Cloud Groundwork
The fixed-scope foundation for Google Cloud: organization structure, IAM, policies, and audit trails as code — built in weeks, owned by you.
From €1,000 · the first call is free
What we usually find
- The infrastructure is a snowflake built by hand in the console: nobody can rebuild it from scratch, and nobody wants to be the one who tries.
- The question "who has access to what?" costs an afternoon of clicking through IAM.
- The ISO 27001 or SOC 2 questionnaire arrives, and the evidence is a pile of screenshots.
- Every new environment takes weeks, because everything that already exists has to be re-created by hand.
- There are no organization policies; every project decides its own security posture.
- Tightening permissions feels dangerous, so broad access stays — the risk moves instead of shrinking.
What ships
- → Organization structure and billing view that scales past the first handful of projects.
- → A Terraform landing zone: networks, projects, and environments as reviewable code.
- → IAM built on our additive-only internal module — tightening permissions cannot lock anyone out.
- → Organization policies that make the secure path the default path.
- → Audit logging wired so evidence is a git log, not a screenshot.
- → Documentation your next auditor — or your next engineer — can work from.
Four phases, each with a written result
- 01
Inventory
One week. We read your organization as it is: projects, IAM, policies, costs. Written findings, ranked.
- 02
Blueprint
The landing zone design: folder structure, networking, IAM model, policy set. Reviewed with your team before anything is built.
- 03
Build
The foundation lands in your repository as Terraform. What took weeks of clicking applies in hours; every change is a pull request.
- 04
Handover
Your team runs it: documentation, walkthrough, and the evidence pack an auditor asks for first.
A Global Power-Systems and Aerospace Group
26 Terraform modules, five environments, validation green across all of them. IAM was rebuilt with zero broad permissions, and provisioning that took weeks of manual work applies in hours. The organization-wide rollout is in progress — built, validated, and documented before it ships.
Lockout-proof by design
Most IAM automation can remove the very permissions it needs to run — one wrong apply and the pipeline locks itself out. Our internal module is additive-only: it grants, never revokes, so tightening access can never take your own access away. Google's own frameworks leave that choice open; ours removes the dangerous one.
We demonstrate it live — a real terraform plan against a real project — in the first call. And because we reuse a proven internal module library, the foundation ships in days of work, not months of design.
Questions about Cloud Groundwork
What does it cost?
Focused work starts around €1,000; after the inventory the scope is in writing, with a fixed price attached. The first call is free.
How long does it take?
The inventory takes one week; the foundation typically lands four to six weeks after the blueprint review, depending on how much console-built state we find.
Does this make us NIS2-compliant?
No tool does that. NIS2 has been binding law in Germany since 6 December 2025, and the statutory BSI registration deadline has passed — what counts now is demonstrable implementation. The foundation gives you the evidence trail: policies, IAM, and audit logs in git history. That is the part supervisors and auditors actually check.
Is Google Workspace included?
The identity backbone is: Cloud Identity groups and memberships run codified in Terraform with a full audit trail — that is what Workspace access governance runs on. Full Workspace configuration (mail routing, security settings, DLP) is a separately scoped follow-up, not quietly implied.
Who owns the code?
You do. Everything lands in your repository under your review; there is no lock-in and no hidden module dependency you cannot read. Our internal modules are documented, and the handover includes running them without us.
We already have infrastructure. Rip and replace?
No. The inventory documents what exists; the foundation lands beside it and migrates piece by piece. The additive-only IAM module exists exactly for this: existing access keeps working while structure arrives.
The 30-Minute Technical Risk Call
Free and without obligation. You get a calendar invite and nothing else.
Book the 30-Minute Call