iShield Solutions Series, IT & Digital Operations · Cloud
Hybrid & Multi-Cloud Operations
Govern Every Estate the Same Way: Data Centre, Private Cloud and Public Cloud
Hybrid & Multi-Cloud Operations gives infrastructure, change, capacity, cost and control decisions one model across environments, so a change in one cloud is assessed against the services, budgets and policies it touches everywhere.
Govern AWS, Azure, GCP and OCI at scale — posture, cost, capacity and policy as code.
The journey at a glance
- DiscoverInfrastructure
- RelateAsset Management / CMDB
- ChangeChange Management
- SizeCapacity Management
- Allocate costIT Financial Management
- ControlRisk & Compliance
- Correct driftPolicy-as-code Evaluator · Drift Remediator · iShield Link
The enterprise challenge
Every environment has its own console. Governance needs one model.
Hybrid estates span data centres and several clouds with inconsistent records, cost visibility and controls.
- Unowned cloud spend
- Unassessed change risk
- Inconsistent security posture
Most enterprises run a mix of long-lived data-centre platforms, a private cloud, two or more public clouds and a growing edge. Each environment has its own console, inventory, tagging habits and billing format.
Governance breaks at the seams. An unrecorded resource has no owner, an untagged account has no cost centre, and a change approved in one environment's pipeline is never assessed against dependencies that run elsewhere. The answer is not another console but one governed model that every environment reports into.
Buyer challenges
Inventories that disagree
Each cloud reports its own resources, and nobody can say which services depend on which accounts, regions or clusters.
Spend without an owner
Untagged and shared resources make it impossible to show each business unit what it consumes.
Change assessed in isolation
Pipelines approve infrastructure changes without seeing the services and dependencies outside their own environment.
Controls applied unevenly
Policies are enforced in one estate and only documented in another, so posture depends on where a workload happens to run.
Decision owners
- Head of cloud and infrastructure
- Which environments and accounts are in scope, and who owns them.
- Change approver or platform owner
- Approval of infrastructure change with cross-estate impact.
- FinOps lead
- Allocation rules, showback and commitment purchases.
- Security and compliance owner
- Cloud control policies and time-bound exceptions.
End-to-end enterprise journey
One governance plane across every environment
Step through the governance planes. Each one applies the same rule to every environment at once: the data centre, the private cloud, each public cloud and the edge.
- Discover · Infrastructure
- Relate · Asset Management / CMDB
- Change · Change Management
- Size · Capacity Management
- Allocate cost · IT Financial Management
- Control · Risk & Compliance
- Correct drift · Policy-as-code Evaluator · Drift Remediator
Stage 1 of 7 Discover
Infrastructure · iShield Nexus
Multi-cloud and agentless network discovery bring resources from every environment into one inventory, classified as configuration items.
- Decision
- Which accounts, subscriptions and networks are in discovery scope.
- Exception path
- Resources found without an owner are queued for assignment.
- Recorded as
- Configuration items with their source environment
This journey shows how responsibilities are intended to divide between the platforms. It describes an operating model, not a pre-built integration between them.
Decisions, exceptions and who owns them
Change approval, policy checks and cost approvals apply across environments.
Bring an environment into scope
- Accountable owner
- Head of cloud and infrastructure
- Evidence recorded
- Discovery scope and ownership assignments
- Exception path
- Out-of-scope environments are listed with the reason.
Approve cross-estate infrastructure change
- Accountable owner
- Change approver
- Evidence recorded
- Change record, impact analysis and schedule
- Exception path
- Emergency changes are reviewed afterwards.
Approve allocation rules and commitments
- Accountable owner
- FinOps lead
- Evidence recorded
- Cost model version and approval record
- Exception path
- The unallocated pool is reviewed every cycle.
Accept a control exception
- Accountable owner
- Control owner
- Evidence recorded
- Exception with owner, rationale and expiry
- Exception path
- Expired exceptions reopen for review.
Who does what in this solution
Each module keeps its own responsibility. Nexus modules link to their accepted module pages; modules from other platforms link to that platform.
| Module | Platform | Responsibility in this solution | Hands on to |
|---|---|---|---|
| Asset Management / CMDB | iShield Nexus | Reconciles records and maps services to the resources they run on. | Impact analysis to Change Management |
| Change Management | iShield Nexus | Governs infrastructure change with cross-estate impact analysis. | Approved changes to the environment teams |
| Capacity Management | iShield Nexus | Forecasts and sizes capacity across environments. | Commitment needs to IT Financial Management |
| IT Financial Management (FinOps / TBM) | iShield Nexus | Ingests billing, allocates cost and optimizes commitments. | Showback to service and business owners |
| Risk & Compliance (cloud controls) | iShield Nexus | Holds cloud control policies, exceptions and evidence. | Control status to compliance reporting |
How the platforms work together
This is a cross-product solution. Each platform keeps its own responsibility; none of them is presented as a module of another.
Why this composition
Cloud governance is a triangle of cost (ITFM), posture (Risk & Compliance + SecOps) and capacity (Infrastructure + Capacity). Treating any one in isolation creates blind spots. Link cloud agents close the remediation loop so policy isn't a PDF — it's a runtime behaviour.
Anchors the solution's operating workflow, records and governance through the modules in the journey above.
Modules included across iShield
The complete published composition of this solution.
Intelligence in explicit modes
Forecasting and cost insight inform capacity and commitment decisions.
- Assistance drafts, answers or summarizes
- Recommendation proposes for a person to accept
- Predictive anticipates or flags
- Workflow-triggered runs only as configured and approved
| AI item | What it does | Mode | Source |
|---|---|---|---|
| Demand forecasting | Projects compute, storage and network demand from telemetry across environments. | Predictive | Capacity Management — Demand forecasting |
| Impact summaries | Summarizes which services a proposed change touches across environments. | Assistance | Asset Management / CMDB — Impact summaries |
| Natural-language financial queries | Answers questions about cloud cost directly from the cost model. | Assistance | IT Financial Management — Natural-language financial queries |
| Evidence mapping | Suggests which configuration and change records evidence a cloud control. | Recommendation | Risk & Compliance — Evidence mapping |
Core capabilities
The solution's published capabilities.
Capacity & rightsizing
Forecast demand, rightsize commitments, plan reservations.
Built around recognized practice
Mappings describe how the end-to-end operating model aligns with recognized practice. They are not attestations or certifications.
Change, capacity and cost are governed consistently across estates: dependency data makes cross-environment impact visible before a change is approved, capacity follows observed demand, and cost allocation follows the services a resource supports.
| Framework | Practice | How the solution operates | Relationship |
|---|---|---|---|
| ITIL 4 | Change enablement | Every infrastructure change, whichever environment it lands in, is assessed against the same dependency model and approved by a named authority.Supports practices described in ITIL 4. ITIL is guidance, not a product credential. | Aligned practice |
| ISO/IEC 20000-1:2018 | Change and capacity requirements of a service management system | Change records with impact analysis and capacity scenarios can serve as evidence for an organization's service management system across all environments.The requirements apply to the organization's management system, not to the software. | Compliance-supporting capability |
| SRE practices (industry practice) | Capacity and reliability planning | Capacity decisions follow observed demand and agreed reliability objectives rather than fixed headroom rules.Industry practice, not a standard. | Aligned practice |
Regulatory context
Regulations and frameworks that organizations in this domain commonly work with. Listed as context for planning, not as a certification, attestation or out-of-the-box mapping.
What changes for the organization
Outcomes are described qualitatively. Figures are published only once evidenced.
One estate view
Every environment reports into one service and configuration model.
Explainable cloud cost
Spend is allocated to the services and consumers that use it.
Governed change everywhere
Infrastructure change is assessed against dependencies across environments.
Consistent controls
Policies, exceptions and evidence work the same way in every estate.
What sets this solution apart
One model, every environment
Discovery, service mapping, change, capacity, cost and controls all reference the same configuration items, wherever they run.
Cost tied to services, not accounts
Allocation runs through the IT Financial Management cost model, so showback follows the service a resource supports.
Policy findings become governed change
Drift and policy findings turn into owned changes or time-bound exceptions, never silent fixes.
Delivery and industry context
Planning information carried over from the solution record.
30 / 60 / 90-day value plan
Days 0–30 — Foundation
Stand up the iShield workspace, integrate sources of truth, ingest baseline data.
- Tenant provisioned in chosen region (KSA / UAE / EU / US)
- SSO + RBAC mapped to enterprise identity (Entra ID / Okta)
- Top 5 integrations connected and reconciled
- Baseline KPIs measured before any change
Days 31–60 — Activation
Turn on automation, AI agents and guardrails for the priority value stream.
- Workflows live for the top 3 use cases
- Link AI agents enabled with explicit guardrails and approvals
- Power-user enablement and admin training complete
- First measurable KPI improvement vs baseline
Days 61–90 — Scale
Industrialize, roll out to additional teams, prove ROI to the steering committee.
- Solution rolled out to additional business units / geos
- Executive dashboard with target vs actual outcomes
- Continuous improvement backlog established
- Signed ROI memo and renewal / expansion plan
Personas served
Illustrative industry scenarios
Representative situations by industry. Regulations named here are context, not certifications or commitments.
Banking & Financial Services
Cross-region active/active landing zones with SAMA CSF posture, FinOps showback per LoB, and DORA-aligned exit testing for hyperscalers.
Public Sector (KSA / UAE)
Sovereign landing zones (NCA CCC-1:2020 / TDRA) with per-ministry chargeback and policy-as-code blocking non-resident workloads.
Telecom
Multi-cloud BSS/OSS posture and capacity forecasting across AWS + Azure + on-prem OpenStack, with FOCUS 1.0 unit-cost per subscriber.
Related IT & Digital Operations solutions
Modern IT Service Management
Enterprise-wide service excellence — single portal, AI agents, change-safe delivery.
OpenAIOps & Digital Operations
Predict and prevent outages — correlate events, find root cause, remediate with guardrails.
OpenIT Strategy, Portfolio & Financials
Align IT investment to business outcomes — capability maps, demand intake, TBM-grade financials.
Open
