This talk describes the European Commission approach to cloud adoption from 2013-2025 along with stories of the good, the bad and the ugly and how EC has iterated upon its risk appetite and security debt appetite over time.