Cloud Computing in Business - Strategy, Security and GDPR Compliance

CIOs and IT managers, CISOs, DPOs, legal counsel, risk and compliance officers, project managers and managers involved in cloud transformation or outsourcing projects.

Basic knowledge of cloud computing (or having attended "Cloud Essentials – Fundamentals"). No advanced technical skills are required.

Cloud adoption is no longer a question of whether to embrace the cloud, but how to do so effectively. How can organisations define a cloud strategy aligned with their business objectives? How can they secure cloud environments while managing risks? And how can they ensure compliance with the GDPR and evolving regulatory frameworks such as NIS2 and DORA?
This three-day programme provides a comprehensive and practical approach to cloud adoption, covering the journey from strategic planning to operational implementation. Through expert guidance, real-world case studies and hands-on workshops, participants develop a structured understanding of cloud governance, security, risk management and regulatory compliance. They will gain the knowledge and tools required to design and implement a cloud strategy that is secure, compliant and aligned with organisational objectives.

By the end of the course, participants will be able to:

• Design and defend a cloud strategy suited to their organisation (cloud-first, hybrid, multi-cloud);
• Build a business case: cloud economics, CAPEX/OPEX, introduction to FinOps;
• Choose a migration approach and plan its main stages;
• Apply the shared responsibility model and identify key security measures (identity and access management, encryption, network security, business continuity);
• Navigate the relevant standards and certifications (ISO/IEC 27001, 27017, 27018, SOC 2) and use the Cloud Security Alliance tools (CAIQ questionnaire, Cloud Controls Matrix) to assess a provider;
• Situate the European NIS2 and DORA regulations and their scope of application;
• Analyse a cloud project from a GDPR perspective: roles and responsibilities, processing agreements (Article 28), transfers outside the EU, data protection impact assessments (DPIA), the contribution of the EU Cloud Code of Conduct;
• Identify the key clauses of a cloud contract and prepare an exit strategy (reversibility);
• Set up cloud governance: roles, policies, indicators, SLA monitoring.

Day 1 – Foundations and strategy

• Refresher on the fundamentals: service and deployment models, market players
• Defining your cloud strategy: cloud-first, hybrid, multi-cloud, sovereignty considerations
• Cloud economics: CAPEX/OPEX, sizing, introduction to FinOps
• Migration strategies (rehost, replatform, refactor…) and success factors
• Case study: building the business case for a migration project

Day 2 – Cloud security

• The shared responsibility model in practice
• Identity and access management (IAM), strong authentication
• Data protection: encryption at rest and in transit, key management
• Network security, logging and detection; business continuity and disaster recovery
• Standards and certifications: ISO/IEC 27001, 27017, 27018, SOC 2
• The Cloud Security Alliance (CSA): overview and provider-assessment tools – CAIQ questionnaire and Cloud Controls Matrix (CCM)
• Workshop: risk analysis of a cloud outsourcing scenario

Day 3 – Compliance, contracts and governance

• The GDPR applied to the cloud: principles and roles (controller / processor); processing agreements (Article 28) and the guarantees to require
• Data transfers outside the EU: standard contractual clauses, Data Privacy Framework, sovereignty
• Data protection impact assessments (DPIA) and compliance documentation
• The EU Cloud Code of Conduct (EU Cloud CoC): value for assessing and selecting providers
• Regulatory overview: NIS2 and DORA (scope, key principles)
• The cloud contract: key clauses, service levels, audit, reversibility and exit strategy
• Cloud governance: roles, policies, indicators, SLA monitoring and continuous improvement
• Final workshop: drawing up the cloud roadmap of a fictitious organisation

At the end of the training, participants will receive a certificate of participation issued by the House of Training.