The Policy Says No Unapproved Cloud Sharing. Nobody Checked If the Firewall Agrees.
Bodil Biering
Almost every company we’ve come across writes the same line into their policy: sharing data via unapproved cloud platforms is not allowed.
Almost none of them have a firewall set up to detect it. Let alone block it.
That’s the gap one of our team kept running into while consulting: the policy said one thing, the technical controls said nothing at all. He’d go in to check whether the rule was actually enforced, and more often than not, he’d be the first person at the company to ever ask the question.
That’s not a small gap. It means the company has no source of truth. Not about its controls, not about the state of its policy, not about anything. The document exists. Whether reality matches it is untested.
It’s worth sitting with why this happens. Policies tend to get written top-down and aspirationally — someone decides what should be true, writes it down, and the document is treated as settled. Nobody loops back to check it against what the firewall, the DLP tool or the actual employee behaviour is doing.
The fix isn’t complicated, just unglamorous: build policy from the ground up. Write down what’s actually happening first. Then decide what you want to happen, make it realistic, make it specific — and only then does the document mean something.
Until someone checks, the policy isn’t a fact about your company. It’s a claim.
