---
title: Operating Model and Governance
description: Define governance roles, control ownership, and mandatory Security and Compliance checkpoints across migration design and delivery.
sidebar:
  label: Operating Model and Governance
  order: 10
source_url: "https://framework.stackit.cloud/migration/design-and-mobilize/security-and-compliance/operating-model-and-governance/"
source_file: "docs/migration/design-and-mobilize/security-and-compliance/operating-model-and-governance.mdx"
---

## Purpose

The operating model ensures Security and Compliance are embedded in all migration decisions, not handled as a final approval step.

## Why shared review is mandatory

- **Cross-domain impact**: Identity, network, logging, and workload controls affect each other.
- **Regulatory continuity**: Compliance requirements must be reflected consistently across architecture and operations.
- **Delivery reliability**: Early review avoids late redesign and go-live delays.

## Recommended governance structure

- **Platform team**: Owns shared controls and technical guardrails.
- **Security team**: Owns control requirements, threat scenarios, and assurance criteria.
- **Compliance and risk**: Owns regulatory interpretation, control mapping, and audit requirements.
- **Application teams**: Own workload-specific implementation and operational adherence.

## Suggested checkpoints by phase

- **Design checkpoint**: Validate architecture approach, trust boundaries, and mandatory controls.
- **Build checkpoint**: Validate policy enforcement and baseline implementation.
- **Pre-go-live checkpoint**: Validate evidence completeness, exception handling, and incident readiness.
- **Run checkpoint**: Validate recurring control verification and reporting cadence.

## Key artifacts

- **RACI matrix**: Decision and approval ownership across domains.
- **Control ownership map**: Mapping of each control to accountable owners.
- **Exception workflow**: Risk acceptance criteria, expiry dates, and remediation tracking.
- **Review cadence**: Recurring governance and control-review sessions.

## Related Target Operating Model guidance

[Target Operating Model](/migration/design-and-mobilize/operating-model/overview/) provides the cross-domain operating model. Its [Governance and Decision Making](/migration/design-and-mobilize/operating-model/governance-and-decision-making/) and [Roles and Responsibilities](/migration/design-and-mobilize/operating-model/roles-and-responsibilities/) pages connect control ownership to platform, workload, FinOps, and service-management responsibilities.

## Anti-patterns to avoid

- **Security as ticket queue**: Review is requested only at the end of implementation.
- **Undefined risk ownership**: Exceptions are granted without named accountability.
- **No run-phase governance**: Controls are approved once but not verified continuously.