Who we are and why we exist

On October 13, 1994, Netscape Navigator was launched, allowing non-technical users to access the internet. Two years later, Compaq developed a business plan on how to utilize the internet through the browser, coining the term "Cloud". Cloud computing is when organizations use the browser and the internet to run their operations, like when using Outlook, Gmail, or QuickBooks Online.

Fast forward to 2024, over 5 billion people use the internet. Cloud computing is prevalent in more than 90% of the world's organizations. This means that 90% of organizations produce value for their stakeholders using tools connected to the internet, creating a dependency on Cloud providers like Microsoft for Outlook, Google for Gmail, and Intuit for QuickBooks Online. But these are not the only Cloud providers.

Cloud computing, or the use of internet and browser-enabled devices, encompasses various levels. For instance, an organization creating software for a doctor's office typically relies on cloud providers like Google Cloud, Microsoft Azure, or Amazon AWS for services and storage. In contrast, larger companies might opt to host these services on their own servers, managed by VMware with Windows as the operating system. Each segment of this supply chain presents unique risks that require effective management through controls, a process known as Cybersecurity Management. It's important to note that terms such as 'cyber', 'internet', 'IT', 'digital', and 'cloud' are often used interchangeably in this context.

For this economic system to function effectively, informed trust in the supply chain is essential. This is where impartial assurance providers play a crucial role, informing stakeholders about the status of an organization's information risks and controls. However, the assurance process often becomes complex and ineffective. Instances where schools, hospitals, financial systems, retailers, and others have their cloud resources held for ransom – reminiscent of old-age piracy – occur despite these organizations having assurance processes in place, such as ISO 27001 certification or SOC 2 attestations. Unfortunately, these can sometimes provide a false sense of assurance to stakeholders. Complade is an organization on a mission to rectify this issue.

Cybersecurity and data privacy standards are developed by the community to streamline processes, similar to the metric standard or Generally Accepted Accounting Principles (GAAP). When organizations utilize, implement, and get "certified" in standards like NIST CSF, ISO 27001, or CyberSecure Canada, yet still fail to protect their resources, the issue does not lie with the standard itself. Rather, it's due to a broken assurance process that leads to a false sense of assurance. This results in negative consequences such as complacency, apathy, and negligence among its stakeholders. Complade is an organization dedicated to resolving this challenge.