# Cloud Center of Excellence — RACI and RFC template

Use this when standing up or resetting a CCoE. **RFC** = request for cloud change (platform exception, new region, net-new service).

## RACI (minimum viable)

| Activity | CCoE / Platform | Application team | Security | FinOps | Finance |
|----------|-----------------|------------------|----------|--------|---------|
| Landing zone standards (VPC, SSO, logging) | **A/R** | C | C | I | I |
| New AWS service approval | **A** | R (business case) | C | C | I |
| Well-Architected workload review | C | **R** | C | C | I |
| Tag / chargeback policy | C | R (apply tags) | I | **A/R** | C |
| MAP / migration wave gate | C | **R** | C | C | I |
| Production deploy (CI/CD) | C | **A/R** | C | I | I |

**A** = accountable, **R** = responsible, **C** = consulted, **I** = informed.

## RFC fields (copy into Jira/ServiceNow)

1. **Requester** + cost center / product tag keys
2. **Change type:** net-new service | region expansion | SCP exception | data class change
3. **Workload silhouette:** accounts, peak RPS, data classification (public / internal / regulated)
4. **Alternatives considered** (including “do nothing”)
5. **WAR pillar impact:** Security, Reliability, Cost (one sentence each)
6. **Rollback plan** (or maintenance window acceptance)
7. **FinOps estimate:** monthly delta + one-time migration (link Cost Explorer saved report or Infracost output)
8. **Security sign-off:** delegated admin impact? new internet egress?

## SLA targets (benchmark)

| RFC type | Target decision |
|----------|-----------------|
| Standard (in-catalog service, approved region) | **3** business days |
| Exception (new region, SCP change) | **10** business days |
| Emergency (incident-driven) | **4** hours acknowledge; post-incident RFC within **5** days |

## When to escalate to architecture review board

- Cross-account data sharing without Lake Formation contract
- Production data leaving approved regions
- Customer-managed keys with non-standard rotation
- Spend uplift **>15%** vs trailing 90-day account average without FinOps pre-approval