As companies set about migrating workloads to the cloud, an important factor often gets lost, sometimes overlooked or misunderstood in the process: security and compliance.

It might come as a surprise to some, given the proclamation of cloud service providers on all the baked-in security and compliance in the platforms. Given increased cyber threats, how can companies run workloads in the cloud in an unsecure manner? The truth is, the reasons for not establishing secure and compliant workloads in the cloud are not nefarious or even irresponsible – in most cases, they are merely making innocent but incorrect assumptions

Companies know that the highly respected and trustworthy underlying cloud providers, such as Microsoft Azure, have advance and security capabilities, and therefore assume that their data is fully and automatically protected.

This is true, but only up to a point.

Think of it this way: if a building is equipped with state-of-the-art alarm systems and security cameras, but someone leaves the door wide open, the building is still penetrable to intruders. The same goes for the cloud.

Cloud providers have security and compliance capabilities, but to take full advantage of the platform security, you need to understand those capabilities and configure your environment on their platform accordingly and aligned with best practices.

Whether a company must adhere to HIPAA, Sarbanes-Oxley, FISMA, the Dodd-Frank Act, or ISO, it’s essential to find a cloud migration partner that has the experience to ensure that compliance is met and security is air-tight. Here are three ways to ensure that security is addressed correctly before, during, and after a cloud migration. 

1. Bake it in, don’t bolt it on 

We believe that security works best when baked into the blueprints of a cloud migration, not bolted on afterward, so we take all security and compliance requirements into consideration from the onset of an engagement.  

2. Don’t set it and forget it 

Once you’re operating in the cloud, you still need to keep security top of mind. Stay on top of any changes to policies, patches, and industry insights with the Azure Security Center. Rich with content, information, tools and processes, the Azure Security Center will provide a unified view of your cloud workloads while giving you the support you need. Don’t have time to keep up with changes yourself? Consider finding a partner that provides managed services to provide the support you need, and who understands the monitoring capabilities and needs in the cloud platform. 

3. Police your policies 

Having policies in place is one thing, but it’s also critical to ensure that they’re enforced to maintain the integrity of the secure and compliant environment you’ve set up. Make sure that each person accessing or contributing to data in the cloud is compliant and operating according to best practices. This includes following an established approval process and an audit trail to demonstrate that compliance is met. 

With data breaches on the rise – one report suggests that year over year, the total number of breaches was up 33.3%, and the total number of records exposed was up 112% between 2018 and 2019. Keeping security top of mind for your cloud migration shouldn’t be an afterthought; it must be a priority.