Governance
34 items tagged with "governance"
Best Practices21
Azure Well-Architected Framework
Microsoft’s five-pillar guidance (reliability, security, cost, performance, ops) for designing and operating workloads on Azure.
FinOps Cloud Cost Best Practices
Shared responsibility model for cloud spend: Inform, Optimize, Operate phases.
OWASP Software Assurance Maturity Model (SAMM)
A maturity model that helps organizations assess and improve their software security program across governance, design, implementation, verification, and operations.
NIST Cybersecurity Framework 2.0
A voluntary framework of cybersecurity outcomes organized into six functions, govern, identify, protect, detect, respond, and recover, for managing organizational cyber risk.
NIST SP 800-53 Security and Privacy Controls
A comprehensive catalog of security and privacy controls for information systems, organized into control families with baselines for different risk levels.
Cloud Landing Zone
A pre-configured, secure, multi-account cloud foundation with baked-in identity, networking, governance, and guardrails so teams can deploy workloads safely at scale.
Data Governance Framework
A structured set of roles, policies, and processes that make an organization accountable for the quality, security, and proper use of its data assets.
Data Contracts
Explicit, version-controlled agreements between data producers and consumers that define schema, semantics, quality, and SLAs to prevent breaking changes.
Data Lineage
The traceable record of data's origin, movement, and transformation across systems, enabling impact analysis, debugging, compliance, and trust.
Schema Evolution and Schema Registry
Managing how data schemas change over time with compatibility rules and a central registry so producers and consumers evolve without breaking each other.
Data Catalog and Discovery
A searchable inventory of an organization's data assets with metadata, ownership, and lineage so people can find, understand, and trust the data they need.
ISO/IEC 42001 AI Management System
ISO/IEC 42001 is the first international standard for an Artificial Intelligence Management System, giving organizations a certifiable framework to govern AI responsibly.
AI TRiSM (Trust, Risk and Security Management)
AI TRiSM is a framework for managing the trust, risk, and security of AI systems across explainability, model operations, data protection, and runtime application security.
API-First Design
An approach that treats the API contract as a product designed before implementation, so teams agree on the interface, then build clients and servers in parallel.
API Backward Compatibility
Evolving an API without breaking existing clients by making only additive changes, versioning breaking changes, and deprecating fields gracefully over time.
Team Topologies
Team Topologies is a model for organizing business and technology teams using four team types and three interaction modes to optimize fast flow and reduce cognitive load.
Architecture Decision Records (ADRs)
An Architecture Decision Record (ADR) is a short, version-controlled document that captures one significant architectural decision, its context, and its consequences for future maintainers.
SOC 2 Compliance
SOC 2 is an AICPA auditing framework that assesses how a service organization protects customer data against five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.
PCI DSS Compliance
PCI DSS is the global security standard for organizations that handle payment card data, defining requirements to protect cardholder data across networks, systems, and processes.
GDPR Compliance Engineering
GDPR compliance engineering turns the EU General Data Protection Regulation's legal principles into concrete technical controls: lawful processing, data minimization, consent, and data-subject rights.
Cloud Cost Allocation and Tagging
Cloud cost allocation and tagging is the FinOps practice of labeling cloud resources with consistent metadata so spend can be attributed accurately to teams, products, and environments.
Reference Architectures1
Regulations4
Sarbanes-Oxley Act of 2002
US law mandating accurate financial reporting and internal controls for public companies, with implications for IT and data integrity.
SEC Cybersecurity Disclosure Rules
US SEC rules requiring public companies to disclose material cybersecurity incidents promptly and describe their risk-management governance.
EU Corporate Sustainability Reporting Directive (Directive (EU) 2022/2464)
EU directive requiring large and listed companies to report standardized, audited sustainability information including environmental, social, and governance data.
SEC Climate-Related Disclosure Rules
U.S. SEC rules requiring public companies to disclose material climate-related risks, governance, and certain emissions in registration statements and reports.
FAQs4
What is a cloud landing zone?
A landing zone is a pre-configured, secure, and scalable cloud environment that establishes a baseline for accounts, networking, identity, security, a...
What is a Kubernetes namespace?
A namespace is a way to divide a single Kubernetes cluster into multiple virtual clusters, providing a scope for names and a boundary for resources. N...
What is SOC 2 compliance?
SOC 2 is an audit framework from the AICPA that evaluates how a service organization manages customer data against five Trust Services Criteria: secur...
What is ISO 27001?
ISO/IEC 27001 is an international standard that specifies the requirements for an information security management system (ISMS), a risk-based framewor...