An enterprise has made the strategic decision to reduce operating costs for the next year...

 A business risk profile is a document that identifies and evaluates the potential risks that can affect the performance, objectives, and strategy of an organization. A business risk profile can help to prioritize and mitigate the risks, as well as to align the risk management activities with the business goals and needs12.

If an enterprise has made the strategic decision to reduce operating costs for the next year and is taking advantage of cost reductions offered by an external cloud service provider, the IT steering committee’s primary concern should be updating the business risk profile. This is because using an external cloud service provider may introduce new or increased risks for the enterprise, such as security, privacy, compliance, availability, performance, or vendor lock-in risks3 . Updating the business risk profile can help the IT steering committee to assess the impact and likelihood of these risks, to evaluate the effectiveness and adequacy of the existing controls and safeguards, to identify and implement any additional measures or actions to address the gaps or issues, and to monitor and report the risk status and outcomes12. References: Business Risk Profile: Definition & Examples. How to Create a Business Risk Profile. A risk assessment model for selecting cloud service providers. Cloud Computing Security for Cloud Service Providers.