_
_
Cloud Operating Model & CoE Setup
Deloitte
Governance and Decision Making
Last updated on
Purpose
Section titled “Purpose”Cloud governance turns shared technical and business responsibilities into timely, traceable decisions. For STACKIT workloads, governance should connect landing-zone guardrails, workload architecture, security requirements, cost accountability, and operational risk.
Define decision rights
Section titled “Define decision rights”Assign a named accountable owner for decisions such as:
- Landing-zone standards, shared network patterns, IAM role patterns, and policy guardrails.
- Workload architecture, service selection, resilience targets, and operational readiness.
- Security exceptions, their expiry dates, risk acceptance, and remediation ownership.
- Budget thresholds, tagging standards, and cost optimization priorities.
- Production changes, migration cutovers, rollback decisions, and major incidents.
Establish a practical governance cadence
Section titled “Establish a practical governance cadence”Use focused forums with clear inputs and decisions rather than a single broad approval board:
- Architecture review validates workload designs against the STACKIT platform baseline.
- Security and compliance review verifies controls, evidence needs, and approved exceptions.
- Operational readiness review confirms monitoring, support ownership, runbooks, and recovery plans before go-live.
- Service review evaluates reliability, demand, security findings, and costs after go-live.
Record decisions, exceptions, owners, and review dates in a decision log. This creates the audit trail needed to distinguish an approved deviation from unmanaged configuration drift.
Related guidance
Section titled “Related guidance”- Account Governance defines the customer-account, folder, and project boundaries to which TOM decision rights apply.
- Cost Management and Control defines the billing, labeling, and budget controls used in FinOps decisions.
- Security and Compliance: Operating Model and Governance defines control owners and mandatory review checkpoints.
Related assets
Section titled “Related assets”Asset title
Framework
Asset type
Adoption
Service
Advisory
Service
Advisory
Software