Cloud Computing and SOA Convergence in Your Enterprise: A Step ...

154 Chapter 8 Bringing Governance to the Clouds
Macro Policies
Macro policies are those policies that IT leaders, such as the enterprise architect,
typically create to address sweeping issues that cover many services, the
data, the processes, and the applications. Following are examples of macro
policies:
All metadata in both on-premise and cloud computing–based systems
must adhere to an approved semantic model.
All services must return a response in 0.05 seconds for on-premise and
0.10 for cloud computing–based services.
Changes to processes have to be approved by a business leader.
All services must be built using Java.
The idea is that we have some general rules that control how the system is
developed, redeveloped, and monitored. Macro policies exist as simple rules
or set processes that must be followed. For example, there could be a process
to address how the database is changed, including 20 steps that must be followed,
from initiation of the change to acceptance testing. Another example is
the process of registering a new user on the cloud computing platform.
Some IT folk may roll their eyes at the kinds of controls placed around
automation. I am sure many such controls exist within your IT shop now. The
same people may also push back on extending these governance concepts to
cloud computing. However, the core value of implementing macro policies is
to reduce risk and save money.
The trick is to strike a balance between too many macro policies, which
can hurt productivity, and too few, which can raise the chance that something
bad will happen. Not an easy thing, but a good rule of thumb is that
your IT department should spend approximately 5% of its time dealing with
issues around macro policies. If you spend more time than that, perhaps you
are overgoverning. Less than that, or if disaster after disaster happens, perhaps
you can put in more macro policies to place more processes around the
management of IT resources, on-premise or cloud computing-based.
Micro Policies
Micro, or service-based, policies typically deal with a policy instance around
a particular service, process, or data element. They are related to macro policies
in that macro policies define what needs to be done, whereas micro