Cloud Service Strategy and Governance
Domain 2 tests whether you can connect cloud choices to business outcomes and control them with governance, not ad hoc approvals.
Core rules
- Strategy sets target outcomes, scope, and constraints: which workloads, markets, risk tolerances, and sourcing models. A migration list is not a strategy.
- Governance is evaluate, direct, and monitor (ISO/IEC 38500). It sets decision rights, policies, guardrails, and accountability; it does not run every change.
- The service portfolio has pipeline, catalog, and retired services. The catalog should describe outcomes, options, prices, SLAs, and owners.
- Demand and financial management cover consumption forecasts, showback or chargeback, unit economics, and budget guardrails.
- Cloud strategy must address vendor lock-in, exit plans, data sovereignty, concentration risk, and contract terms before commitment.
Worked example
A regulator requires customer records to stay in-country. A team proposes a low-cost public SaaS. The strategy review finds the SaaS stores backups in another region and has weak export tooling. The decision is to keep the regulated records in a private, in-country service, while using SaaS for non-regulated collaboration. Reasoning: the constraint is legal and exit-related, so the lowest unit price is not the lowest business risk.
Traps
Equating cloud strategy with migration volume; treating governance as a bottleneck; comparing only list price and ignoring egress, exit, and retraining; ignoring data residency in backups and support access; and approving a service with no named owner.