✓ Contract:  Associated with not reading in between the lines of your contract 

✓ Billing:  Associated with ensuring that you’re billed correctly and only for the resources you consume 

Of course, your governance body has the responsibility of monitoring these and other risks on an ongoing basis. 

## Making cloud governance work 

Effective management of the cloud is going to be part people and processes and part technology. It’s really a three-part solution: 

✓ You may want to set up some sort of governing body to deal with all the different environments you now need to manage. Hopefully you already have an existing governance group in place. This group can be part of that group. The governance body has oversight responsibilities and collaborates with the business. This group deals with cloud providers to discuss the issues and negotiate terms and conditions with cloud providers. 

✓ Your organization needs to have governance bodies in the cloud that deal with standardization of services and other shared infrastructure issues. You need some sort of interface to these groups. Of course, your level of involvement depends on your level of involvement in the cloud. 

✓ Your organization also needs to have technology in the mix that helps your organization automatically monitor the performance of the cloud provider. 

## Managing Service Levels 

The third leg of the stool in the security and governance triad deals with managing service levels. Cloud providers need to monitor cloud services to ensure that they meet agreed upon service levels. This means that the performance of the servers, networks, and virtualized images in the cloud providers’ environments need to be both measured and monitored — individually and collectively — to ensure that the environ- ment is tuned to satisfy all business requirements. 

