Cloud Governance
What this domain tests
Cloud Governance tests whether you can separate direction-setting from execution. Questions cover policy hierarchy, accountability, decision rights, the cloud center of excellence (CCoE), procurement and vendor governance, performance and value measurement, acceptable use, data classification and exit strategy. COBIT is a useful reference for aligning IT goals with enterprise goals and defining who decides.
Core rules
- Governance sets direction and constraints: who decides, what is allowed, how performance is measured. Management executes within those constraints.
- Policies must cover acceptable use, data classification, procurement, vendor due diligence and exit. A policy without an enforcement mechanism is only intent.
- Accountability stays internal even when services are outsourced. The provider can deliver a service; it cannot own the business outcome.
- A CCoE coordinates architecture, security, procurement and finance, but it should not absorb business accountability or become a pure approval bottleneck.
- Governance needs metrics: cost, risk, compliance and service performance, reported to accountable executives.
Worked example
Marketing buys a SaaS collaboration tool with a corporate card, without IT review. Reasoning: this is a governance gap, not merely a technology problem. The response is a procurement gate, risk tiering based on data classification, register entry, contract review for data location and exit, and a communication plan. Blaming the tool misses the missing decision right.
Traps
Writing policy that no one enforces; treating the CCoE as the sole decision-maker; leaving cloud accountability below board level; ignoring shadow IT; omitting exit clauses and data-return rights.