Manufacturing cloud governance checklist

Every account, subscription, project, environment, and critical resource has an owner

Business service and technical owners are distinct where appropriate

Tags or equivalent metadata support allocation

Orphaned and experimental resources have expiry rules

Named identities replace shared accounts

Privileged access is limited, time-bound where practical, and reviewed

Service identities have owners and credential-rotation methods

Joiner, mover, leaver, emergency, and vendor-access paths are tested

Budgets route to accountable owners before thresholds are exceeded

Shared cost allocation is documented

Rightsizing considers peaks, resilience, licenses, and recovery

Savings claims use verified invoice changes and avoid double counting

Production changes have review, evidence, and rollback

Policy exceptions record approver, reason, risk, and expiry

Logs reach an owned monitoring route with suitable retention

Backup scope matches dependencies and restore tests are scheduled