"I finally know what to expect"

With CloudGate, our onboarding of new services is finally standardised. In the past, I never knew what to expect and how much work and time I had to plan for onboarding my projects.

Now I can finally see who has to check what and, above all, I can see the progress at any time and know where things stand.

But the best thing is that I'm no longer a “messenger”: I involve my providers directly in information gathering or audits, and no longer have to send excel sheets around.

I like the fact that after onboarding, I can immediately see what control measures and checks are in store for my services over the next few years.

I also like the fact that my role is free of charge as we use the First Class Edition.

"No more waiting around thanks to votum"

In my role as Digital Coordinator, I have the task of making digitalisation possible. The pressure from the specialist side to set ourselves apart from the competition is so great that we can barely keep up, especially when it comes to approving SaaS solutions, and usually have to onboard three to four solutions in parallel.

CloudGate helps me to maintain an overview and to always be able to talk to our business side, as well as our management.

I also really appreciate the collaborative approach of the solution. I have clearly defined our responsibilities and don't have to do this every time.

But my absolute favourite is the vote at the end of the audit:
At last, our audit areas ‘from supervisory law to ZAM’ have to vote clearly PRO or CONTRA of a service. Since we started using CloudGate, we no longer have to deal with the long delays with unclear statements and positions.
And if there is a problem, I can immediately see it in CloudGate and we can resolve it in our next service board meeting.

"Ingenious: central register, BaFin notifications and DORA information register in one tool"

I have to admit that it was with a heavy heart that we gave up our previous Excel-based risk assessment processes. Of course, it's not easy to let go, but it helped that microfin imported our checklists directly into CloudGate so that we could start using our familiar approach straight away.

We can now report outsourcings to BaFin at the touch of a button and with audit-proof documentation: The upstream data validation for notifications of intent and enforcement notifications, as well as the automatic transmission saves us errors and a lot of time - previously we did this laboriously by hand in the MVP front end.

But what really excites us is that the information register in accordance with DORA is now also being set up as a side effect - without any double entry of data!

The fact that microfin also maintains the legal and regulatory content and makes changes at national and EU level available quickly gives me a good feeling.

"Focus on data"

Finally, our specialist departments are motivated to clearly identify the data to be processed in connection with the introduction of new services. CloudGate makes it much easier for us to analyse protection requirements and risks.

We also have a good collection of risks and protective measures after just a few onboardings, without having to formulate them anew each time. CloudGate helps us by allowing us to easily transfer this information from previous use cases to new ones.

The clear country allocation with regard to data storage and processing helps us immensely to scrutinise those services that process sensitive data outside the EU.

We find the option of adapting data subject groups, legal bases, data collection methods, data policies and authorised access groups to our terminology in CloudGate brilliant.

"Game changer with increasingly scarce legal resources"

Thanks to the process mapped in CloudGate, we already know before the negotiation phase whether there is a significant/important outsourcing or carve-out. The fewer regulatory requirements we have to negotiate into provider contracts or hyperscaler contracts, the better: this saves time and energy.

In CloudGate, our colleagues can also categorise the usually numerous sub-providers of a provider into classes so that we can concentrate on the really critical sub-providers during subsequent contract reviews.

But what saves us even more time and resources is the automatic change detection in general terms of use. Without CloudGate, we would not be able to fulfil our obligation to check changes, especially with the high number of SaaS solutions - a real game changer.

Incidentally, we were very pleased that we were not forced to abandon our previous contract management solution, but were able to couple it with CloudGate very quickly. Thanks to the well-documented interface, our IT department was even able to implement this itself.

"In short: Wow!"

Naturally, we like to take a look under the bonnet of IT architecture. CloudGate looked really good: a Kubernetes-based modern application architecture with client separation and encryption.

We attach great importance to the continuous development of SaaS solutions. After coordination with microfin, it was clear that three to four releases per month would be rolled out to all customers via the automated CI/CD route - so evergreening is guaranteed.

As a rule, we not only evaluate the technology used, but also the UX design. We liked the user interface, the intuitive usability, the clarity and the wide range of export functions.

CloudGate is rounded off by a decent knowledge base. However, we particularly applaud the useful interface documentation in the solution itself: As a developer, you can try out all the REST API functions directly.

"Top delivery model including consulting"

microfin was recommended to us when we were looking for an outsourcing management tool. After the first meeting, it was already clear that the outsourcing and cloud consulting, coupled with more than twenty years of consulting experience with financial service providers and insurance companies, as well as a practice-orientated SaaS solution, represented a reliable promise for the future for us.

At first I was a little reluctant, as I had expected a sourcing consultant to organise its delivery model offshore. However, the opposite is the case: microfin delivers all services - from German-language support to DevOps and infrastructure operation - from Germany. In particular, the choice of the Open Telekom Cloud as our infrastructure provider has given us a lot of confidence.

We also use microfin as a consultant for tricky risk assessments: for example, we were able to use the ready-made risk assessment for Microsoft 365 in CloudGate and thus introduce MS Teams & Co. more quickly and implement the necessary controls.

The icing on the cake was the whitelabelling option, which contributed significantly to the acceptance of CloudGate among our users: It allowed us to customise the appearance of CloudGate to our corporate CI without any programming effort.

"They're on the ball"

I was pleasantly surprised by microfin's response times as early as the preparation phase for the CloudGate trial. Within a few hours, we had a free quote, an NDA and the general terms of use on the table, so that I was able to commission the trial directly, much to the delight of my colleagues.

I then, of course, looked at the pricing model and spoke to microfin about the billing modalities. I was an instant fan of the “Pay as you go” method, which was based on the roles used. The easy-to-control usage billing via the solution itself makes commercial processing much easier for me.

I was also delighted to realise that the role of the user in the First Class Edition of CloudGate can be used free of charge. This is very important for us, as our demand process can basically be initiated by any employee in the company - whether on the business or IT side - so we can't even name the number of users. Simply round!

"New ISM yardstick"

We wanted to know exactly what was going on and subjected CloudGate to our tried-and-tested ISM test with more than 200 test points. We looked at all technical and organisational measures, from application to security to access control, in detail.

What can I say: Our expectations were clearly exceeded. microfin set a new benchmark with their answers and we really had nothing to complain about.

Okay, with the Open Telekom Cloud as our partner for infrastructure management, we honestly didn't expect any other result.

We particularly liked the fact that microfin clearly presented the measures for application and infrastructure management separately for each requirement.

Incidentally, we have also discovered CloudGate for ourselves and the providers we audit can now edit our ISM checklists directly in CloudGate. This allows us to see the progress directly and intervene immediately rather than after four to six weeks if the level of detail is not right.

Top!

"Compliance in other areas too"

Our Central Outsourcing Management thought the legal and regulatory content in CloudGate was truly good. It's nice, the focus is on outsourcing and IT topics, but there's more to it, I thought at first.

Then I tried out the functionalities around check catalogues and digital checklists and recognised the potential of the predefined answers, question trees, decision support and checkpoint background information.

We have now created a whole series of check catalogues for specialist compliance topics and internal audits ourselves. This helps us to achieve compliance in other subject areas as well - the solution also provides audit security, and we have simply created additional agile boards for the new subject areas, thus separating ourselves very elegantly from the Central Outsourcing Management topics.

Very universal with additional benefits - this inspires me.

"Just do it!"

We didn't want to deal with CloudGate in the first place - our thinking was: “Not another risk management system”. However, we bought the argument that risks in connection with managed services, AI or cloud applications are best handled where the onboarding and risk checks are carried out.

We then only adjusted the risk matrix months after launching CloudGate. Unfortunately, quite a few risks had already been identified!
But what can I say: although we adjusted the risk matrix in terms of frequency of occurrence, level of damage and classes, we didn't have to reallocate the recorded risks - CloudGate did that automatically. Someone really put some thought into this.

It's brilliant that we can easily record risks for individual services, contracts or providers on an ad hoc basis and that we can immediately see which services are driving our risks and which measures are mitigating them via the central risk dashboard.

Naturally, we wanted to regularly transmit the operational risks from CloudGate to our central risk management system. Fortunately, this was not as difficult as we had feared - microfin provided an interface via the REST API in just a few days.

"Finally involved right from the start"

With CloudGate, we finally have the opportunity to test the SaaS solutions that are highly coveted by our specialist departments in terms of ergonomics, performance and behaviour control right from the start. Both we and our HR department were tired of being asked just before a service was released and then having to reject a solution as a last resort.

Now we can scrutinise new solutions in onboarding directly with our own review catalogues in parallel with our colleagues and check them for potential violations of our employees' personal rights.

In doing so, we have learnt that critical reports or telemetry data can be restricted for many solutions to enable them to be used after all.

We were impressed by the fact that microfin had already provided us and HR with corresponding check catalogues when the CloudGate instance was provided. This demonstrates practical experience, and we are now taking off in our new role as innovators and enablers!

"Yes, BaFin can ring the bell"

We occasionally have to check the correctness of onboarding decisions or retrace decision-making chains. So it's a good thing that CloudGate has an explicit auditor role for me.

I can look at everything without having to worry about changing something unintentionally: My CloudGate role lets me use CloudGate in ‘read-only’ mode and I'm also the only one who can see the complete audit trail in full and in detail.

What I particularly like is the integrated option for digital signatures. This allows, for example, risk acceptances or production releases to be digitally signed by several responsible parties. This finally means that nothing is printed anymore and we can still prove that we have taken note of or approved something without any doubt.

What a cool thing!