Secure landing zone for a government department

The client is a UK government department with delivery teams already building in the cloud but no governed foundation beneath them. Public-sector bodies must be able to evidence control of their estate to assurance bodies.

Accounts were being created by hand without guardrails, so the estate was drifting and its security posture varied from account to account.

Teams spun up cloud accounts by hand with no guardrails, so the estate drifted and security posture varied account to account. There was no consistent baseline to assure against.

The department could not evidence control to its assurance body, which put spending approvals at risk. Without demonstrable governance, the whole cloud programme was exposed.

It needed a governed foundation fast, without slowing the delivery teams already in flight. Governance had to be added underneath live work, not imposed by stopping it.

We built a landing zone with automated account vending, so every new account arrives with guardrails and logging already in place. Making the compliant path the default path is what keeps the estate consistent as it grows.

Service control policies enforce the rules centrally rather than relying on each team to remember them, and centralised logging gave the assurance body the evidence it needed, aligned to NCSC cloud guidance. Control became provable rather than aspirational.

We delivered it as reusable Terraform so the department owns and extends the platform itself. The foundation was handed over as a capability, not a dependency.