Why CISOs Must Govern an Entire Control Ecosystem—Not Just Their Own Company

By Eckhart Mehler for CISOsCISO — a perspective on cybersecurity leadership, governance and the decisions that determine whether organizations retain control.

Cloud Governance Is No Longer About Your Organization

One conversation keeps repeating itself in boardrooms.

Internal Audit presents a positive report on cloud governance.

Management is satisfied.

The board concludes that cloud risks are under control.

The CISO remains uncomfortable.

Not because the audit is wrong.

But because everyone has been answering a different question.

The audit asks:

"Is the organisation governing its cloud activities appropriately?"

The CISO asks:

"Can the organisation demonstrate that the entire cloud control system is actually working?"

These are not the same question.

Yet they are often treated as if they were.

Three Professions. One Phrase. Three Meanings.

The term Cloud Governance has become overloaded.

Every stakeholder uses it.

Almost nobody means exactly the same thing.

Internal Audit

Internal Audit typically asks:

• Is there a cloud strategy?
• Are roles defined?
• Are responsibilities assigned?
• Are approval processes documented?
• Is there executive oversight?
• Are decisions recorded?
• Is reporting available?

This is a perfectly legitimate governance review.

It evaluates whether management has established an appropriate governance framework.

The Board

Boards usually ask a simpler question.

Can we trust that cloud is being managed professionally?

They seek management assurance.

They want confidence that:

• responsibilities exist,
• risks are discussed,
• decisions are controlled,
• governance structures operate.

They are not reviewing Azure policies or privileged identities.

Nor should they be.

The CISO

The CISO hears "Cloud Governance" and immediately thinks about something else.

Not governance documents.

Not steering committees.

Not reporting.

The CISO thinks about control effectiveness.

Questions such as:

• Who protects privileged identities?
• Who verifies encryption?
• Who validates cloud configurations?
• Who detects attacks?
• Who tests recovery?
• Who monitors outsourced controls?
• Who owns residual risk?

Governance is important.

But only because it should ensure that security controls actually work.

Cloud Changed the Meaning of Governance

In traditional data centres the organisation controlled almost everything.

Servers.

Networks.

Storage.

Firewalls.

Operating systems.

Backups.

Governance and technical control largely existed inside one organisational boundary.

Cloud computing changed that completely.

The Organization No Longer Owns the Entire Control System

Today, cloud security depends on multiple independent organisations.

Microsoft controls part of the environment.

SAP controls another.

Managed service providers operate additional components.

External identity providers contribute their own controls.

The customer remains responsible for everything left behind.

Security therefore no longer depends solely on internal governance.

It depends on whether an entire distributed control ecosystem functions as intended.

Shared Responsibility Is Really Shared Control

Most people understand the Shared Responsibility Model as a legal concept.

It is much more than that.

It is a governance model.

Every cloud service divides responsibilities between provider and customer.

Unfortunately, responsibilities are only one part of the equation.

Controls are distributed as well.

Who patches?

Who monitors?

Who encrypts?

Who manages identities?

Who operates backup?

Who validates resilience?

Who proves that these controls actually work?

These questions define modern cloud governance.

The Missing Layer: Control Governance

Many governance reviews assess whether an organisation governs itself effectively.

Few assess whether it governs the entire control chain.

This distinction matters enormously.

Traditional governance asks:

"Do we have appropriate management structures?"

Control governance asks:

"Can we demonstrate that every critical security control is owned, operated, monitored and independently assured—regardless of who performs it?"

That is a fundamentally different assurance question.

Contracts Are Part of the Security Architecture

This difference becomes particularly visible when examining cloud contracts.

Many organisations treat contracts primarily as procurement documents.

A CISO sees something entirely different.

Every cloud contract defines:

• security responsibilities,
• audit rights,
• compliance obligations,
• incident reporting,
• logging commitments,
• encryption responsibilities,
• subcontractor governance,
• availability commitments,
• exit conditions.

These are not administrative details.

They define the boundaries of the organisation's security architecture.

Certification Is Not Assurance

Another common misconception is that provider certifications automatically prove security.

A provider may hold:

• ISO/IEC 27001,
• SOC reports,
• BSI C5 attestation,
• numerous compliance certifications.

These are valuable.

But they do not answer an important question.

How does your organisation verify that the provider's controls integrate effectively with your own?

This is where governance often stops.

And where assurance should begin.

Why CCAK and BSI C5 Take a Different Perspective

Frameworks such as CCAK and the Cloud Security Alliance Cloud Controls Matrix (CSA CCM) shift the focus from governance structures to operational control effectiveness.

Similarly, BSI C5 places significant emphasis on demonstrable security controls, operational assurance and continuous monitoring.

Instead of asking:

"Do governance processes exist?"

They ask:

• Are identities protected?
• Are security controls operating?
• Are responsibilities clearly divided?
• Can evidence be produced?
• Are providers continuously monitored?
• Is the Shared Responsibility Model actually governed?

This is the difference between governance maturity and assurance maturity.

Boards Should Ask a New Question

For years boards have asked:

"Who owns cloud governance?"

That question is no longer sufficient.

The more relevant question is:

"Who governs the controls that nobody inside the organisation directly operates?"

That is the real governance challenge of cloud computing.

Because ownership has become distributed.

Accountability has not.

The Emerging Governance Model

Modern enterprises increasingly need three complementary assurance perspectives.

1. Cloud Management Governance

Can the organisation govern cloud adoption?

2. Cloud Control Governance

Can the organisation govern all security controls across customers, providers and partners?

3. Cloud Security Assurance

Can the organisation independently verify that these controls are effective?

Only together do these perspectives provide meaningful assurance.

A New Responsibility for CISOs

The role of the CISO has quietly changed.

Twenty years ago, governing internal security controls was sufficient.

Today, CISOs must govern controls they do not own.

They must evaluate providers they cannot manage.

They must rely on evidence they did not produce.

They must accept risks created by services they do not operate.

Cloud has transformed cybersecurity into ecosystem governance.

Final Thought

Cloud governance is no longer primarily about governing your own organisation.

It is about governing confidence across an interconnected network of providers, partners and shared controls.

The greatest governance risk is no longer the absence of policies.

It is believing that governing your own organisation automatically means governing the entire security ecosystem.

It does not.

The future of cloud governance belongs to organisations that understand one simple truth:

In the cloud, security is distributed—but accountability never is.

Key Takeaways

• Cloud Governance means different things to Internal Audit, Boards and CISOs.
• Shared Responsibility is fundamentally a shared control model, not just a contractual model.
• Traditional governance reviews evaluate organisational structures—not necessarily control effectiveness.
• Contracts, provider assurance and outsourced controls are now integral parts of enterprise security governance.
• Frameworks such as CCAK, CSA CCM and BSI C5 extend governance into continuous control assurance across the entire cloud ecosystem.
• Boards should distinguish between Management Governance, Control Governance and Security Assurance when assessing cloud risk.

Discussion

Has your organisation expanded its definition of cloud governance beyond internal processes? Or are you still governing only your own organisation while assuming the rest of the control ecosystem simply works?

Publication Note & Disclaimer
This article reflects my personal professional perspective and does not represent the official policy or position of my employer. Drafting and editorial refinement may have been supported by commercially available AI-assisted tools. The analysis, conclusions and final curation are entirely my own.

For information regarding image credits, copyrights, trademarks and other intellectual property rights, please refer to the Imprint.