The shared responsibility model is a fundamental concept in cloud governance. The cloud provider (CSP) is responsible for the security *of* the cloud—the hardware, software, networking, and facilities that run the cloud services. The customer (the company) is responsible for security *in* the cloud—this includes managing their data, classifying assets, configuring access controls, and setting encryption for data at rest and in transit. This clear delineation is the most appropriate and practical approach.

Governance policies must be clear, actionable, and implementable. A vague statement like “comply with local laws” does not provide operational guidance. Teams won’t know *which* laws apply (e.g., GDPR, CCPA, specific sector regulations), *what* data classifications are involved, or *how* to configure cloud storage locations (regions, zones). This creates a high risk of non-compliance because there is no concrete control to follow. Effective policy must translate legal requirements into specific technical and procedural mandates.

While lift-and-shift can speed up migration, it is often antithetical to cloud optimization and security. This strategy does not refactor the application to use cloud-native services (like managed databases, serverless functions, or auto-scaling). Consequently, the application may not be resilient, scalable, or cost-effective. More critically, it often replicates poor security architectures (like flat networks, weak IAM models) and misses the opportunity to implement cloud-native security controls, thereby perpetuating risk.

You cannot manage what you cannot measure. The first step must be visibility and attribution. A cost allocation audit using detailed billing reports and analyzing resource tags (or lack thereof) is essential to understand *who* is spending *what* and *why*. This identifies wasteful resources (e.g., forgotten test instances, over-provisioned services), untagged projects, or potentially malicious activity. Taking drastic action (like option 0) without this analysis could disrupt critical business functions. Governance relies on data-driven decisions.

A service credit is the primary, and often sole, remedy defined in a cloud provider’s SLA for failing to meet service commitments (like uptime percentage). It is typically calculated as a percentage of the customer’s bill for the affected service during the outage period. It is crucial to understand that service credits are not designed to compensate for actual business losses (which would be covered by liability clauses, if at all); they are a contractual mechanism for partial refunds based on performance failure.

A core governance objective in a multi-cloud environment is to enforce consistency and maintain control. Cloud-agnostic tools (for IAM, cost management, security posture, compliance monitoring) provide a single pane of glass to apply uniform policies, detect configuration drift, and manage costs across different providers. This reduces the complexity and risk of managing disparate, provider-specific tool sets and processes, thereby supporting the strategic flexibility that multi-cloud aims to provide.

In the SaaS model, the provider manages everything from the application down to the infrastructure. The customer’s data and business processes are dependent on the provider’s resilience. Therefore, understanding the provider’s BCDR capabilities—including Recovery Time Objective (RTO) and Recovery Point Objective (RPO)—and ensuring they meet or exceed the organization’s own business continuity requirements is paramount. The other options (data center details, OS versions, HR policies) are typically obscured or managed entirely by the SaaS provider.

Just-in-Time (JIT) access is a security best practice that enforces the principle of least privilege in a dynamic way. Instead of standing, permanent administrative privileges, JIT elevates a user’s access only when needed, for a specific, limited duration, and often requires a manager’s approval. This significantly reduces the attack surface by minimizing the time window in which privileged accounts are active. All actions taken during the JIT session are fully logged, providing a clear audit trail.

Effective cloud governance requires knowing what you have, who owns it, and what it’s for. A lack of consistent, mandatory resource tagging is a classic governance failure in asset management. Without tags (like CostCenter, Application, Owner, Environment), it becomes impossible to perform accurate cost allocation, enforce compliance policies based on context, manage the lifecycle of resources, or perform cleanup of orphaned assets. This leads to financial waste, security blind spots, and operational inefficiency.

The shared responsibility model is a fundamental concept in cloud governance. The cloud provider (CSP) is responsible for the security *of* the cloud—the hardware, software, networking, and facilities that run the cloud services. The customer (the company) is responsible for security *in* the cloud—this includes managing their data, classifying assets, configuring access controls, and setting encryption for data at rest and in transit. This clear delineation is the most appropriate and practical approach.0