Cloud Governance, Demystified

In today’s digital world, the need for organizations to align cloud capabilities with business requirements grows every day. While cloud provides dynamic flexibility and scale, it requires organizations to maximize information security to protect their brand reputation from unplanned service disruptions. A lack of governance also significantly increases the risk of data vulnerability. Some of the challenges which organizations will need to be prepared to manage, sooner rather than later, include:

• Provisioning and orchestration
• Technology control over IT, data and information security
• Resource optimization and cost management
• Change management
• Resource capabilities
• Business resiliency
• IT risk management and compliance

So, what is the answer to this dynamic and challenging technology landscape? Cloud Governance.  

Defining Cloud Governance

Cloud governance involves putting in place the right processes and controls to ensure an organization’s cloud-based data remains secure. Effective cloud governance helps organizations maintain balance. While information loss is the first repercussion of a data breach, these events also trigger an avalanche of issues, including unplanned costs to eliminate control gaps and penalties paid to customers. We’ve seen numerous examples where a breach resulted in a damaged reputation magnified by the speed of social media.

An organization may choose to use a public, private or hybrid model, and each brings unique challenges. Because most organizations deploy a hybrid model, the steps required to effectively manage the model can quickly become complicated. From controls to compliance to costs, the challenges inherent in each type of cloud service model and how the organization chooses to tackle those issues will ultimately form the foundation of a governance strategy. 

Developing a Cloud Governance Strategy

With models and challenges defined, organizations have taken the first step in understanding the requirements and limitations of cloud governance. We then suggest organizations consider these factors:

Let’s look at this real-world example of an organization using two different public clouds, AWS and Azure. This company found itself losing control due to the lack of standardization between the cloud service provider platforms. In this case, an effective cloud governance strategy would focus on cloud migration, backup, provisioning and orchestration and compliance to bridge the standardization gap. With the governance framework, standards, policies and control procedures aligned, the organization will be able to administer operations and manage against their IT risk profile and appetite.

Resource training is also critical, as we often see organizations realize after making the switch to cloud, that they could have attained better results and avoided significant rework costs resulting from human errors. Training also raises awareness about cloud associated sustainability, IT risks and potential impacts to the organization if not managed and maintained.

Cloud governance plays a major role in optimizing resources and cost management. Without effective governance, organizations often see higher than anticipated costs due to factors like redundant services. Effective implementation of cloud technologies can provide the business economies of scale, lower capital cost and distribute the cost structure across a variety of variable expenditures when managed properly. Variable costs need to be constrained without forgoing agility. Changes in IaaS, PaaS, SaaS configuration alters the cost structure and services an organization will receive. Identifying organizational responsibility is critical to optimization and cost containment.

Aligning cloud governance to business priorities ensures the governance blueprint will effectively support the business. Cloud governance is a continuous process which requires, at a minimum, an annual review across key stakeholders at the enterprise and business unit levels.

A cloud governance strategy cannot be perceived as “one size fits all.” Cloud governance needs to adhere to a consistent cycle of maintenance. This cycle enables the organization to tailor it’s cloud governance strategy, framework, policies, standards and procedures. We often share this Gartner definition of key elements of a governance cycle with clients as they begin to consider their governance objectives:

Source: Gartner

We also suggest forming a cloud governance board to ensure the governance strategy, framework and policies are appropriately formulated and implemented. To be fully effective, a formal communication strategy should be developed and communicated to to cloud office champions, release coordinators and product managers. This strengthens support for the strategy across the organization. The governance board will also define key metrics (SLAs, asset lifecycle management, business cycle, etc.) to aggregate, analyze and assess overall effectiveness of the governance program while also identifying opportunities for continuous improvement to optimize cloud resources and manage associated costs, all while maintaining regulatory compliance and managing IT risk.

Conclusion

It’s a tough world out there in the cloud. The very survival of a business in a data-driven economy is susceptible to complexities with data management and anticipating where the next cyber risk may come from. The shift from traditional on-premise data centers to cloud to achieve automation and operational agility significantly changes how the business is managed. To overcome these challenges, it is imperative organizations adopt a cloud governance model that is aligned to business priorities to manage the cloud effectively and securely.