What we do
Governance & Compliance
We set up Cloud Adoption Framework governance as working controls in Azure, with the evidence to show an auditor when they ask.
- Frameworks
- CAF: Govern, Secure · Well-Architected: Security, Operational Excellence
- Good first step
- Microsoft CAF Readiness Assessment, a baseline in 3–4 weeks
The problem
In most estates we look at, governance lives in a document written during the build. The estate has changed a lot since then and the document hasn't. This becomes a problem when an auditor asks for evidence that a control has been operating over the last quarter, because a document can only show how the control was designed. Audit dates are usually set by someone else, so the gap tends to surface under time pressure.
You probably need this if
- Your governance model is a document, and the estate has moved on since it was written
- Producing audit evidence means a fortnight of screenshots and chasing people
- You report against NCSC Cloud Security Principles or DSPT and assemble it by hand each time
- Each control is assigned to a team, with no named person behind it
What the service covers
- 1Microsoft CAF Govern put into practice: each cloud risk documented with a policy statement, enforced by an Azure Policy assignment and monitored for compliance
- 2Regulatory mapping to the frameworks you report against: NCSC Cloud Security Principles, the NCSC Cyber Assessment Framework where GovAssure applies, Cyber Essentials Plus, ISO 27001, and DSPT where applicable
- 3Azure Policy compliance reporting with evidence export, so answering an audit request becomes a query you can rerun
- 4Landing zone conformance review against the Azure landing zone design areas
- 5Change advisory input for platform-affecting changes
- 6Documented control ownership: a RACI with a named person against every control
Other areas we work in
All 8 areasAzure Platform Architecture
We design the Azure platform, check that it holds under its own governance, and hand it to your team with the controls already deployed.
Cloud Security Architecture
We design the detection, tune it to your estate, and hand your team a backlog they can work through.
Cloud Migration
We plan the move, build the landing zone it arrives into, and migrate workloads in waves your change board can approve.
Where governance work begins
Most governance work starts with a 30-minute call. We'll go through the frameworks you report against and how evidence is produced today, and suggest where to begin. If you'd like a structured baseline first, the CAF Readiness Assessment takes three to four weeks.