An audit report has revealed that data scientists are analyzing sensitive "big data" files using an offsite cloud because corporate servers do not have the necessary processing capabilities. A…

Although the practice is not prohibited by current policies, using an offsite cloud for sensitive data without prior authorization or assessment introduces significant, unknown risks. A formal risk analysis is the necessary first step to understand the potential impact, likelihood, and existing controls (or lack thereof) before any other corrective or policy-related actions can be effectively planned.

Updating data governance practices would follow a risk analysis, as you need to understand the risks before defining appropriate governance.

Revising the information security policy is a reactive measure that should be based on the findings of a comprehensive risk analysis.

Recommending a private cloud is a potential solution, but it's premature without first understanding the risks of the current situation and the requirements for a secure alternative.