Cloud Governance

Cloud services are easy to start: anyone with a credit card can open an account. Without rules, a company ends up with scattered accounts, unclear ownership, surprise bills and data in places nobody approved. Cloud governance sets the guardrails. It usually defines which providers and regions are allowed, who approves new workloads, how data is classified before it moves, and which security settings are mandatory. It also covers cost tracking, tagging of resources, logging, and exit plans if a provider fails or is dropped. Much of this is written as policy and then enforced through automated checks in the cloud platform itself. The work sits between IT, security, procurement, legal and the business owners, and connects to third-party risk and regulatory outsourcing rules. Auditors reviewing a cloud programme usually ask first for the approved-provider list and evidence that the mandatory settings are checked.

A retail bank lets project teams build on a public cloud. The cloud governance group requires that any workload holding customer data uses an approved region, encrypted storage and central logging. A monthly scan finds one team's storage bucket open to the internet, and the owner is told to close it within a day.