Cloud Services in London

Financial Services / Insurance

A London-headquartered FTSE 100 insurance group (GBP 42B GWP, operating across life, general, and health insurance in 28 countries, 55,000 employees) needed to consolidate its cloud strategy across a fragmented landscape of cloud deployments, on-premises data centres, and managed hosting arrangements inherited through a decade of acquisitions. (1) Cloud sprawl: the group operated across 180+ AWS accounts, 90+ Azure subscriptions, and 25+ GCP projects — most created by individual business units or acquired companies without central governance. Total cloud spending: GBP 85M annually, growing at 35% year-over-year with no clear correlation to business growth. Cloud cost allocation was impossible — 60% of cloud spending could not be attributed to specific business units or applications. (2) Regulatory risk: the FCA and PRA expected regulated entities to demonstrate effective governance of cloud outsourcing per SS2/21. The group could not provide a complete inventory of cloud-hosted applications, data classifications, or provider dependencies — creating material regulatory risk during the next supervisory review. Concentration risk: 72% of cloud workloads were on AWS — exceeding the group's own risk appetite for single-provider dependency. (3) Security inconsistency: each cloud account/subscription had been configured independently — resulting in inconsistent security policies (some accounts had MFA enforced, others did not), inconsistent encryption (some workloads used encryption at rest, others did not), and inconsistent network architecture (some accounts had proper VPC isolation, others had overly permissive security groups). The CISO identified 340 critical security findings across cloud deployments during the last assessment. (4) Data sovereignty confusion: the group operated in 28 countries — each with different data residency requirements. Customer data from UK, EU, and non-EU jurisdictions was co-mingled in cloud deployments without clear data classification or residency controls. Post-Brexit, the group needed to separate UK and EU data processing to ensure compliance with both UK GDPR and EU GDPR — while maintaining operational efficiency. (5) Operational resilience: the Bank of England's operational resilience requirements mandated that important business services (claims processing, policy administration, payment processing) could continue operating during severe disruption. The group had no cloud-based DR for 45% of important business services — and the existing DR arrangements had never been tested end-to-end.

We designed and implemented a multi-cloud governance and consolidation programme over 18 weeks. (1) Cloud governance platform: centralised cloud management — all cloud accounts (AWS, Azure, GCP) brought under a unified governance framework. Account hierarchy: structured organisation of cloud accounts by business unit, environment (production, staging, development), and data classification — replacing the flat, ungoverned structure. Policy enforcement: automated guardrails applied across all cloud accounts — mandatory encryption, MFA enforcement, network isolation, tagging requirements, and prohibited configurations. Compliance scanning: continuous assessment of all cloud resources against security and regulatory baselines — findings reported, prioritised, and tracked to resolution. Cost management: comprehensive tagging taxonomy applied to all cloud resources — enabling cost allocation to business unit, application, and cost centre with 95% attribution accuracy. (2) Regulatory compliance architecture: SS2/21 documentation (complete inventory of cloud-hosted applications, data classifications, provider dependencies, and exit strategies — maintained automatically through the governance platform), concentration risk management (workload distribution strategy — reducing AWS dependency from 72% to 55% over 18 months by migrating suitable workloads to Azure and GCP), provider exit capability (documented and tested exit procedures for each cloud provider — including data export, application portability, and alternative deployment), and regulatory reporting (automated generation of cloud governance reports for FCA and PRA supervisory reviews). (3) Security remediation: systematic resolution of the 340 critical findings — MFA enforcement across all accounts (completed in 2 weeks), encryption at rest enabled for all storage (completed in 4 weeks), network security standardisation (VPC redesign, security group cleanup — completed in 8 weeks), and identity management (centralised IAM through Okta with cloud-provider integration — completed in 6 weeks). Security baseline: automated enforcement preventing drift — new security findings auto-detected and flagged within 24 hours. (4) Data sovereignty: data classification framework — all cloud-hosted data classified by jurisdiction, sensitivity, and regulatory regime. UK data residency: UK customer data hosted exclusively in UK cloud regions — AWS eu-west-2, Azure UK South. EU data residency: EU customer data hosted in EU regions — separated from UK data processing per EU GDPR requirements. Data flow mapping: automated tracking of data flows between cloud regions — ensuring no cross-jurisdictional data transfer without appropriate legal basis. (5) Operational resilience: DR architecture for all important business services — cross-region (UK primary, Ireland or Netherlands DR) with automated failover. Testing: quarterly DR testing for important business services — automated failover exercises with measured RPO and RTO. Chaos engineering: controlled failure injection to validate resilience architecture — ensuring that important business services survived cloud provider outages, region failures, and connectivity disruptions.

Cloud cost: total cloud spending reduced from GBP 85M to GBP 62M annually (27% reduction) through rightsizing, reserved instance optimisation, and eliminating orphaned resources. Cost allocation: from 40% attributable to 95% attributable — enabling business unit accountability for cloud spending. Year-over-year growth rate: from 35% (ungoverned) to 12% (aligned with business growth). Regulatory compliance: complete SS2/21 compliance demonstrated at the next PRA supervisory review — the group's cloud governance cited as a positive example. Zero regulatory findings related to cloud during the review (compared to 3 material findings in the previous examination). Concentration risk: AWS dependency reduced from 72% to 58% in the first year (on trajectory for 55% target). Security: 340 critical findings remediated — from 340 critical findings to zero within 16 weeks. Security baseline compliance: 98.5% across all cloud accounts (measured continuously). Mean time to detect new security findings: from never (no continuous scanning) to under 24 hours. Data sovereignty: complete separation of UK and EU customer data — compliant with both UK GDPR and EU GDPR. Automated data flow monitoring preventing inadvertent cross-jurisdictional transfer. Operational resilience: 100% of important business services with tested DR — RPO under 4 hours and RTO under 2 hours for all critical systems. Quarterly DR testing passed without issues. Annual value: GBP 23M (cloud cost optimisation — reduced spending from GBP 85M to GBP 62M), GBP 15M (regulatory risk — avoided potential FCA/PRA enforcement action and demonstrated compliance leadership), GBP 8M (security — eliminated critical vulnerabilities reducing breach risk and cyber insurance premiums), GBP 5M (operational efficiency — centralised cloud management reducing per-business-unit cloud operations overhead), GBP 4M (operational resilience — tested DR reducing business continuity risk for important business services) = GBP 55M. Development cost: GBP 520,000. Payback: under 4 days.