If an organisation uses external cloud services, it is more or less dependent on the respective cloud service provider. As a result, the organisation may no longer be able to fully control the outsourced business processes or the associated information—or, in particular, their security. Despite possible controls, the organisation also depends at a certain point on the cloud service provider to properly implement the necessary security safeguards. Failure in this regard results in inadequate protection of business processes and business-critical information.

In addition, the use of external cloud services can lead to the loss of knowledge about information security and technology within the organisation. As a result, the organisation may no longer be able to assess whether the protective safeguards taken by the provider are sufficient. This makes it very difficult to change providers, as well. The cloud service provider could also exploit this dependency—for example, to enforce price increases or lower its quality of service.