Cloud residual risk assessment tool

A computing device comprising:

• a memory;
• and
• one or more processors in communication with the memory and configured to:
• obtain data defining a first plurality of risks for a current host, wherein the data defining the first plurality of risks corresponds to one or more risk factors for each of two or more of an application domain, a hosting service domain, or a data center domain;
• determine a first set of residual risk scores for each risk of the first plurality of risks;
• aggregate the first set of residual risk scores associated with the current host to form a first aggregate residual risk score;
• generate a synthetic application that embodies characteristics of an application on the current host and deploy the synthetic application to a future host;
• obtain data defining a second plurality of risks of the future host by monitoring performance of the future host with the synthetic application, wherein the data defining the second plurality of risks corresponds to one or more risk factors for each of two or more of an application domain, a hosting service domain, or a data center domain;
• determine a second set of residual risk scores for each risk of the second plurality of risks after it is determined that the future host has met control objectives of a control adherence framework;
• aggregate the second set of residual risk scores associated with the future host to form a second aggregate residual risk score;
• determine whether the second aggregate residual risk score is less than the first aggregate residual risk score;
• and
• migrate assets from the current host to the future host.

A non-transitory computer-readable storage medium storing instructions that, when executed, cause one or more processors of a server device to:

• obtain data defining a first plurality of risks for a current host, wherein the data defining the first plurality of risks corresponds to one or more risk factors for each of two or more of an application domain, a hosting service domain, or a data center domain;
• determine, a first set of residual risk scores for each risk of the first plurality of risks;
• aggregate the first set of residual risk scores associated with the current host to form a first aggregate residual risk score;
• generate a synthetic application that embodies characteristics of an application on the current host and deploy the synthetic application to a future host;
• obtain data defining a second plurality of risks of the future host by monitoring performance of the future host with the synthetic application, wherein the data defining the second plurality of risks corresponds to one or more risk factors for each of two or more of an application domain, a hosting service domain, or a data center domain;
• determine a second set of residual risk scores for each risk of the second plurality of risks after it is determined that the future host has met control objectives of a control adherence framework;
• aggregate the second set of residual risk scores associated with the future host to form a second aggregate residual risk score;
• determine whether the second aggregate residual risk score is less than the first aggregate residual risk score;
• and
• migrate assets from the current host to the future host.