NIST SP 800-146

Apply NIST SP 800-146 Section 9.7 (Auditing and Accountability) + Section 9.8 (Cost Management) + Section 9.9 (Lessons Learned). Auditing and accountability require (a) cloud audit log ingestion into the enterprise SIEM, (b) cloud provider audit report (SOC 2 Type II / ISO 27001 / FedRAMP) reviewed annually with gap analysis, (c) right-to-audit clause in provider contracts where regulator demands it, (d) accountability matrix mapping each control objective to the responsible party (provider, consumer, shared). Cost management requires (a) tagging and allocation strategy enforced via policy, (b) FinOps function or equivalent for showback or chargeback, (c) reserved-capacity / savings-plan strategy reviewed quarterly, (d) anomaly detection on cloud spend with budget breach alerts. Lessons learned require (a) post-incident review of cloud-impacting incidents, (b) post-migration review of ev

• cloud audit log ingestion configuration in SIEM and last 90-day completeness check
• provider audit report (SOC 2 Type II / ISO 27001 / FedRAMP) with gap analysis
• FinOps tagging policy + showback / chargeback report + anomaly detection rules
• lessons-learned log linked to strategy updates

• cloud audit logs not ingested or retention shorter than policy requires
• provider audit report not reviewed or gap analysis not done
• cost anomaly detection absent or not actioned
• lessons learned captured but not fed back into strategy

Establish an enterprise cloud adoption strategy and decision framework following NIST SP 800-146 Chapter 2 (Cloud Computing Definitions and Recommendations) + Chapter 9 (General Recommendations). The strategy must articulate (a) business drivers and target outcomes (cost efficiency, elasticity, time-to-market, modernisation), (b) candidate workloads with suitability assessment per workload class (analytical batch, transactional, latency-sensitive, sensitive-data, sovereign-data), (c) target service-model mix (SaaS / PaaS / IaaS) per workload, (d) target deployment-model mix (private / community / public / hybrid) per workload, (e) explicit non-target workloads (e.g. systems classified PROTECTED that cannot use multi-tenant public). Document the decision framework template that procurement, architecture, and risk owners use to evaluate every cloud candidate consistently. Capture lessons l

• cloud adoption strategy approved by executive sponsor
• workload suitability register classifying every candidate workload
• decision-framework template used by procurement / architecture / risk for new cloud requests
• lessons-learned log feeding strategy updates

• strategy is a marketing slide rather than an operational document
• no documented exclusion list for workloads that must not use public cloud
• decision framework not enforced consistently across business units

Apply NIST SP 800-146 Chapter 8 deployment model operational recommendations. For Public Cloud (Section 8.1): assess provider transparency, security architecture, tenancy isolation, breach history, jurisdiction of operation. For Private Cloud (Section 8.2): assess capital cost, operational maturity of internal IT, automation tooling parity with public providers. For Community Cloud (Section 8.3): assess community membership criteria, shared governance model, and equitable cost-sharing. For Hybrid Cloud (Section 8.4): assess interconnect (dedicated, VPN, internet), data flow governance between private and public components, identity federation across boundaries, and consistent policy enforcement. Maintain explicit operational recommendations per deployment model and reference them when a workload is classified.

• deployment-model classification per workload
• hybrid architecture decision record covering interconnect + identity federation + data flow
• community cloud governance charter where applicable

• hybrid label used without documented architecture
• interconnect uses internet without compensating controls
• no policy enforcement parity across private and public components

Apply NIST SP 800-146 Chapter 7 IaaS operational recommendations to every IaaS service consumed. Coverage must include (a) infrastructure-as-code as the canonical provisioning method (no manual console provisioning of production), (b) base image and template hardening with documented baseline (CIS / DISA STIG / vendor secure baseline), (c) workload protection (host-based intrusion detection, anti-malware, file integrity monitoring), (d) network segmentation (VPC, subnet, security group, network ACL) with default-deny posture, (e) container and serverless protection where the workload is containerised or function-based, (f) configuration management and drift detection. Maintain an IaaS workload register that records operational posture and applies continuous compliance scanning.

• IaaS workload register with infrastructure-as-code repository link per workload
• base image / template hardening baseline (CIS / DISA STIG) with last verification date
• network segmentation diagram and security-group / NACL evidence
• continuous configuration scanning report

• production IaaS provisioned via console rather than IaC
• network segmentation not default-deny
• drift detection absent or not actioned

Apply NIST SP 800-146 Section 9.1 (Performance Considerations) + Section 9.2 (Reliability and Availability Considerations) + Section 9.3 (Service Level Recommendations) + interoperability and portability recommendations. Service Level Agreements with cloud providers must specify (a) availability target with credit regime, (b) performance metrics relevant to workload (latency, throughput, IOPS), (c) reliability and disaster recovery (RTO / RPO + provider DR posture + consumer-side DR responsibility), (d) interoperability standards supported (open APIs, standard formats, standard authentication), (e) portability commitments (data export format, application export packaging, exit assistance period). Continuous measurement against SLA must feed the cloud governance dashboard and trigger formal escalation when targets are breached.

• provider SLAs with measured monthly conformance reports
• performance and reliability dashboards for each tier-1 cloud service
• portability and exit-test evidence (last data export and last application repatriation test)

• SLA terms accepted at provider default without negotiation
• no measurement of provider SLA conformance
• portability never tested

Apply NIST SP 800-146 Chapter 6 PaaS operational recommendations to every PaaS service consumed. Coverage must include (a) application development standards aligned to PaaS-provided languages, runtimes, and libraries, (b) secure software development lifecycle integrated with PaaS deployment pipelines, (c) data layer separation (consumer-owned database vs provider-managed database), (d) portability strategy for PaaS-built applications (containerised, twelve-factor, infrastructure-as-code), (e) PaaS-specific identity and secrets management (managed identity, key vault, secret rotation), (f) build artefact and dependency provenance (software bill of materials). Maintain a PaaS register that records the operational posture for every active PaaS subscription with annual re-assessment.

• PaaS register with portability strategy per application (containerised, twelve-factor, IaC)
• SDLC integration with PaaS deployment pipeline showing security gates
• secrets management evidence (key vault / managed identity rotation log)
• software bill of materials per PaaS-deployed application

• application uses PaaS proprietary services without portability assessment
• secrets stored in source or environment variables instead of managed secret store
• no SBOM for PaaS-deployed applications

Apply NIST SP 800-146 Chapter 5 SaaS operational recommendations to every SaaS service consumed. Coverage must include (a) data ownership and exit clauses in the SaaS subscription contract, (b) provider security and privacy assurance package (SOC 2 Type II / ISO 27001 / FedRAMP equivalent), (c) application configuration baseline aligned to organisational policy (password complexity, session management, MFA, audit logging, retention), (d) integration security (SSO via SAML or OIDC, SCIM provisioning, API access control), (e) data export and portability path (machine-readable export format and frequency), (f) tenant administrator separation of duties. Maintain a SaaS register that records the operational posture for every active SaaS subscription with annual re-assessment.

• SaaS register with provider assurance (SOC 2 / ISO 27001 / FedRAMP) status per service
• configuration baseline per SaaS aligned to organisational policy (MFA, audit, retention)
• data export and exit plan per SaaS with last test date

• SaaS subscribed without provider assurance review
• configuration left at vendor defaults
• no documented exit path or exit never tested

Apply NIST SP 800-146 Section 9.4 (Security Recommendations) and Section 9.5 (Privacy Recommendations) across the cloud portfolio. Security recommendations must address (a) shared responsibility model documented per service-model, (b) identity and access management (federation, MFA, privileged access, JIT access), (c) data protection (classification, encryption at rest and in transit, key management with consumer-controlled keys where appropriate, secure deletion), (d) network protection (segmentation, default deny, edge protection), (e) monitoring and logging (cloud audit trail, SIEM ingestion, retention), (f) incident response (cloud-aware IR runbooks, provider notification channel, evidence collection capability), (g) vulnerability management (continuous scanning, patch responsibility split). Privacy recommendations must address data subject rights, lawful basis for processing in the

• shared responsibility matrix per service-model
• cloud risk register including SP 800-146 Section 9.6 open security issues with residual risk acceptance
• data classification mapping to cloud encryption + key management posture
• cross-border transfer mechanism per region (SCC / IDTA / adequacy / national)

• shared responsibility matrix generic and not service-specific
• open security issues not addressed in risk register
• cross-border transfer mechanism undocumented