29Jul

What is Cloud Governance? Why Cloud Governance is important?

Cloud computing delivers faster, more agile responses to changing business demands than previous ways used to deliver IT services. Along with these and other numerous benefits, the cloud also introduces a significant risk: the loss of control.

This can lead to cost overruns, inefficient use of cloud resources, security breaches, data leaks and failure to meet compliance obligations.

Good governance practices mitigate those risks. A cloud governance framework defines how to control key management points in cloud operations. It also helps set boundaries across potentially competing interests in an organization.

What is Cloud Governance?

Cloud governance is a set of rules and policies adopted by companies that run services in the cloud. The goal of cloud governance is to enhance data security, manage risk, and enable the smooth operation of cloud systems.

Cloud governance ensures that asset deployment, system integration, data security, and other aspects of cloud computing are properly planned, considered, and managed. It is highly dynamic, because cloud systems can be created and maintained by different groups in the organization, involve third-party vendors, and can change on a daily basis.

Why is Cloud Governance Important?

Cloud environment is much more complex than on-premise. That is why we need to initiate Cloud governance to meets organizational policies, security best practices and compliance obligations.

By implementing a cloud governance framework, organizations can take control of their cloud environment and its data by obtaining complete visibility into all of their cloud activity. This, in turn, helps them to optimize performance, lower operational costs, and minimize security risks—especially as cloud usage grows

Cloud Governance Model Principles

The following five principles are a good starting point for building your cloud governance model:

Compliance with policies and standards—cloud usage standards must be consistent with regulations and compliance standards used by your organization and others in your industry.
Alignment with business objectives—cloud strategy should be an integral part of the overall business and IT strategy. All cloud systems and policies should demonstrably support business goals.
Collaboration—there should be clear agreements between owners and users of cloud infrastructure, and other stakeholders in the relevant organizational units, to ensure they make appropriate and mutually beneficial use of cloud resources.
Change management—all changes to a cloud environment must be implemented in a consistent and standardized manner, subject to the appropriate controls.
Dynamic response—cloud governance should rely on monitoring and cloud automation to dynamically respond to events in the cloud environment.

How to Design and Implement a Cloud Governance Framework

The following are the primary components of a cloud governance framework.

Cloud Financial Management

In many organizations, cloud costs quickly get out of hand. Cloud services often promise to reduce IT costs, but this only holds true if costs are duly managed. There are three elements of cloud financial management:

Financial policies clarifying how the organization plans to use the cloud. For example, policies can define in which cases managed services should be used to reduce in-house operating costs, or specify a cost management checklist that must be followed before deploying new cloud services.
Budgets define the specific allowance for different parts of the organization or different categories of cloud services.
Cost reporting is difficult to achieve in a consistent way. Some cloud services have unpredictable charges that can appear in different places of the cloud infrastructure—for example, cloud snapshots used for backup can be stored across different regions and accounts. You can use cost reporting tools provided by the cloud vendor, or adopt third party tools that cover multiple clouds.

Cloud Operations Management

Operations management involves defining processes for deployment of services. These processes should include:

A clear definition of resources allocated to the service over time
Service-level agreements (SLAs) to define expected performance
Ongoing monitoring to make sure SLAs are met
Process and required checks before deploying code to production
Access control requirements

Strong cloud operations management is an excellent way to prevent shadow IT. It can conserve costs by preventing unnecessary use of cloud resources, and can dramatically improve the return on investment of cloud expenditure in the long term.

Cloud Data Management

The cloud makes it easier to collect and analyze huge amounts of data, but this makes data management a much bigger challenge. Cloud governance should specify how to manage the entire data lifecycle in the cloud. This includes:

Building a data classification scheme, and setting policies for data at different levels of sensitivity
Ensuring all data is encrypted, at rest and in transit
Putting in place appropriate access controls for each type of data
Using data masking to reduce the risk of sensitive data when it is used for scenarios like development, testing, or training
Developing a tiering strategy, moving data over time from high cost fast access systems to lower cost archival systems
Ensuring that data lifecycle management is automated—this is critical to apply policies in large scale cloud deployments

Cloud Security and Compliance Management

Cloud governance takes responsibility for all the key topics of enterprise security. It determines what are the organization’s security and compliance requirements, and ensuring they are enforced in the cloud environment:

Cloud governance should strike a balance between business drivers and requirements, real security risks, and the requirements of compliance standards. It should use existing policies and security practices, extending them to the cloud and translating them to the cloud environment.

Ref:

https://www.imperva.com/learn/data-security/cloud-governance/