Body of Knowledge
The organized reference of core Responsible Cloud concepts, terms, and practices — the shared vocabulary the Framework and Methodology are built from.
Applied research program
Responsible Cloud Research & Methods
Developing practical methods for making cloud, AI, and technology risk more visible, accountable, evidenceable, and manageable.
Why this exists
Applied research for organizations without enterprise-sized teams.
Responsible Cloud conducts applied research into practical technology governance for organizations that may not have enterprise-sized security, risk, FinOps, procurement, or governance teams. Research is intended to produce usable frameworks, methodologies, assessment instruments, evidence models, practitioner guidance, and open educational resources — not academic theory on its own.
This page separates established Responsible Cloud methodology from emerging research concepts. Status labels, version numbers, and publication dates below are accurate as of the date shown. Unpublished concepts are marked as unpublished rather than given invented version numbers or dates. Research is one of four ways Responsible Cloud operates — alongside the discipline itself, the published Framework and Methodology, and the consulting practice that applies them.
Research & Methods architecture
How these fifteen items fit together.
These are not unrelated projects. Everything on this page traces back to one discipline, expressed through a published framework and methodology, a set of core assets still being built, and a set of research lines exploring where the discipline needs to go next.
- Responsible Cloud
- Framework
- Methodology
Responsible Cloud is the overarching discipline and operating philosophy. The Framework is its conceptual structure — the executive questions and capability pillars. The Methodology is how the Framework is put into motion: Discover → Assess → Prioritize → Assign → Reduce → Prove. Both the Framework and the Methodology are published and versioned; see the portfolio below for exact version and publication dates.
Core assets still being built
These are named parts of the discipline that do not yet exist as finished, published material. They are listed here — honestly labeled — rather than left unmentioned.
Maturity Model
A staged model describing how an organization’s technology governance practices progress from informal to disciplined.
Controls Catalog
A structured catalog of specific, right-sized controls mapped to the Framework’s eight capability pillars.
Evidence Standard
A defined standard for what counts as adequate evidence that a control or improvement genuinely exists — the intended output of the Cloud Evidence Engineering research below.
Reference Architecture
A reference architecture showing how the Framework’s pillars and the Methodology’s six phases map onto a real small-organization cloud and AI environment.
Practitioner Guide
A step-by-step guide for practitioners — internal staff, partners, or advisors — applying the Methodology day to day.
Supporting and emerging methodologies
Six active research lines feed the core assets above. Each is explored in full below, with its own primary question, problem statement, and honest status.
Research portfolio
Seven active lines of work, in detail.
One is the established Responsible Cloud discipline, in active use today. Six are the supporting and emerging methodologies introduced above, published here as concept summaries while full research is developed.
Published
1. Responsible Cloud
Responsible Cloud is the overarching discipline and practical methodology for understanding technology, identifying meaningful risk, prioritizing action, assigning accountability, reducing risk, and documenting what changed.
Primary question: How can organizations make technology risk reduction understandable, actionable, accountable, and provable?
Problem addressed
Organizations without enterprise-sized security, risk, and governance functions often manage technology informally, leaving decisions undocumented and hard to explain or defend.
Current status
Active and foundational. This is the published, in-use discipline behind every Responsible Cloud engagement and the free Cloud Risk Check.
Version and publication
Methodology v1.0 — current as of August 14, 2026.
Framework v1.0 — published 2026.
No standalone downloadable paper is currently published; the Framework and Methodology are published as web pages.
Research
2. Cloud Evidence Engineering
Cloud Evidence Engineering is an emerging discipline focused on how organizations design, collect, and maintain reliable evidence that technology controls, responsibilities, and improvements genuinely exist — rather than assuming a control is effective because a policy or setting exists.
Primary question: How do we systematically engineer reliable evidence that technology controls, responsibilities, and improvements actually exist?
Problem addressed
Organizations often report that a safeguard is “in place,” but when evidence is requested — by leadership, an insurer, a customer, or after an incident — the record is missing, outdated, or inconsistent.
Current status
Foundational research. Concept and scope defined; full publication is in development.
Version and publication
Not yet versioned. Not yet published.
Evidence designEvidence collectionEvidence qualityValidationTraceabilityContinuous evidenceExecutive assurance
This card is the current published view of this research direction. No separate paper or version history exists yet.
Research
3. Cloud Dependency Engineering
Cloud Dependency Engineering studies what an organization depends upon, what depends on the organization, and how a failure in one part of that chain propagates to the rest.
Primary question: What does the organization depend upon, what depends upon it, and what happens when those dependencies fail?
Problem addressed
Technology dependencies are often invisible until something fails. Organizations frequently cannot say, with confidence, which vendors, platforms, or single points of failure their most important work actually depends on.
Current status
Foundational research. Concept and scope defined; full publication is in development.
Version and publication
Not yet versioned. Not yet published.
Dependency discoveryDependency mappingConcentrationSubstitutabilityRecoverabilityFailure propagationVendor dependencies
This card is the current published view of this research direction. No separate paper or version history exists yet.
Research
4. AI Infrastructure Accountability
AI Infrastructure Accountability examines who is responsible for the infrastructure, resources, access, dependencies, costs, and operational consequences that support an organization’s AI systems — not just the AI model or tool itself.
Primary question: Who is accountable for the infrastructure, resources, access, dependencies, costs, and operational consequences supporting AI systems?
Problem addressed
AI tools are often adopted faster than the infrastructure decisions behind them are assigned to an accountable owner, leaving questions about access, cost, and failure response unanswered until something goes wrong.
Current status
Foundational research. Concept and scope defined; full publication is in development.
Version and publication
Not yet versioned. Not yet published.
This card is the current published view of this research direction. No separate paper or version history exists yet.
Research
5. AI Cost Assurance
AI Cost Assurance examines whether an organization’s AI-related spending is attributable to an owner, explainable in plain language, controlled before it grows unpredictably, and economically justified relative to the value produced.
Primary question: Can management trust, explain, control, attribute, and economically justify its AI expenditures?
Problem addressed
AI usage and its associated cost can scale quickly and unpredictably across teams and tools, often without a clear owner or a defensible way to explain the spend to leadership.
Not a replacement for FinOps
FinOps focuses on optimizing and forecasting cloud spending broadly. AI Cost Assurance focuses specifically on whether AI spending can be attributed, explained, controlled, and justified. The two are intended to complement each other, not compete.
Version and publication
Not yet versioned. Not yet published.
This card is the current published view of this research direction. No separate paper or version history exists yet.
Research
6. Autonomous Technology Internal Controls
This research develops internal controls for technology capable of initiating or materially influencing organizational actions with increasing autonomy — for example, systems that can take actions, spend money, or make decisions with reduced or no direct human review at the moment of action.
Primary question: What internal controls are required when autonomous technology can initiate or materially influence organizational actions?
Problem addressed
Traditional internal controls assume a person initiates and authorizes each significant action. As technology takes on more autonomous initiation and influence, existing control models may not clearly address authorization, limits, or accountability.
Current status
Foundational research. Concept and scope defined; full publication is in development.
Version and publication
Not yet versioned. Not yet published.
AuthorizationIdentityAccessFinancial authoritySegregation of dutiesDelegationLimitsMonitoringExceptionsEvidenceTermination
This card is the current published view of this research direction. No separate paper or version history exists yet.
Research
7. Minimum Viable Technology Governance
Minimum Viable Technology Governance (MVTG) asks what the smallest practical governance system is that an organization needs to manage modern technology responsibly — enough structure to be accountable, without enterprise-scale bureaucracy a small organization cannot sustain.
Primary question: What is the smallest practical governance system an organization needs to manage modern technology responsibly?
Introducing MVTG-7
- Know
- Own
- Control
- Evidence
- Spend
- Recover
- Review
Problem addressed
Many small and growing organizations have no formal technology governance, or attempt to adopt enterprise-scale frameworks that are too heavy to maintain and abandon governance altogether as a result.
Current status
Foundational research. Concept and scope defined; full publication is in development.
Version and publication
Not yet versioned. Not yet published.
This card is the current published view of this research direction. No separate paper or version history exists yet.
Open research philosophy
Open Research Philosophy
Responsible Cloud research is transparent about maturity, limitations, sources, prior art, and changes over time. Emerging methodologies on this site are not described as internationally recognized disciplines or standards unless that recognition genuinely exists.
Where a method is still being developed, this site uses language such as:
- “Responsible Cloud is developing…”
- “Responsible Cloud proposes…”
- “This research explores…”
- “This model is an early framework…”
This site does not use unsupported claims such as “the world’s first,” “invented by,” “industry standard,” “universally accepted,” or “scientifically proven.” Where prior art, related work, or existing standards exist, they are identified and credited rather than ignored.