Neither frozen nor improvised
A governance model is designed for the organisation of one particular moment: its size, its clouds, its risks. The organisation changes: a new provider arrives, a team grows, a regulation appears, artificial intelligence gets adopted. If governance does not change with it, it becomes irrelevant. If it changes without order, it becomes impossible to follow.
The whole model, with versions
Everything that makes up governance is versioned together: the map of domains and owners, the standard, the automatic policies, the account structure, the identity roles and the indicators. A new version of the model:
- Has a number, a date and a list of changes in plain language.
- Is announced before taking effect, with a transition period.
- Explains the why of each change: an incident, an indicator, a strategic decision.
- Has its adoption measured: what share of the organisation already complies with the new version.
The inputs for change
A healthy governance model changes on the basis of signals it has already collected:
- Indicators getting worse (we saw this in the previous article).
- Exceptions that recur against the same rule.
- Incidents whose cause reveals a gap.
- Frequent escalations indicating that a decision level is badly defined.
- Strategic changes: a new cloud, a new market, a new technology.
Closing the series
Organisation before tools, named owners, decisions at the level where they belong, a standard you can comply with and that evolves, exceptions with an expiry date, a considered account structure, a single identity, policies that are inherited and governance that is measured and versioned. The goal is not to control more, but for every team to know what it can do without asking, and for the organisation to be able to demonstrate, when asked, that it does what it says.
How we apply it: Multicloud Governance.