Before embarking on an Oracle Cloud Applications implementation, organizations must develop a comprehensive governance framework for SaaS applications to limit overspending and security failures. Effective governance ensures that business goals are set, responsibility is assigned, outcomes are monitored, and status is reported. Here are a few best practices to ensure effective, secure and compliant SaaS use.
How to Develop an Oracle Cloud Applications Governance Framework
Establish a Governance Approach
In organizations that don’t manage their use of SaaS, user adoption occurs in ways that are suboptimal and risky. Organizations that use technology to track SaaS usage constantly find their sensitive data stored in personal accounts or in unmanaged SaaS applications. Sometimes, different applications provide the same functionality to different BUs and become separately managed applications, introducing security and compliance risks. An Oracle Cloud Applications implementation is not just a one-time project but an IT asset that requires ongoing management with a complete life cycle approach. Applications that are critical or contain sensitive data must receive even greater levels of control.
Create a Policy
Effective governance is possible only when you set clear rules and provide a basis for enforcement. Here are three basic rules you can apply:
- IT must work with business stakeholders to create a flexible, practical and cooperative process to acquire necessary SaaS capabilities and redirect inappropriate ones to better solutions.
- If the IT organization cannot maintain responsibility for a particular SaaS application, then the application owner should typically be a BU manager or department head.
- Maintain a complete and detailed inventory of SaaS applications. There are also useful tools for application portfolio management, software asset management, SaaS management platforms etc. that can simplify the process.
Analyze Control Requirements
Oracle Cloud Applications customers often take application control functionality for granted and often do not appropriately address security control needs during the purchase process. Without a defined requirements collection process, organizations may fail to fully specify their need for control and monitoring mechanisms. As BUs make decisions on the use of SaaS, security and risk management, business and IT leaders need to monitor how the service is used and what data is stored in it.
Perform Continuous Management
Oracle Cloud Applications require continuous monitoring. You must adopt agile approaches to managing and enabling continuous change. Key ongoing governance tasks include; vendor risk management, service monitoring and license management, identity and access management, compliance reporting, user risk management, data backup and versioning, application performance monitoring, application portfolio management, and incident management.
Manage End of Life
The final phase of Oracle Cloud Applications management involves the closing down and safe deprovisioning of the service. Contingency planning is needed as the solution might need replacement if it doesn’t meet your requirements. Also, if you are given short notice of change or shutdown it can leave you without recourse. Though this scenario is highly unlikely, some level of exit planning should be performed before it’s needed. Some of the critical exit activities include data migration, redeployment, or archiving.
