Cloud governance and compliance for your environments
We structure the rules, roles and controls that govern your Azure, AWS and Google Cloud environments. Governance policies, risk management, GDPR and ISO compliance: your practices become clear, auditable and sustainable over time.
Rules, roles, controls
Auditable compliance
Multi-cloud and hybrid
/ Our Clients
/
What is cloud governance?
Cloud governance is the framework of rules, roles and decision-making processes that governs how your organisation designs, deploys and controls its cloud environments. It answers concrete questions:
- Who can create a resource, and against which standards?
- With what level of encryption and what traceability of access?
- Not to be confused with cyber risk governance: this is the technical side, applied to your platforms
Our cloud governance and compliance expertise
We support CIOs and IT teams in bringing their cloud environments into compliance and securing them, combining governance, risk management and technical documentation.
Cloud governance
Design and rollout of governance policies for your Azure, GCP, AWS and hybrid environments, with transformation support and team training.
GDPR compliance
Audit and remediation of your cloud environments: data protection policies, access traceability and embedding of compliant practices.
Cloud risk management
Vulnerability analysis (intrusion, service interruption, data leakage) and action plans to reduce and anticipate risks against the ISO 27001 and NIST standards.
ISO compliance audit
Audit of the security documents and processes in place, to verify compliance with current standards and improve risk management continuously.
Technical documentation
Writing and structuring the deliverables that make the difference in an audit: technical architecture documents, quality assurance plans, project plans, vulnerability reports and security assurance plans.
/ Our compliance approach
A structured, step-by-step approach to securing your cloud environments, from the initial audit through to documentation and continuous compliance monitoring.
Initial audit
Assessment of the existing environment, mapping of resources and identification of gaps against GDPR and ISO requirements and security best practice.
Risk analysis
Identification of vulnerabilities, risk assessment and prioritisation by criticality and potential impact on your business.
Action plan
Definition of corrective measures, development of the compliance roadmap and of governance policies suited to your organisation.
Compliance delivery
Implementation of policies, rollout of security measures and delivery of remediation actions on your cloud environments.
Documentation and follow-up
Formalisation of practices, drafting of technical deliverables and continuous compliance monitoring to maintain the required level over time.
/
Cloud governance, GDPR, ISO 27001 and NIS2: who requires what
Three frameworks, three different sets of expectations, and one confusion that comes up in almost every audit:
- GDPR: knowing where your personal data sits, who accesses it and on what legal basis, and being able to demonstrate it. Your cloud configuration is what provides the evidence
- ISO 27001: an information security management system, with written policies and evidence that they are applied
- NIS2: for essential and important entities, risk management and incident notification, with accountability reaching up to the board
- The confusion: your host’s certification covers its infrastructure only, never your own usage
/
Hosting outside the EU, the Cloud Act and Article 44 of the GDPR
Article 44 of the GDPR governs any transfer of personal data outside the European Union: it is only permitted where the level of protection remains equivalent. Yet most cloud services rely on groups subject to US law, under which the Cloud Act allows access to the data they host, wherever it is stored. Choosing a European region at a hyperscaler therefore does not settle the legal question.
We map where your data and backups actually reside, then we build the remediation options:
- Contractual clauses and transfer impact assessment
- Encryption with the keys held on your side
- Segregation of sensitive processing, or relocation to a European provider
/ Cloud environments we master
We work across the main hyperscalers, European clouds and hybrid environments, adapting our governance and compliance practices to the specifics of each platform and to your data location constraints.
Multi-cloud expertise adapted to your environment and your compliance requirements.
/
Security certified to ISO 27001:2022
Castelis is certified to ISO 27001:2022. This certification attests that our own information security management system meets an audited international standard: formalised policies, risk analysis, access control, incident management and regular reviews.
That is a direct guarantee for you: the practices we put in place for our clients are the ones we hold ourselves to. More than 25 years of experience and more than 500 projects delivered, with more than 80 employees at Castelis, a hunik group company bringing together 7 specialist firms.
/
Frequently asked questions
No, and that is often exactly when the urgency appears. A production cloud environment that has never been audited accumulates invisible compliance debt: forgotten permissions, unencrypted resources, incomplete logging. The earlier the intervention, the less costly and risky the remediation.
An in-house CISO knows the context better than anyone but often lacks the availability, and sometimes the distance, to run a cloud compliance programme end to end. We work alongside them: an outside perspective, specifically cloud expertise and structured deliverables that can be presented in an audit as they are.
It depends on the complexity of your environment and on the gap found during the audit. An initial audit with an action plan is delivered quickly. Full compliance then unfolds according to the scope chosen and the pace your teams can sustain alongside their projects. The initial scoping gives you a dated roadmap before any commitment.
Three things: passing an audit, whether ISO, client or partner, without improvising; passing on knowledge when the team changes; and having a reliable baseline for evolving the architecture without regressing on compliance.
No. Your host’s certification covers its infrastructure, not your usage. How you configure your resources, manage access and process data remains your responsibility. That is precisely what we audit.
If your processing relies on a provider subject to US law, yes, including when the data is stored in a European region. The real question is not whether the risk exists but which processing activities it actually affects, and which measures are proportionate. We map the effective location of your data and the technical access that is possible, then we build the remediation options with you.
Let's talk about your cloud governance
