what percentage of your identified issues actually get fixed?.

The complete loop:

the cloud governance loop breaks this cycle:. Know Your Cloud → Raise The Bar → Make Change Happen. it's not a framework or maturity model. it's a practice for turning visibility into action.

"we've made progress on cloud security". *shows dashboard with 73% compliance*. "what about the other 27%?". "well, we've identified all the issues. ". this is where most governance efforts stall. they know what's wrong but can't figure out how to make it right.

knowing what to govern is only half the battle. the practices are HOW you make it real. complete guide: which practice is your org weakest at?.

the 5 practices of cloud governance are the missing piece:. Standards: define what "good" looks like.Controls & Automation: enforce those standards.Adoption: support teams w/ tools and guidance.Rollout: introduce change thoughtfully.Measurement & Improvement: track what's working.

here's why most governance initiatives fail:. they define WHAT needs to be governed. they skip HOW to actually govern it.

RT @mattstratton: Less than two weeks until @StefGregoles & I have our backyard goth wedding!. If you’d like to give a gift, we have a fun….

He was the paragon example of what a father, a man, a human, and a leader should be. Jeff, I will miss you, buddy. We lost a shining light yesterday. 💔.

Jeff was a speaker at almost every DevOpsDays Chicago event, and the two of us co-emceed the 2023 version. I literally never heard Jeff speak about the human factors of tech and operations without him making my brain think about things in new ways.

(writing this just now made me tear us as I realized I hadn’t talked to Jeff at all this baseball season and I have to imagine he was just absolutely loving this team this year).

Jeff and I first met over ten years ago in a joint adventure for a blog for nerdy guys who were also dads. it was my first chance to really get to know Jeff in all his delightful nerdery. He co-founded the Chicago Nerds Social Club as well as being the biggest Cubs fan ever.

My heart is so heavy today. One of the finest people in the Chicago tech community passed away yesterday. @DarkAndNerdy was a brilliant, caring, and empathetic man. A great father, and one of the smartest people I ever met.

Less than two weeks until @StefGregoles & I have our backyard goth wedding!. If you’d like to give a gift, we have a fund for deluxe 3-day passes for @riotfest.bsky.social (our non-traditional honeymoon) & tattoos!.

the framework: what's sitting in your backlog of "security findings we should probably fix someday"?.

most orgs are really good at FINDING issues. they're terrible at FIXING them systematically. you can't govern what you haven't defined. that's why we start with the 5 pillars: what ARE we actually governing?.

overheard in a security meeting: "we've identified 1,247 vulnerabilities across our cloud accounts". "great! how many got fixed last month?". ". seventeen". this is the classic visibility without action problem.

When teams are asking for MORE governance instead of avoiding it, you know you're doing it right. The complete framework: Has anyone ever ASKED you for more governance? What made the difference?.

Controversial take: "cloud governance" isn't about restricting what teams can do, it's about creating conditions where they can innovate safely & efficiently. The best governance feels invisible to the people using it. Like good infrastructure, you only notice when it's missing.

What your favorite Smashing Pumpkins song says about you .