The landing zone was born from a compliance mandate, and it shows. Every Azure Policy is a deny. Every deployment needs sign off from the security architect, the network team, and, if it touches anything interesting, the CISO. Subscription requests take three weeks.
Six months later, a business unit has an AWS account nobody knows about, a department is running workloads on someone’s MSDN subscription, and the board has approved a SaaS purchase specifically because “it was faster than going through IT.”
In a market the size of New Zealand’s, this failure is amplified. There are fewer people, fewer central teams, and far less tolerance for process friction.
Symptoms You Will Recognise
- The workaround economy. Developers share credentials, test in production, or deploy resources via the portal with personal accounts because the pipeline path takes too long.
- “As a Service” SaaS sprawl. When the compliant path is slow, NZ businesses, famously pragmatic, just buy a tool. Marketing buys the CRM. Ops buys the monitoring SaaS. Now personal data sits in five unvetted services, and your Privacy Act 2020 obligations extend to all of them.
- Escalation driven exceptions. Because there is no exception process with an SLA, exceptions are granted when someone’s manager escalates to your manager. Governance becomes a hierarchy game, not a risk decision.
- The audit scramble. When NZISM attestation, CPS 234 reporting, or a Privacy Commissioner inquiry arrives, nobody can reconstruct who approved what and why.
Why This Happens
Landing zones in NZ are often commissioned in response to a driver: a risk assessment finding, an audit recommendation, a client’s security questionnaire, an incident. The team that receives that mandate inherits its fear. Fearful teams build deny first governance.
There is also a skills gap problem. Writing an effective Azure Policy is hard; writing a hard deny is trivial. Under time pressure, teams ship deny policies they cannot reverse and do not fully understand, then spend months unpicking the ones that blocked legitimate work.
The Fix: Governance as a Product
1. Start in audit mode. Always.
Deploy every policy as Audit first. Run for one or two sprints. You will discover:
- Which deny rules would have blocked legitimate work (deploy those as deny after exceptions are handled)
- Which controls nobody actually needed
- Real world compliance baselines you can measure against
2. Measure the right metric
The number of policies enforced tells you nothing. The metric that matters:
Time from “team needs an environment” to “team has a compliant, deployable environment.”
Target it in days. Publish it. Improve it. That single number is the health indicator of your governance product.
3. Build golden paths, not gatekeepers
For a NZ organisation, the highest leverage move is subscription vending with pre approved patterns:
- A team requests an environment through a form or pipeline
- They receive a subscription pre configured with: correct management group placement, baseline policies (NZISM informed where relevant), budget alerts, mandatory tags, network integration, and logging wired to your central workspace
- Total time: hours, not weeks
Now the fastest path is also the compliant path. The deny policies that remain are few, well understood, and defensible.
4. Make exceptions a risk decision, not a favour
Establish a formal exception register with:
- A defined SLA (e.g., five business days) for review
- Documented risk assessment against your applicable framework (NZISM profile, CPS 234 obligations, Privacy Act impact)
- Expiry dates. Exceptions that live forever are policies that do not exist.
- Named risk acceptors
This also directly serves your audits. When a NZISM assessment or a client’s due diligence questionnaire arrives, your exception register is evidence of a functioning control environment. That is worth real money in an NZ market where enterprise deals routinely hinge on security questionnaires.
5. Remember the SaaS blind spot
Governance that only covers Azure is incomplete. Your Privacy Act obligations cover personal information in every SaaS tool the business has bought. A lightweight SaaS approval process, faster than buying it rogue, is part of your landing zone story whether the platform team likes it or not.
The NZ Reality
In a market this size, your platform team’s reputation is a real asset or a real liability. The organisation will talk, in stand ups, at NZ tech meetups, across the corridor. Be the team that made the right thing easy.
The test: can a two person startup team inside your organisation get a fully compliant production environment in under a week? If not, you do not have governance. You have a tollbooth.
One Block · build from here