Three clouds, three platform teams and three separate compliance scores is not a governance model. It is three governance models running simultaneously — with no unified view, no single evidence pack and no consistent standard across all three.
The reality in most enterprises today
Azure for core workloads. AWS for specific capabilities — AI/ML, data lake, particular services. GCP for analytics or where Google-specific tooling is preferred. Each cloud acquired its own platform team over time. Each team built its own governance approach. And each governance approach is now producing its own findings, its own evidence and its own version of the truth.
The problem compounds at audit time. The compliance team needs a single evidence pack covering all regulatory requirements across all cloud environments. What they get instead is three sets of output from three different tools, which must be manually reconciled, cross-referenced and assembled into a coherent document. This takes 3–4 weeks and a significant proportion of the compliance team's annual capacity.
How ZAP was designed for multi-cloud from the start
ZAP was designed from the outset for multi-cloud governance. A single ZAP instance connects to Azure, AWS and GCP accounts simultaneously. One compliance dashboard. One governance score. One evidence pack covering CIS Azure 2.0 (215 controls), CIS AWS 2.0 (20 controls) and CIS GCP 1.3 (25 controls) — plus all nine regulatory frameworks — from a single platform.
When compliance is enforced at the point of deployment — not discovered through retrospective scanning — the standard is consistent across all three clouds.
The regulatory value of a single view
For regulated enterprises, the single-view capability has specific regulatory value. DORA ICT risk management requirements demand a comprehensive view of ICT assets and vulnerabilities. FCA PS21/3 cloud outsourcing oversight requires understanding all material cloud arrangements. NCSC CAF requires comprehensive estate visibility.
The adaptation tax
The organisations that manage multi-cloud governance most effectively have one thing in common: they chose governance tooling that was designed for multi-cloud from the beginning, not adapted for it after the fact. The adaptation tax — the manual work required to make single-cloud tools produce multi-cloud evidence — is paid every quarter, every audit cycle and every time a regulator asks a question.
See ZAP live
Book a 30-minute session with the Zentej team. We show you ZAP live on our instance — landing zone, compliance scan, evidence generation, ZAP AI. No commitment.