Two to three weeks on which workloads belong in the cloud, which belong where they are, and what each one costs to run once it moves. You get a migration order you can argue with and a number you can budget against.

Built cloud-native rather than lifted and reshaped later: stateless services, managed data stores, and a deployment path that exists from the first commit instead of being bolted on before launch.

Rehost, replatform or rebuild, decided per workload rather than as a programme-wide rule. The cutover plan includes the rollback, because the first migration that cannot be reversed is the one that goes wrong.

Infrastructure as code from day one, so the environment that passed testing is the environment that ships. Drift is detected rather than discovered, and nobody has to remember what was clicked last March.

The connective work between your systems and the services they now depend on: queues, events and APIs with retry and idempotency designed in, because a cloud network will deliver the same message twice eventually.

An owner, a response time and a monthly note on what moved. Patching, capacity and incident response handled as ongoing work rather than as the thing somebody gets to after the roadmap.

Identity, network boundaries, secrets and audit trails set at architecture rather than retrofitted before a review. Least privilege is a default here, not a hardening exercise someone schedules for later.

The bill, read properly. Rightsizing, reserved capacity and the idle resources nobody owns, reviewed monthly against what you actually ran. Most first passes find a quarter of the spend doing nothing.

Scaling rules that have been forced in testing rather than trusted in production. We will tell you the ceiling and what it costs to raise it, because an autoscaler nobody has pushed is a guess.

Identity, least privilege, secrets handling and an audit trail you can replay. Designed at architecture, because security retrofitted before a review is the expensive kind.

The failure modes written down and the recovery rehearsed. Availability is a number you test toward, not a tier you buy, and the test is pulling the thing out while people are watching.

Measured at the boundary your users actually feel, not at the service's own edge. Budgets are agreed before the build so a regression is a release blocker rather than a ticket.

Your cloud estate has to talk to what you already run, including the system nobody wants to touch. Those integrations are designed first, because they are where migrations quietly fail.

Residency, retention and access settled in the architecture, so you answer an auditor by replaying a run rather than reconstructing one. SOC 2, HIPAA and GDPR are build constraints here.