A Lightweight Governance Framework for Multi-Cloud Data Protection and Compliance Management in SMEs

Abstract

The implementation of multi-cloud settings in small and medium-sized businesses (SMEs) has been characterized by a consistent trend of growth, although governance systems capable of efficiently managing the issue of data protection and regulatory compliance in such complex environments are still in the conceptual phase of their development. The current frameworks, such as SKY CONTROL, NIST Cybersecurity Framework (CSF), and ISO/IEC 27001 were initially designed without considering the unique limitations posed by SME multi-cloud applications. This manuscript presents the Multi-Cloud Governance Framework (MCGF), a lightweight, vendor-neutral conceptual architecture that can support data protection and compliance management of SMEs that work on a solution on several cloud platforms. The MCGF is organized in four pillars, namely, data governance; compliance automation; policy enforcement and interoperability; and SME adoption alongside cost-benefit analysis. The framework is based on five regulatory frameworks, as well as the General Data Protection Regulation (GDPR), ISO/IEC 27001:2022, the Cloud Controls Matrix (CSA CCM) version 4, the Digital Personal Data Protection Act (DPDPA) 2023 in India, and the NIST CSF version 2.0. Comparative analysis placed against the frameworks that exist in reality proves that MCGF includes the areas of governance that are not addressed at all (or addressed partially) by the existing solutions in the scenario of multi-cloud use in SME. A prototype, coded in Python and encapsulating all four MCGF pillars was then designed and tested against real AWS and Azure environments and returned tangible compliance artefacts for 15 resource analyses concerning storage governance, regulatory rule assessment, IAM analysis, and cost viability scoring. The prototype successfully validated the ability of the framework to detect genuine governance gaps across both environments, in almost zero operational overhead and provided empirical proof of the conceptual design.