How can you resolve cloud governance conflicts among teams?

Addressing cloud governance conflicts involves identifying conflict sources, such as differing objectives and standards, and establishing a detailed governance framework with clear policies and standards. Effective communication and collaboration are essential, allowing teams to share concerns and ideas openly and promoting a collaborative environment. Including stakeholders in decisions ensures diverse needs are considered, and data-driven methods can assess cloud solutions' impact. Offering continuous education on cloud governance maintains understanding and adherence to evolving standards, harmonizing varying needs and preferences and facilitating effective cloud adoption.

Often times, my customers have adopted cloud organically - with insufficient planning. This results in multiple groups "owning" cloud infrastructure without central command and control. It's important to establish a Cloud Center of Excellence or a Cloud Board of some sort. This is generally a collaboration between the IT organization, finance, security leadership and the business. The direction for this CCoE is to establish governance and controls along with standards and perhaps budgets for cloud design and consumption. This small group crosses internal org boundaries and can mitigate conflict - just starting to talk is the first step.

Establishing a Cloud Center of Excellence includes determining roles and responsibilities for managing, operating, and maturing your cloud infrastructure. I like to start with a RACI model. If you adhere to ITSM / ITIL or similar methodologies, you can use roles you've established there. It should be clear where responsibilities lie and where approvals come from and who all should be involved. It's important to include these two additional roles if you haven't already: 1. Executive sponsorship - you need at least one from IT, but often I see finance, vendor management, and business application executives as well. 2. Cloud champions - these are business users that assist you in having conversations with their peers.

There are cloud governance standards that specifically focus on cloud based infrastructure rather than general IT methodologies such as the ITIL (Information Technology Infrastructure Library) service management framework. Specific to the cloud providers there is the AWS Well-Architected Framework, Azure Cloud Adoption Framework (CAF), and the more general Cloud Native Computing Foundation (CNCF). Some examples of cloud security frameworks are cloud specific guides like CIS (Center for Internet Security) which is sort of a household name in cloud security. There's also ISO/IEC 27017 & 27018, NIST Special Publication 800-144 & 800-145, and Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM) just to name a few.

I often talk about Cloud Champions with my customers. These are users in the organization that are consuming cloud services. The policies and governance you establish needs to support the innovation that the business demands. Governance in a vacuum is counterproductive. The whole idea behind controls is to provide a standardized, safe place for IT infrastructure to operate and to facilitate increasing the value of IT for the business. If you don't engage with the business, how can you determine what is valuable to them and what kind of services they require? Using frameworks like the cloud adoption framework and well-architected frameworks can help here, but you really need to collaborate with the consumers of the platform.

In many situations, hybrid is the right solution. Microsoft provides lots of resources about how to implement a hybrid environment.

Governance frameworks and tools can really help in establishing control over your environment. Each cloud platform includes many native management tools, and some include multi and hybrid-cloud management tools. Requirements for each organization are different, and each will need to evaluate their own business needs against the features and functionality they get natively. Third-party tools often provide interesting additional features or better interfaces, but unless they differentiate substantially from native tools it may not be worthwhile to invest in them. Remember - you'll need to develop expertise in the 3rd party tools in addition to the cloud platforms themselves.

Cloud infrastructure is closer to coding than it is to traditional infrastructure in some ways. You can deploy your infrastructure from code on every platform - which means you can use Agile methodologies and apply concepts like Continuous Integration and Continuous Delivery (CI/CD) to how you manage infrastructure. DevOps is where software Development meets IT Operations. Legacy IT infrastructure operations will need updating of roles and processes to accommodate your new platform(s). Consider: 1. How does change management change when you can deploy infrastructure from code - in minutes rather than in weeks/months? 2. How is asset management different when licensing is charged as part of a service operational expenditure (OpEx)?

Cloud governance oftentimes has a tremendous amount of overlap with governance in other focus areas such as cybersecurity, business resiliency, data, etc. It is important to make sure that your governance solutions are intentionally aligned and work together, or else you may end up creating more problems than you've solved.