The US Department of the Treasury is taking aim at cloud computing and its adoption by financial services companies. In a new report, Treasury says it has found that “financial service firms ramping up their reliance on cloud-based technologies need more visibility, staff support, and cybersecurity incident response engagement from (cloud providers).”

“There is no question that providing consumers with secure and reliable financial services means greater demand for cloud-based technologies,” according to Deputy Secretary of the Treasury Wally Adeyemo, remarking on the report. “By building trust, cooperation, and collaboration at the outset, we can promote safe and effective migration for financial institutions that choose to adopt cloud services.”

The report was written in collaboration with the Financial and Banking Information Infrastructure Committee (FBIIC), an independent federal organization comprised of members from Treasury, the Federal Reserve, FDIC, Farm Credit Administration, Consumer Financial Protection Bureau, SEC, and several other agencies.

Seven Broad Areas of Concern
In announcing the report, Treasury noted that the report “does not impose any requirements and does not endorse or discourage the use of any specific provider or cloud services.” The report identifies seven broad areas of concern:

* Insufficient transparency to support due diligence and monitoring by financial institutions.

* Gaps in human capital and tools to securely deploy cloud services.

* Exposure to potential operational incidents, including those originating at a cloud provider.

* Concern that a cyber vulnerability or incident at one cloud provider may potentially have a cascading impact across the broader financial sector.

* The potential impact of market concentration in cloud service offerings on the financial sector’s resilience.

* Dynamics in contract negotiations given the current market concentration.

* International landscape and regulatory fragmentation.

The report recommends creating closer cooperation among US regulators with respect to cloud services, additional operational tests with cloud providers, and development of best practices. It said thatTreasury “will continue working with U.S. financial regulators and other agency partners, as well as financial firms and cloud providers.”

Photograph of Treasury Building from U.S. Dept. of the Treasury