The Federal Financial Institutions Examination Council releaseda statement Tuesday highlighting key elements that financialinstitutions need to address before deciding whether to outsourcecloud computing services.

In its summary statement, the FFIEC said financial institutionshave to consider the “fundamentalsof risk and risk management defined in the FFIEC InformationTechnology Examination Handbook (IT Handbook), especially theOutsourcing Technology Services Booklet (Outsourcing Booklet).”

The outsourcing booklet reviews specific issues of cloudcomputing such as data classification, data segregation andrecoverability. The booklet also addresses vendor management,information security, legal, regulatory and reputationalconsiderations, business continuity planning and auditing.

“The FFIEC statement is quite timely because there has been alot of buzz about cloud computing and how cloud computing can helpfinancial services,” said David Albertazzi, a senior IT analystwith the Aite Group in Boston.

“There are a lot of compelling benefits in cloud computing, butthere are a lot of considerations as well. Up until now, therehasn't been much from regulatory agencies which specificallyaddresses cloud computing, so the statement is very welcome,”Albertazzi said.

The statement revealed no surprises about FFIEC's outsourcingguidelines, he said.

“The fundamentals of risk and risk management defined in the ITHandbook apply to cloud computing as they do to other forms ofoutsourcing. Cloud computing may require more robust controls dueto the nature of the service,” the FFIEC position paper reads inpart.

“When evaluating the feasibility of outsourcing to acloud-computing service provider, it is important to look beyondpotential benefits and to perform a thorough due diligence and riskassessment of elements specific to that service. As with otherservice provider offers, cloud computing may not be appropriate forall financial institutions,” the paper said.