Identification of IT security and legal requirements regarding cloud services

The adoption of cloud computing holds tremendous potential for small and medium-sized enterprises (SMEs) as it enables them to reduce costs as well as improve flexibility and scalability. In order to choose an appropriate cloud service, it is necessary to carefully identify functional and non-functional requirements. In this regard, the aspects affecting IT security as well as legal requirements are important topics to the users of SMEs. However, the smaller the enterprise, the lower the probability that there is enough expertise to identify the requirements in these subject areas. Addressing this issue, the contribution of this paper is the description of a method for identifying IT security and legal requirements regarding a cloud service in a structured kind of way. The presented method was implemented as a part of a prototype for a cloud service search. Based on this search system, an evaluation with users of SMEs was conducted. The evaluation results attest the search system and its underlying method to successfully assist users regarding the identification of relevant legal and IT security requirements, hence reducing the amount of expertise required by users of SMEs, as well as the associated effort of searching for appropriate cloud services.