Developing the Cloud ERP Cybersecurity Assessment Framework (CECAF) for Evidence-Based Cybersecurity Capability Assessment in Cloud ERP Platforms

Staš Heric; Samo Bobek

doi:10.2478/ngoe-2026-0017

.blurhash-client-img { display: none !important; }

Developing the Cloud ERP Cybersecurity Assessment Framework (CECAF) for Evidence-Based Cybersecurity Capability Assessment in Cloud ERP Platforms

Naše gospodarstvo/Our economy

Volume 72 (2026): Issue 3 (September 2026)

By: Staš Heric and Samo Bobek

Open Access

|Oct 2026

Abstract

The purpose of this study is to develop the Cloud ERP Cybersecurity Assessment Framework (CECAF) to systematically evaluate cybersecurity capabilities in cloud ERP platforms. The framework was developed through the synthesis of academic literature, internationally recognised cybersecurity standards, cybersecurity capability maturity assessment principles, and cloud ERP-specific cybersecurity requirements, and demonstrated through an evidence-based assessment of Infor CloudSuite using publicly available official technical documentation. The findings demonstrate that CECAF enables a structured, transparent, and reproducible evaluation of cybersecurity capabilities across multiple assessment domains. The study contributes by introducing an analytical assessment framework tailored to cloud ERP platforms and by highlighting the methodological importance of documented technical evidence for objective cybersecurity capability assessment. The framework provides practical guidance for cybersecurity evaluation and comparative assessment of cloud ERP platforms.

References

Almorsy, M., Grundy, J., & Müller, I. (2016). An analysis of the cloud computing security problem. Journal of Cloud Computing, 5(1), 38. https://doi.org/10.1186/s13677-016-0066-2
Search in Google Scholar Back to article
Anica-Popa, L.-E., Vrîncianu, M., Pugna, I.-B., & Boldeanu, D.-M. (2024). Addressing cybersecurity issues in ERP systems: Emerging trends and challenges. Proceedings of the International Conference on Business Excellence, 18(1), 1306–1323. https://doi.org/10.2478/picbe-2024-0108
Search in Google Scholar Back to article
Becker, J., Knackstedt, R., & Pöppelbuß, J. (2009). Developing maturity models for IT management: A procedure model and its application. Business & Information Systems Engineering, 1(3), 213–222. https://doi.org/10.1007/s12599-009-0044-5
Search in Google Scholar Back to article
Bertino, E. (2021). Zero Trust Architecture: Does It Help? IEEE Security & Privacy, 19 (6), 95–99. https://doi.org/10.1109/MSEC.2021.3091195
Search in Google Scholar Back to article
Brezavšček, A., & Baggia, A. (2025). Recent trends in information and cyber security maturity assessment: A systematic literature review. Systems, 13(1), 52. https://doi.org/10.3390/systems13010052
Search in Google Scholar Back to article
Cloud Security Alliance. (2024). Cloud Controls Matrix (CCM) . Retrieved from https://cloudsecurityalliance.org/research/cloud-controls-matrix
Search in Google Scholar Back to article
Demi, S., & Haddara, M. (2018). Do cloud ERP systems retire? An ERP lifecycle perspective. Procedia Computer Science, 138, 587–594. https://doi.org/10.1016/j.procs.2018.10.079
Search in Google Scholar Back to article
Dwivedi, Y. K., Hughes, L., Coombs, C., et al. (2021). Artificial Intelligence (AI): Multidisciplinary perspectives on emerging challenges, opportunities, and agenda for research, practice and policy. International Journal of Information Management, 57, 101994. https://doi.org/10.1016/j.ijinfomgt.2019.08.002
Search in Google Scholar Back to article
Infor. (2020). Infor Business Continuity Plan Overview. Retrieved from https://webassets.infor.com/images/Infor-Business-Continuity-Plan-Overview-April-2020.pdf
Search in Google Scholar Back to article
Infor. (2023). Information Security Plan (Software as a Service). Retrieved from https://dam.infor.com/api/public/content/94cc4621111741dfb603ed08dbb0f254
Search in Google Scholar Back to article
Infor. (2024). Data Privacy. Retrieved from https://www.infor.com/about/data-privacy
Search in Google Scholar Back to article
Infor. (n.d.). Audit Logging Documentation. Retrieved June 10, 2026, from https://docs.infor.com/
Search in Google Scholar Back to article
Infor. (n.d.). Federated Security. Retrieved June 9, 2026, from https://docs.infor.com/inforos/
Search in Google Scholar Back to article
Infor. (n.d.). Infor ION API Administration Guide. Retrieved June 10, 2026, from https://docs.infor.com/ionapi/
Search in Google Scholar Back to article
Infor. (n.d.). Infor OS API Gateway Administration Guide. Retrieved June 8, 2026, from https://docs.infor.com/inforos/
Search in Google Scholar Back to article
Infor. (n.d.). Infor OS Security Administration Guide. Retrieved June 10, 2026, from https://docs.infor.com/inforos/
Search in Google Scholar Back to article
Infor. (n.d.). Infor OS User Administration Guide. Retrieved June 9, 2026, from https://docs.infor.com/inforos/
Search in Google Scholar Back to article
Infor. (n.d.). Infor Trust Center. Retrieved June 10, 2026, from https://trust.infor.com/
Search in Google Scholar Back to article
International Organization for Standardization. (2022). ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection—Information security management systems—Requirements. https://www.iso.org/standard/27001.html
Search in Google Scholar Back to article
Ivanović, T., & Marić, M. (2021). Cloud ERP systems in digital transformation: Opportunities and challenges. Strategic Management, 26(4), 28–40. https://doi.org/10.5937/StraMan2104028I
Search in Google Scholar Back to article
Khan, M. Y., Ab-Rahim, R., & Yeng, S. (2025). A conceptual overview of Enterprise Resource Planning systems. International Journal of Academic Research in Business and Social Sciences, 15(5). https://doi.org/10.6007/IJARBSS/v15-i5/25490
Search in Google Scholar Back to article
Khokrale, R. (2025). Cybersecurity in ERP-integrated supply chains: Risks and mitigation strategies. The Eastasouth Journal of Information System and Computer Science, 3(2). https://doi.org/10.58812/esiscs.v3i02.869
Search in Google Scholar Back to article
Klaus, H., Rosemann, M., & Gable, G. G. (2000). What is ERP? Information Systems Frontiers, 2(2), 141–162. https://doi.org/10.1023/A:1026543906354
Search in Google Scholar Back to article
Lee, Y., Lee, J., & Kim, S. (2024). Cybersecurity challenges and strategies in cloud ERP environments: A systematic literature review. Journal of Enterprise Information Management, 37(3), 742–768. https://doi.org/10.1108/JEIM-07-2023-0283
Search in Google Scholar Back to article
Liyanage, L., Arachchilage, N. A. G., & Russello, G. (2024). SoK: Identifying limitations and bridging gaps of cybersecurity capability maturity models (CCMMs). arXiv. https://doi.org/10.48550/arXiv.2408.16140
Search in Google Scholar Back to article
Llivisaca-Villazhañay, J., Paredes-Gualtor, J., Paredes-Valverde, M. A., & Ortiz-Crespo, A. (2025). Cloud ERP adoption and digital transformation in organisations: A systematic literature review. Information Systems Frontiers. Advance online publication. https://doi.org/10.1007/s10796-025-10625-5
Search in Google Scholar Back to article
Mushtaq, S., Mohsin, M., & Mushtaq, M. M. (2025). A systematic literature review on the implementation and challenges of Zero Trust Architecture across domains. Sensors, 25(19), 6118. https://doi.org/10.3390/s25196118
Search in Google Scholar Back to article
National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0. U.S. Department of Commerce. https://www.nist.gov/cyberframework
Search in Google Scholar Back to article
Paulk, M. C., Curtis, B., Chrissis, M. B., & Weber, C. V. (1993). Capability Maturity Model, Version 1.1. IEEE Software, 10(4), 18–27. https://doi.org/10.1109/52.219617
Search in Google Scholar Back to article
Qazi, A., Khorram-Manesh, A., Vaziri, S., & Dimitrov, D. (2026). Cybersecurity capability assessment in cloud ERP systems: A maturity model approach. Computers & Security, 142, Article 103821. https://doi.org/10.1016/j.cose.2025.103821
Search in Google Scholar Back to article
Rose, S., Borchert, O., Mitchell, S., & Connelly, S. (2020). Zero trust architecture (NIST Special Publication 800-207). https://doi.org/10.6028/NIST.SP.800-207
Search in Google Scholar Back to article
Singh, U. K., & Sharma, A. (2021). Cloud computing security framework based on shared responsibility models: Cloud computing. In Cyber-Physical, IoT, and Autonomous Systems in Industry 4.0 (pp. 39-55). CRC Press.
Search in Google Scholar Back to article
Sternad Zabukovšek, S., & Bobek, S. (2025). Using the technology acceptance model for factors influencing acceptance of enterprise resource planning solutions. In Encyclopedia of Information Science and Technology, Sixth Edition (pp. 1-28). IGI Global Scientific Publishing.
Search in Google Scholar Back to article
Sunyaev, A. (2020). Internet computing: Principles of distributed systems and emerging internet-based technologies (2nd ed.). Springer. https://doi.org/10.1007/978-3-030-34957-8
Search in Google Scholar Back to article
Yin, R. K. (2018). Case study research and applications: Design and methods (6th ed.). SAGE Publications.
Search in Google Scholar Back to article