LinkedIn
Twitter
At Google Cloud’s Office of the CISO, we help customers navigate cloud-enabled digital transformations. Over the past few years, we've gathered valuable insights from countless conversations about successful cloud migrations. Here, we'll share those learnings and address common security challenges organizations face. For many readers, this isn’t new, and yet it’s an area we wanted to focus on as we’re continuing to see organizations struggle with adoption.
The Initial Rush and the Inevitable Slowdown
Many large organizations embark on modernization journeys with ambitious goals: increased efficiency, improved customer experiences, and innovative features. They invest in new infrastructure, applications, and user-friendly tools.
However, the initial momentum fades. Despite apparent agreement on the goals, disagreements arise regarding implementation: how, when, and by whom. Organizations grapple with legacy systems, internal resistance to change, and unexpected costs due to the complexity of running old and new systems simultaneously.
Unexpected priorities can further derail progress. Competing initiatives lead to resource reallocation and budget adjustments, causing delays and deviations from the original plan.
While these challenges are common, they don't have to be insurmountable. By anticipating and proactively addressing them, organizations can achieve successful cloud migrations. Here are some practical tips based on our observations:
#1: Prioritize Executive and Organizational Alignment
Clear communication and collaboration are essential for a smooth cloud migration. This might sound simple, but it's crucial for long-term success.
As we've emphasized before, aligning CxO ownership, business priorities, risk tolerance, funding, and incentives is fundamental.
Establish a core team of empowered representatives from various departments (Risk, Compliance, Legal, Cybersecurity, Procurement, Data Governance, etc.). This named team will define and guide the migration, ensuring alignment with strategic goals. These subject matter experts will serve as central points of contact, identify trends, and share knowledge, helping to ensure there are no empty seats at the table.
Proactive stakeholder engagement at the project's inception minimizes resistance and ensures efficient execution. Bringing key teams in early avoids the reactive scenario where late joiners disrupt progress by questioning established strategies. Late engagement results in redundant evaluations and undermines project timelines.
Cloud impacts every aspect of the business. Defining roles and aligning on goals early on minimizes risks and inefficiencies, fostering a unified and efficient transformation. This approach helps everyone move together toward a shared vision, building a transformation-oriented culture where every team involved is invested in the initiative’s success.
#2 - Scale Operations with Processes, Tools & Automation
New initiatives present opportunities to redefine processes and controls, and to embrace automation and improve coverage and consistency. However, we recognize that migrating to the cloud can feel overwhelming, particularly in organizations with established platforms, applications and processes that need to continue to function without interruption.
Some organizations opt for a piecemeal migration, moving services individually. This allows for incremental scalability but can overlook broader business context and interdependencies, particularly in security and threat modeling. If you choose this approach, maintain a holistic view of end-to-end processes and controls.
A workload-enabled approach, which prioritizes business outcomes and addresses service interdependencies, requires more upfront project management due to its complexity. To support this approach, consider implementing top level shared KPIs and metrics to align teams (e.g. business, IT, security, finance) and incentivize collaboration, making both teamwork attributes and project delivery a formal part of performance expectations.
Regardless of the approach you choose, review and update existing control requirements for cloud compatibility, ask critical questions about risk mitigation and automation at scale, and revisit compliance with control frameworks in the process. Map your existing controls, identifying their origins, ownership, relevance, monitoring mechanisms, and consistency. This will lay the foundation for a secure and compliant cloud environment, ultimately fostering a cohesive cloud strategy.
We recognize, particularly for well established institutions, that such an undertaking may feel insurmountable as technology evolves, industry standards shift, and uncovering the historical rationale for certain decisions may be difficult. To mitigate some of these challenges, before undertaking the review, it’s important to agree at the outset of what “done” looks like. In other words, control owners should determine, in consultation and collaboration with risk and compliance teams, what would be acceptable as evidence of control effectiveness.
Consider resources like CSA’s cloud controls matrix, CRI’s control framework, and FINOS’ common cloud controls, to bridge industry frameworks with practical implementation. Where possible, codify operational controls to reduce their manual nature and potential for inconsistent application, while driving scalability, reliability, and architectural and operational effectiveness standards.
This gradual shift towards automation and streamlined processes can also enhance the ability to effectively partner with the second and third lines of defense. Automate controls and engage stakeholders from all lines of defense early on. Define clear criteria for control evidence and align on risk tolerance.
This systematic approach provides comprehensive visibility and control, reduces technical debt, and establishes clear metrics for measuring progress, providing meaningful insights to senior management and the board.
#3 – Embrace the Culture Shift
Choosing the approach that makes the most sense for your organization underscores the importance of upfront evaluation and planning for organizational readiness. It's not uncommon for existing teams to operate in silos, especially without top-down alignment on incentives and deliverables. Cloud migration requires not just a technology shift, but also a culture shift.
“Culture eats strategy for breakfast” most widely attributed to Peter Drucker is absolutely true here. This is only achieved through leadership and executive alignment.
A successful cloud migration transcends mere technological implementation; it necessitates a profound cultural change within the organization. This shift involves moving away from siloed operations and rigid hierarchies towards a more agile, collaborative, and learning-oriented environment. Upskilling and reskilling the workforce is paramount. Employees need to be equipped with the necessary cloud competencies to manage, optimize, and secure the new infrastructure. This includes not just technical training, but also fostering a mindset that embraces continuous learning and adaptation to the rapidly evolving cloud landscape.
Enable and incentivize the workforce to adopt cloud-native practices. Recognizing and rewarding employees who contribute to successful migration and innovation fosters a sense of ownership and encourages proactive engagement, ultimately driving the desired cultural transformation.
To mitigate key person risk and build a resilient cloud environment, cross-training becomes indispensable. By ensuring that multiple team members possess expertise across different cloud domains, organizations minimize the impact of individual departures or skill gaps. This fosters a more flexible and adaptable workforce, capable of handling diverse cloud challenges.
Cross-training also promotes knowledge sharing and collaboration, breaking down silos and fostering a culture of collective responsibility. This collaborative approach enhances problem-solving capabilities and strengthens the overall team dynamic, leading to smoother cloud operations and faster issue resolution.
In summary, below is an illustrative journey map of how to rationalize and evolve your teams and processes for a successful and secure cloud migration, summarizing the insights shared above. Following this guidance will lead to continual improvement as the organization transforms and scales, converging on shared goals and enabling measurable business results. For additional thoughts on this topic, tune in to the Cloud Security podcast.
