Tshepo Motshegoa, CIO at SEACOM.

Cloud computing continues to be one of the most impactful technological trends for businesses in South Africa today. 

Experts predict local spending on cloud services will increase this year, with a hybrid cloud approach – IT architecture that combines public and private cloud environments – trumping traditional on-premise IT infrastructure.

As more enterprises move their operations and infrastructure to the cloud, they are required to adhere to all regulatory frameworks and ensure they remain compliant with all relevant laws related to data sovereignty, privacy, and security. 

Enterprises may treat compliance as a given, especially when taking a lift-and-shift approach to migrating exact copies of applications and workloads, but it’s never that simple. 

When migrating, they need to ensure their migration aligns with all legal requirements and protects all relevant stakeholders.

The need for governance

Like any part of a business, IT is subject to governance. Policies and rules guide the organisation to achieving its goals and outlining the objectives and responsibilities of all stakeholders. 

This principle extends to cloud services, with cloud governance intended to regulate how users and businesses utilise cloud environments. For many, cloud governance is just an extension of IT governance but, in the event of a sizable migration, organisations may find themselves needing to develop new rules and frameworks that best suit their new architectures.

Governance is also a legal matter. Organisations, both local and multinational, are obligated to adhere to all relevant regulatory requirements that relate to IT infrastructure and the handling of data. 

The go-to example of this is Europe’s General Data Protection Regulation (GDPR) but, as South Africa’s business sector continues to digitalise, local regulations such as the Protection of Personal Information (POPI) Act come into sharper focus. 

At the same time, the proliferation of the cloud brings data sovereignty into focus too, as organisations now need mechanisms to monitor and control data crossing international borders and territories.

Taking a holistic approach to security

Cloud computing adds a new layer of complexity to compliance as it introduces new players to an organisation’s IT operations. 

At the same time, dropping all workloads into a public cloud environment does not absolve organisations of the responsibility of ensuring they remain compliant.

Failing to recognise this, companies may suffer severe consequences ranging from fines and penalties to legal challenges and reputational damage.

To reap the benefits of the cloud, while remaining compliant, organisations need to follow some best practices. First and foremost is fully comprehending your cloud model, as public, private, and hybrid environments influence the standards they need to adhere to.

Organisations should also thoroughly read their service level agreements with cloud providers, which should clearly outline environment segmentation and stipulate where data can and cannot be geographically located.

Meanwhile, security sits at the heart of compliance. Cloud infrastructure demands a holistic approach to security and the resulting strategy should incorporate all threat protection and mitigation products, including data encryption and multi-factor authentication for all users.

Cloud security posture management (CSPM) – a category of security products that help automate security and compliance assurance – is a must-have for organisations as it can help them continuously monitor infrastructure for misconfigurations and gaps in policy enforcement.

The future of compliance

Like any component of enterprise IT, governance and compliance in the cloud are subject to new trends that transform existing processes. 

Artificial intelligence (AI) and machine learning, arguably the biggest buzzwords in the tech world right now, can be used to improve compliance procedures and reduce false positives by gathering, analysing, and filtering large amounts of data. 

Workflow automation via AI can also lower the cost of compliance procedures and the human capital required to oversee them, as well as minimise human error that can occur through data misinterpretation.

Another trend that could transform cloud compliance is blockchain technology. Immutable audit trails and smart contracts for security policies reinforce organisations’ ability to verify compliance, while also improving transparency, accountability, and authenticity.

Compliance trends like these may still be in their infancy, but the time to act is now. By taking compliance seriously and engaging with trusted vendors and experts on frameworks, local enterprises can turn being compliant into a key business asset. One that enables digitalisation and represents an investment in the future.