Digitalisation through Code-based Infrastructure

All courses / Architecture as Code / Module 5 / Chapter 21

Learning objectives

After the lesson the participant can:

• Explain the four dimensions of digital transformation that must be addressed together.
• Identify the regulatory drivers that shape cloud-first strategies for organisations in the EU.
• Evaluate cloud provider offerings against data sovereignty requirements and write the result as a selection policy.
• Assess the limitation of keyword-based compliance checks and name the appropriate alternative.

Key concepts

Transformation dimensions

Four dimensions to be addressed holistically: technical transformation, organisational change, cultural evolution and competence development. Technical transformation must be combined with organisational and cultural change to achieve lasting results.

Cloud-first strategy

A strategy in which organisations primarily choose cloud-based solutions for new initiatives. In the EU it must comply with data sovereignty regulations, which creates demand for Architecture as Code that handles sensitive data in line with the GDPR and sector rules.

EU-trusted provider policy

A codified provider selection policy that differentiates providers that are inherently sovereign from those acceptable only when their EU-only controls are in force. EU-headquartered platforms form the default where obligations prohibit other arrangements.

Self-service developer portal

A portal through which developers provision infrastructure from templates that carry compliance defaults from the start. The chapter cites Backstage, created at Spotify, with a software catalogue and software templates.

Keyword-based compliance check

A pipeline step that searches infrastructure code for words such as encryption. The chapter warns that this is not a meaningful GDPR compliance check and points to policy-as-code tooling as the alternative.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The chapter distinguishes providers that are inherently sovereign from those that become acceptable only when EU-only controls are in force. How would you verify, continuously, that those controls remain in force?
2. Why is a pipeline step that searches for the word encryption worse than no check at all in some respects?
3. Which of the four transformation dimensions receives the least attention in your organisation's digital strategy, and what does that cost?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. What does the chapter say about searching infrastructure code for encryption keywords in a compliance pipeline?

   1. It is sufficient evidence for a supervisory authority
   2. It is the recommended first step before any policy tooling
   3. It is not a meaningful GDPR compliance check
   4. It is required by the NIS2 Directive
   Show the answer

   C. It is not a meaningful GDPR compliance check
   The pipeline example carries an explicit warning that searching for encryption keywords is not a meaningful GDPR compliance check, and the learning objectives point to policy-as-code tooling instead.

2. How should policy catalogues treat cloud providers, according to the chapter?

   1. Differentiate inherently sovereign providers from those acceptable only with EU-only controls
   2. Treat all providers with an EU region as equivalent
   3. Exclude every provider headquartered outside the EU, whatever sovereign controls it has in force
   4. Leave provider choice to each product team's preference
   Show the answer

   A. Differentiate inherently sovereign providers from those acceptable only with EU-only controls
   Policy catalogues should differentiate between providers that are inherently sovereign and those that become acceptable only when their EU-only controls are in force.

3. Which four dimensions of digital transformation does the chapter say must be addressed holistically?

   1. Strategy, budget, procurement and operations
   2. Technical, organisational, cultural and competence
   3. Cloud, data, security and artificial intelligence
   4. Discovery, pilot, scale and optimisation
   Show the answer

   B. Technical, organisational, cultural and competence
   The dimensions are technical transformation, organisational change, cultural evolution and competence development, to be balanced with one another.