---
title: Governance and Decision Making
description: Establish clear cloud decision rights, review forums, exception handling, and escalation paths for stable operations on STACKIT.
sidebar:
  label: Governance and Decision Making
  order: 1
source_url: "https://framework.stackit.cloud/migration/design-and-mobilize/operating-model/governance-and-decision-making/"
source_file: "docs/migration/design-and-mobilize/operating-model/governance-and-decision-making.mdx"
---

## Purpose

Cloud governance turns shared technical and business responsibilities into timely, traceable decisions. For STACKIT workloads, governance should connect landing-zone guardrails, workload architecture, security requirements, cost accountability, and operational risk.

## Define decision rights

Assign a named accountable owner for decisions such as:

- Landing-zone standards, shared network patterns, IAM role patterns, and policy guardrails.
- Workload architecture, service selection, resilience targets, and operational readiness.
- Security exceptions, their expiry dates, risk acceptance, and remediation ownership.
- Budget thresholds, tagging standards, and cost optimization priorities.
- Production changes, migration cutovers, rollback decisions, and major incidents.

## Establish a practical governance cadence

Use focused forums with clear inputs and decisions rather than a single broad approval board:

- **Architecture review** validates workload designs against the STACKIT platform baseline.
- **Security and compliance review** verifies controls, evidence needs, and approved exceptions.
- **Operational readiness review** confirms monitoring, support ownership, runbooks, and recovery plans before go-live.
- **Service review** evaluates reliability, demand, security findings, and costs after go-live.

Record decisions, exceptions, owners, and review dates in a decision log. This creates the audit trail needed to distinguish an approved deviation from unmanaged configuration drift.

## Related guidance

- [Account Governance](/migration/design-and-mobilize/landing-zones/account-governance/) defines the customer-account, folder, and project boundaries to which TOM decision rights apply.
- [Cost Management and Control](/migration/design-and-mobilize/landing-zones/cost-management-and-control/) defines the billing, labeling, and budget controls used in FinOps decisions.
- [Security and Compliance: Operating Model and Governance](/migration/design-and-mobilize/security-and-compliance/operating-model-and-governance/) defines control owners and mandatory review checkpoints.

## Related assets

<ScfAssetLoader showFilter={false} showSearch={false} frameworkSlug="migration" filterByTag="operating-model" />