Compliance, Risk Management, and Security Architecture
Evidence, not assertion
Security and Compliance Center evaluates resources against profiles and controls, producing findings you can attach to an audit. The IBM Cloud Framework for Financial Services is a control framework IBM publishes for regulated workloads; the shared responsibility model means IBM's certifications cover the platform, while your configurations need their own evidence. Data residency is a provisioning decision per region.
Architecture patterns that satisfy auditors
Hub-and-spoke VPCs joined by Transit Gateway, with inspection and egress centralized in the hub; a dedicated logging and security account receiving audit events; centralized key management with separate custodians from platform administrators; context-based restrictions limiting control-plane access to corporate zones; tagging for inventory and ownership.
Risk framing
Map each finding to likelihood and impact, then to a compensating control. A public bucket is high impact and easily remediated; a missing key rotation schedule is lower urgency but still reportable. Separation of duties between the person who can delete a root key and the person who can read the data is a control, not a formality.
Worked example
A financial workload fails a scan because a bucket is public. Remediate by removing public access and switching to a private endpoint with a virtual private endpoint, add a context-based restriction on the control plane, then re-scan to produce a clean finding. Document the compensating controls applied during the gap.
Traps that cost marks
Claiming compliance because IBM Cloud holds a certification. Assuming a framework mapping equals technical enforcement. Forgetting that remediation changes must be re-scanned to generate evidence. Treating data residency as an account setting when it is set per resource at provisioning.