With the increasing popularity of cloud computing technologies, the expectations towards cloud providers increase not only in terms of functionality, cost, and service delivery speed, but also for the security of the customers’ data that is stored remotely. Cloud providers can be certified for their compliance with established industry standards for data security; however, there is minimal research published on how to design internal processes to achieve this goal. The objective of this thesis is to address this gap by providing a framework that can be used by cloud providers to create a process for monitoring customer data backups. The area of backup and restore is an important part of data security, as it ensures data integrity and availability. In order to address the research objective, the Design Science methodology is combined with the software development lifecycle so that a specific software-based instantiation of the framework can be designed, implemented and evaluated.

The first outcome of the research is a set of 36 requirements for the software tool that are collected by interviewing business experts who work for SAP, a cloud provider and the partner of this research. It was found that the most important aspect of monitoring backups is to create a flexible input option for adding new system types. An intermediate outcome of the research is a method of discovering interconnections between requirements by using post-it notes that are placed on a whiteboard so that they can be positioned in relation to each other by drawing arrows and lines between them. The second major outcome is the software tool that is developed based on the findings from the requirements and is assessed for utility by a sample of users. The aspect of flexibility is addressed by basing the data collection on a search query that can be configured according to the users’ specifications. By generalising the workings of the software tool, a framework is developed as the final outcome that is independent from the underlying technical base. It consists of four stages (system analysis, solution design and development, process operation, and communication) that should enable an implementing company to create a reliable backup monitoring process.