extensively - reducing the transition risks","Likely","Serious",null,"Likely","Serious",{"$f":"IF(ISNUMBER(AA21),VLOOKUP(AC21,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L21),VLOOKUP(L21,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(J21),VLOOKUP(J21,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9]
[null,null,"Data classification on DoCE side","Inappropriate data classification and definition of mitigating controls leading to being unable to define requirements towards the  provider","Highly Likely","Serious",null,"Need to clean up Data Classification and deployment BEFORE handing over to Cloud Provider","Highly likely","Serious",null,"Highly likely","Serious",{"$f":"IF(ISNUMBER(AA22),VLOOKUP(AC22,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L22),VLOOKUP(L22,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":4},{"$f":"IF(ISTEXT(J22),VLOOKUP(J22,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},12]
[null,null,"Data migration from on-premise into the cloud (regardless whether public, private or hybrid)","Difficulty to move legacy data into a cloud based environment","Likely","Serious",null,"DoCE uses Microsoft Technologies in-house extensively - reducing the transition risks","Not Likely","Severe",null,"Not Likely","Severe",{"$f":"IF(ISNUMBER(AA23),VLOOKUP(AC23,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L23),VLOOKUP(L23,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J23),VLOOKUP(J23,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},8]
[null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISNUMBER(AA24),VLOOKUP(AB24,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L24),VLOOKUP(L24,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(J24),VLOOKUP(J24,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},""]
[null,"Operational Risks","Data Center Operations","Failure for the  provider to respect management standards and best practices and implement security controls in accordance to sensitivity of business services","Likely","Serious",null,"Cloud Solution  ISO27001 certified and externally audited + Contractual SLA","Likely","Serious",null,{"$f":"IF(ISBLANK(I25), E25, I25)","v":"Likely"},"Serious",{"$f":"IF(ISNUMBER(AA25),VLOOKUP(AC25,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L25),VLOOKUP(L25,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(J25),VLOOKUP(J25,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9]
[null,null,"Log & Tracing failure","Loss or Compromise of Operational Logs (including Security Logs)","Not Likely","Serious",null,"Cloud Solution  ISO27001 certified and externally audited","Not Likely","Serious",null,"Not Likely","Serious",{"$f":"IF(ISNUMBER(AA26),VLOOKUP(AC26,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L26),VLOOKUP(L26,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J26),VLOOKUP(J26,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},6]
[null,null,"Backup Failure","Misplacement or theft of Backup information","Likely","Serious",null,"Cloud Solution  ISO27001 certified and externally audited","Slight","Serious",null,"Slight","Serious",{"$f":"IF(ISNUMBER(AA27),VLOOKUP(AC27,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Very low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L27),VLOOKUP(L27,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":1},{"$f":"IF(ISTEXT(J27),VLOOKUP(J27,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},3]
[null,null,"Information Management and Data Security ","Loose identification of sensitive data or protection of data in transit or stored in the cloud, and prevention of data leakage","Likely","Serious",null,"Need to clean up Data Classification and deployment BEFORE handing over to Cloud Provider + agree upon specific SLAs related to data protection","Likely","Serious",null,"Likely","Serious",{"$f":"IF(ISNUMBER(AA28),VLOOKUP(AC28,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L28),VLOOKUP(L28,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(J28),VLOOKUP(J28,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9]
[null,null,"Impact on current internal operational procedures","Review of existing operational procedures regarding change management, incident/problem management, business continuity management","Likely","Serious",null,null,"Likely","Serious",null,"Likely","Serious",{"$f":"IF(ISNUMBER(AA29),VLOOKUP(AC29,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L29),VLOOKUP(L29,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(J29),VLOOKUP(J29,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9]
[null,null,"Inaccurate Modeling of Resource Usage / Resource Exhaustion","Temporary failure to provide additional capacity and/or to meet Service Level Agreement. ","Not Likely","Serious",null,"Addressed through SLA","Highly likely","Serious",null,"Highly likely","Serious",{"$f":"IF(ISNUMBER(AA30),VLOOKUP(AC30,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L30),VLOOKUP(L30,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":4},{"$f":"IF(ISTEXT(J30),VLOOKUP(J30,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},12]
[null,null,"Integration into existing business solutions","Difficulty of Integration into legacy/current environment (interfaces)","Likely","Serious",null,"DoCE uses Microsoft Technologies in-house extensively - reducing the transition risks","Highly likely","Serious",null,"Highly likely","Serious",{"$f":"IF(ISNUMBER(AA31),VLOOKUP(AC31,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L31),VLOOKUP(L31,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":4},{"$f":"IF(ISTEXT(J31),VLOOKUP(J31,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},12]
[null,null,"Malicious Activities from an Insider","Privileged users (e.g. Administrator) performing unauthorized activities on the system (data theft, tampering…)","Likely","Serious",null,"Cloud Solution  ISO27001 certified and externally audited","Not Likely","Severe",null,"Not Likely","Severe",{"$f":"IF(ISNUMBER(AA32),VLOOKUP(AC32,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L32),VLOOKUP(L32,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J32),VLOOKUP(J32,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},8]
[null,null,"Sensitive Information Leakage","Accidental or Malicious activity leading to sensitive information being exposed to otherwise unauthorised group","Likely","Serious",null,"Cloud Solution  ISO27001 certified and externally audited","Not likely","Serious",null,"Not likely","Serious",{"$f":"IF(ISNUMBER(AA33),VLOOKUP(AC33,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L33),VLOOKUP(L33,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J33),VLOOKUP(J33,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},6]
[null,null,"Operations management","Provider performs operations in a manner not meeting compliance requirements (e.g. Change management, patch management)","Likely","Serious",null,"SLA + Compliance to 6 sigmas standards","Likely","Serious",null,"Likely","Serious",{"$f":"IF(ISNUMBER(AA34),VLOOKUP(AC34,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L34),VLOOKUP(L34,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(J34),VLOOKUP(J34,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9]
[null,null,"Subpoena and e-discovery","Confiscation of critical system as a result of subpoena by law-enforcement agencies or civil suits","Likely","Serious",null,"System Distribution within Cloud renders this situation less problematic","Not Likely","Serious",null,"Not Likely","Serious",{"$f":"IF(ISNUMBER(AA35),VLOOKUP(AC35,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L35),VLOOKUP(L35,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J35),VLOOKUP(J35,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},6]
[null,null,"Unauthorized access to premises","Unauthorized access to premises Including physical acccess to machines and other facilities","Likely","Serious",null,"Cloud Solution  ISO27001 certified and externally audited","Slight","Serious",null,"Slight","Serious",{"$f":"IF(ISNUMBER(AA36),VLOOKUP(AC36,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Very low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L36),VLOOKUP(L36,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":1},{"$f":"IF(ISTEXT(J36),VLOOKUP(J36,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},3]
[null,null,"Theft of Computer Equipment","Systems or Data be stolen","Likely","Serious",null,"Cloud Solution  ISO27001 certified and externally audited","Not Likely","Serious",null,"Not Likely","Serious",{"$f":"IF(ISNUMBER(AA37),VLOOKUP(AC37,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L37),VLOOKUP(L37,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J37),VLOOKUP(J37,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},6]
[null,null,"Security of the endpoint (e.g. laptop, pc, smartphone, slate) from which the cloud service is consumed.","Inability to provide adequate policies/controls to secure the end-point ","Not Likely","Serious",null,"Standard set of endpoint policies available and can be enforced through SLA","Likely","Serious",null,"Likely","Serious",{"$f":"IF(ISNUMBER(AA38),VLOOKUP(AC38,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L38),VLOOKUP(L38,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(J38),VLOOKUP(J38,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9]
[null,null,"Human Resource Constraints","Inability to find and retain the right resources to ensure service and support","Slight","Serious",null,null,"Not likely","Mild",null,"Not likely","Mild",{"$f":"IF(ISNUMBER(AA39),VLOOKUP(AC39,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Very low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L39),VLOOKUP(L39,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J39),VLOOKUP(J39,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":2},4]
[null,null,"Natural Disasters","Handling of Natural Disaster Situations (Business Continuity Management)","Likely","Serious",null,"Architecture of the Cloud Solution + SLA","Not Likely","Catastrophic",null,"Not Likely","Catastrophic",{"$f":"IF(ISNUMBER(AA40),VLOOKUP(AC40,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L40),VLOOKUP(L40,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J40),VLOOKUP(J40,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":5},10]
[null,null,"Licensing Risks","Unable to handle Natural Disaster Situations (Business Continuity Management)","Not Likely","Serious",null,"Contractual Agreement with DoCE ","Not Likely","Severe",null,"Not Likely","Severe",{"$f":"IF(ISNUMBER(AA41),VLOOKUP(AC41,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L41),VLOOKUP(L41,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J41),VLOOKUP(J41,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},8]
[null,null,"Traditional Security, Business Continuity and Disaster Recovery","Failure for the  provider to  implement datacenters security, business continuity and disaster recovery plans","Likely","Serious",null,"Cloud Solution  ISO27001 certified and externally audited","Not Likely","Serious",null,"Not Likely","Serious",{"$f":"IF(ISNUMBER(AA42),VLOOKUP(AC42,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L42),VLOOKUP(L42,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J42),VLOOKUP(J42,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},6]
[null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISNUMBER(AA43),VLOOKUP(AB43,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":""},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L43),VLOOKUP(L43,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":""},{"$f":"IF(ISTEXT(J43),VLOOKUP(J43,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":""},""]
[null,"Market & Finance Risks","Loss of reputation","In-house system: risk of some significant and public incidents / In the Cloud: risk with  Cloud Provider or co-tenant activities","Highly Likely","Serious",null,"Departments with high criticality remain on-premise or on Private Cloud","Not Likely","Severe",null,{"$f":"IF(ISBLANK(I44), E44, I44)","v":"Not Likely"},"Severe",{"$f":"IF(ISNUMBER(AA44),VLOOKUP(AC44,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L44),VLOOKUP(L44,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J44),VLOOKUP(J44,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":4},8]
[null,null,"Service Termination or Failure","The Service can no longer be provided as assumed","Likely","Serious",null,"Solution Architecture","Not Likely","Serious",null,"Not Likely","Serious",{"$f":"IF(ISNUMBER(AA45),VLOOKUP(AC45,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L45),VLOOKUP(L45,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J45),VLOOKUP(J45,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},6]
[null,null,"Isolation Failure","Access to the Service is temporarily denied, possibly leading to reputational, critical or financial issues","Likely","Serious",null,"Solution Architecture","Likely","Serious",null,"Likely","Serious",{"$f":"IF(ISNUMBER(AA46),VLOOKUP(AC46,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L46),VLOOKUP(L46,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(J46),VLOOKUP(J46,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},9]
[null,null,"Capacity Management","Inadequate Resource Provisioning and Investment in Infrastructure","Likely","Serious",null,"Cloud Offering a strategic product for Microsoft","Highly likely","Serious",null,"Highly likely","Serious",{"$f":"IF(ISNUMBER(AA47),VLOOKUP(AC47,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Moderate"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L47),VLOOKUP(L47,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":4},{"$f":"IF(ISTEXT(J47),VLOOKUP(J47,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},12]
[null,null,"Environment Agility / Time to Market","Latency or overall difficulty in being able to adjust the systems' characteristics (performance, architecture, segregation) to address dynamic environment","Slight","Serious",null,null,"Likely","Mild",null,"Likely","Mild",{"$f":"IF(ISNUMBER(AA48),VLOOKUP(AC48,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L48),VLOOKUP(L48,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":3},{"$f":"IF(ISTEXT(J48),VLOOKUP(J48,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":2},6]
[null,null,"Incident Response","The  provider could not detect, handle incidents and report them to the DoCE with data that can be analyzed easily to satisfy legal requirements in case of forensic investigations","Likely","Serious",null,"Cloud Solution  ISO27001 certified and externally audited","Not Likely","Serious",null,"Not Likely","Serious",{"$f":"IF(ISNUMBER(AA49),VLOOKUP(AC49,VLookup!$A$23:$B$47,2,FALSE),\"\")","v":"Low"},null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"IF(ISTEXT(L49),VLOOKUP(L49,VLookup!$A$2:$B$6,2,\"FALSE\"),\"\")","v":2},{"$f":"IF(ISTEXT(J49),VLOOKUP(J49,VLookup!$A$13:$B$17,2,\"False\"),\"\")","v":3},6]
[]
[null,{"$f":"IF(A51=1,IF(#REF!<43,\"Please complete the mandatory questions - \" &#REF!,\"\"),\"\")","v":""}]

{"sheet":"VLookup","index":8,"n_rows":47,"n_cols":14,"rows_kept":47,"cut":false,"hidden":false,"merged":[]}
["LIKELIHOOD"]
["Expected",5,null,"Lookup tables used in other sheets"]
["Highly likely",4]
["Likely",3]
["Not likely",2]
["Slight",1]
[]
[]
[]
[]
[]
["IMPACT"]
["Catastrophic",5]
["Severe",4]
["Serious",3]
["Mild",2,null,null,null,null,null,null,"Very high","21-25",null,"Risk","LxI","Code"]
["Low",1,null,null,null,null,null,null,"High","16-20",null,"Very high","21-25"]
[null,null,null,null,null,null,null,null,"Moderate","11-15",null,"High","16-20"]
[null,null,null,null,null,null,null,null,"Low","6-10",null,"Moderate","2015-11-01"]
[null,null,null,null,null,null,null,null,"Very low","1-5",null,"Low","2012-10-06"]
["SUM",null,null,null,null,null,null,null,null,null,null,"Very low","2012-05-01"]
[]
[25,"Very high"]
[24,"Very high"]
[23,"Very high"]
[22,"Very high"]
[21,"Very high"]
[20,"High"]
[19,"High"]
[18,"High"]
[17,"High"]
[16,"High"]
[15,"Moderate"]
[14,"Moderate"]
[13,"Moderate"]
[12,"Moderate"]
[11,"Moderate"]
[10,"Low"]
[9,"Low"]
[8,"Low"]
[7,"Low"]
[6,"Low"]
[5,"Very low"]
[4,"Very low"]
[3,"Very low"]
[2,"Very low"]
[1,"Very low"]