Start with the Big Picture

• What's the single most important business outcome you need this cloud migration to deliver in the next 12 months? Options: Reduce operational cost, Enable digital services (customer-facing), Meet regulator/compliance mandate, Improve disaster recovery/resilience, Retire on‑prem data center, Other
• Who is the executive sponsor and who will be your day‑to‑day point of contact for technical decisions?
• How would you describe your current cloud posture today—pilot/POC, partial production, multi‑cloud, or mostly on‑prem? Options: No cloud (on‑prem only), Pilot/POC only, Single workload in production, Multiple production workloads, Multi‑cloud hybrid
• What is the timeline you're working toward for migrating the first regulated workload to production? Options: Next 30 days, 30–90 days, 3–6 months, 6–12 months, 12+ months, No fixed timeline
• When you think about this effort, what keeps you or your team up at night?

If Compliance Could Talk, What Would It Demand?

• What would it do to your migration plan if your CISO or a regulator said: 'We won't accept anything less than full FedRAMP/HITRUST/PCI controls as deployed—not just compliance‑eligible services'? Options: Pivot timeline, Require 3rd‑party assessment, Engage external compliance consultants, Stop migration until evidence provided, No change
• Which specific certifications or attestations are mandatory for the workload(s) in scope? Options: FedRAMP Moderate, FedRAMP High, HITRUST, PCI DSS, SOC 2 Type II, ISO 27001, State/regional privacy requirements, Other
• Who in your organization is the final approver for compliance acceptance (title/role)? Options: CISO, Head of Compliance, Security Architect, Legal/Privacy Lead, External Regulator, Other
• What compliance evidence do you currently require to sign off on a new platform (examples: control mapping, audit reports, system security plan, pen‑test report)? Options: SSP/System Security Plan, Third‑party audit report (SOC/FedRAMP), Penetration test report, Encryption attestations, Data residency proof, Other
• Tell us about a past time compliance blocked or delayed a cloud project—what happened and how long did it take to resolve?
• Are there internal policies or external contracts that prevent you from using certain regions or vendors (e.g., data residency, vendor blacklist)? Options: Yes — internal policy, Yes — contractually prohibited, Yes — regulator imposed, No restrictions, Unsure

Where Money Sneaks Out the Backdoor

• What would it mean for your team if a migrated workload produced a surprise six‑figure monthly bill—how would decisions change? Options: Immediate rollback, Cut non‑essential services, Finance escalation, Renegotiate committed spend, Accept and monitor, Other
• Which of these cost factors have surprised you before or feel most risky for this migration? Options: Egress charges, Storage tiering & cold storage, Network bandwidth, Unoptimized reserved capacity, Licensing / marketplace costs, Support & managed services, Other
• Do you currently model expected steady‑state monthly spend and peak month spend separately? If so, how confident are you in those models? Options: We model both and are confident, We model both but not confident, We only model steady‑state, We don't model in detail, Unsure
• What committed‑spend approach would your finance/procurement team consider acceptable (minimum term, payment cadence, true‑up options)? Options: 12‑month minimum, 24‑month minimum, Annual prepayment, Monthly true‑up, Quarterly true‑up, Consumption‑based with floor
• Have you experienced billing disputes or opaque egress/storage pricing with prior vendors? Describe one example and the impact.
• Which stakeholders must approve pricing tradeoffs (e.g., finance, procurement, legal, security)? Options: Finance/FP&A, Procurement, Legal, CISO/Security, Business Unit Owner, Other

What Does Success Look Like in Real Numbers?

• If we measured success 90 days after go‑live, what 3 metrics would tell you this migration is working?
• Which of the following operational targets are non‑negotiable for you? Options: RTO (Recovery Time Objective), RPO (Recovery Point Objective), SLA uptime %, Mean time to detect/respond, Audit/log integrity, Cost per workload
• What thresholds in those metrics would trigger escalation or rollbacks? Options: X% below SLA, Y hours downtime, Z% cost overrun, Failed compliance audit, Other
• How will you measure user/business impact (examples: transaction latency, support tickets, revenue at risk)? Options: Transaction latency, Error rate, Support ticket volume, Revenue impact, Customer experience/NPS, Other
• Who will own reporting and cadence for these metrics after go‑live (title/role)? Options: Cloud Ops Lead, Platform Engineering, Solutions Architect, Business Unit Owner, Other
• Would you be open to a jointly defined success dashboard we review monthly with the account and engineering teams? Options: Yes, Maybe, No

How Much Risk Are You Willing to Live With?

• If you had to pick one sentence that describes your organization's appetite for residual risk after migration, what would it be? Options: Zero tolerance — must be fully mitigated, Very low — only minor residual risk, Moderate — acceptable tradeoffs for speed, High — willing to accept risk for cost/speed, Undecided
• Which residual risks would you consider acceptable to the business (select all that apply)? Options: Minor configuration deviations, Delayed non‑critical audits, Temporary limited monitoring gaps, Performance variance, None — all must be resolved
• What incidents or findings in a pen‑test or audit would be automatic deal blockers for your compliance team? Options: Critical vulnerabilities, Data exfiltration risk, Unencrypted data at rest, Missing audit logs, Third‑party subprocessor concerns, Other
• How do you currently handle risk exceptions—who signs them off and what documentation is required?
• What specific security or privacy controls do you expect to be enforced by default (examples: encryption at rest, access boundaries, centralized audit logging)? Options: Encryption at rest, Encryption in transit, Role‑based access control, Centralized audit logging, Key management (customer‑managed), Data residency enforcement
• How quickly would you expect remediation for a high‑severity finding post‑deployment (SLAs for fixes)? Options: 24 hours, 72 hours, 1 week, Depends on complexity, No expectation defined

Deal Mechanics — Where the Rubber Meets Paper

• What are the non‑negotiable contract terms you must have before signing a committed‑spend agreement? Options: Transparent egress pricing, Clear storage tiering terms, Data Processing Agreement (DPA), Pen‑test and results sharing, Service availability SLA, Termination and exit terms
• Which procurement cycle best describes how your organization awards multi‑year platform agreements? Options: Fast track (under 30 days), Standard (30–90 days), Complex (3–6 months), Enterprise procurement (6+ months)
• Who needs to sign off on pricing and legal terms (roles)? Options: Procurement Director, VP Finance/CFO, General Counsel, CISO/Security, Business Unit Head, Other
• What billing model do you prefer for committed spend? Options: Monthly billing with true‑up, Quarterly billing, Annual prepay, Consumption with minimum commitment, Other
• What exit/egress protections are essential to you (examples: data export tools, assistance, capped transfer rates)? Options: Export tooling & scripts, Assisted data export period, Capped egress rates or credits, No special protections needed, Other
• Are there procurement policies (e.g., SOC 2 attestation required, DPA language) you can share so we can align contract language early? Options: Yes — will share, Yes — but restricted, No — none to share, Unsure

Who's Playing Which Role — Team Rhythm and RACI

• Who will be the dedicated technical owner for the migration and ongoing ops (title/role)? Options: Cloud/Platform Engineer, DevOps Lead, Infrastructure Manager, Solutions Architect (internal), Other
• Which internal teams must be actively involved during migration windows? Options: Security/InfoSec, Network Engineering, DBA/Storage, App Owners/Developers, Compliance/Privacy, Procurement/Finance
• Would you want a named solutions architect embedded with your team for the first 3–6 months? Options: Yes — mandatory, Preferred but optional, No
• How do you prefer handoffs and decision‑making to work during migration (examples: weekly steering, daily standups, asynchronous tickets)? Options: Weekly steering committee, Twice‑weekly syncs, Daily runbook standups during waves, Asynchronous with SLAs, Other
• What internal communication channels and escalation paths already exist for cloud incidents? Options: Pager/on‑call rotation, Dedicated Slack/MS Teams channel, Email escalation chain, Incident response runbook, None formalized
• What would success look like for your team’s working relationship with our solutions architect in month 1 and month 3?

If This Worked, What Comes Next?

• Imagine we met your top success metrics—what would your next migration look like and how soon would you want to expand? Options: Expand similar workload immediately, Plan next workload in 3 months, Consolidate several services before expanding, Not sure yet
• Which parts of your estate are highest priority for follow‑on migrations (select up to three)? Options: Core banking/transactional systems, EHR/clinical systems, Billing & claims, Analytics/data warehouse, Backup & archive, Dev/test environments
• What organizational signals would tell you it’s time to expand (examples: compliance sign‑off, cost savings realized, SLA reliability)? Options: Compliance sign‑off on initial workload, Consistent cost predictability, SLA met for X months, Business request for scale, Other
• What internal obstacles could derail expansion even if the initial migration succeeds? Options: Budget constraints, Procurement cycle delays, Security concerns, Change fatigue, Competing priorities, Other
• If you could ask our team for one guarantee to make you feel confident about expanding, what would it be?
• Realistically, when should we schedule a follow‑up to review success signals and discuss expansion plans? Options: 30 days after go‑live, 60 days after go‑live, 90 days after go‑live, On milestone completion, Other

• Solution Experience Kickoff — Current State Confirmation
• Consequence & Success Metrics Workshop
• Compliant Architecture Solution Experience
• Migration Path & Runbook — Pilot Proof
• Cost Model & Commercial Proof

• Lock in pilot schedule and required test data windows.
• Compliance owner lists mandatory compliance gates (e.g., FedRAMP baseline, pen-test timing) and signs off.
• One-sentence Future State
• Get customer agreement that the presented architecture will achieve the defined future state and success metrics.
• Map each compliance control to evidence and owner, closing any responsibility gaps.
• Establish concrete validation checkpoints to be executed during pilot and waves.
• Solutions architect to deliver an annotated architecture diagram with control-to-evidence mapping.
• Compliance owner to confirm the sufficiency of mapped evidence for audits and list any additional documentary needs.
• Operations owner to accept the validation checklist and assign test owners.
• Migration Waves & Pilot Selection
• Agree on a low-risk pilot that will prove the architecture and migration process against the success metrics.
• Confirm runbooks, rollback criteria, and operational owners for pilot execution.
• Introductions & Objectives
• Build and share pilot runbook with step owners, expected outcomes, and rollback triggers.
• Network/ops to provision transfer bandwidth reservation and confirm egress throttling parameters for the pilot window.
• Schedule pilot cutover date and invite all operational stakeholders and audit observers.
• Current Cost Baseline & Drivers
• Obtain customer validation that the cost model reliably projects outcomes and that key cost risks are mitigated.
• Select a pricing scenario for negotiation and identify legal/compliance items required to finalize terms.
• Establish a billing governance cadence and dashboard ownership for ongoing cost control.
• Deliver a detailed cost-model workbook with scenario tabs and assumptions annotated for customer review.
• Finance/legal to draft term sheet reflecting committed-spend band, egress/storage clauses, and SLA obligations.
• Set up monthly spend-review meeting and connect billing dashboards to designated finance owners.
• Achieve a single, agreed one-sentence current state describing who is affected and how it’s breaking.
• Surface initial quantified consequences (cost/risk/time) tied to the current state.
• List all missing evidence and assign owners to supply them before the architecture walkthrough.
• Customer provides finalized architecture diagram, workload inventory, and last 3 months of billing/cost drivers.
• Solutions architect drafts a one-sentence current-state proposal based on attachments for customer confirmation.
• Schedule the Consequence & Metrics Workshop and Architecture Walkthrough with required stakeholders.
• Reconfirm Current State & Stakes
• Agree on a small set of measurable success signals that will prove the future state.
• Quantify the business and compliance consequences that make the change urgent.
• Document acceptable residual risk and procurement constraints to constrain the solution design.
• Create a Success Metrics document mapping each metric to measurement source, owner, and target values.
• Finance provides committed-spend bounds and billing constraints to be used in cost modeling.
• Proposed Cost Model Aligned to Architecture
• Data Migration & Egress Strategy
• Quantify Consequence — Cost, Time, Risk
• Read & Validate Current State (one sentence)
• Architecture Walkthrough — Zones & Controls
• Runbooks & Rollback Procedures
• Evidence Review — What’s Real
• Control-to-Evidence Mapping
• Define Measurable Success Signals
• Scenario Modeling & Sensitivity Analysis
• Consequences Snapshot (preliminary)
• How Design Eliminates the Key Problems
• Operational Owners & Run Schedule
• Billing Governance & Reconciliation
• Acceptable Residual Risk & Compliance Gates
• Acceptance Criteria & Validation Points
• Data & Preconditions Missing
• Procurement & Spend Constraints
• Pilot Success Criteria & Measurement
• Decision & Contractual Next Steps
• Validation & Sign-off
• Alignment & Next Steps

• Provision FedRAMP-certified Compute Instances
• Deploy HITRUST-compliant Managed Database
• Create Isolated Compliance VPC with Network Controls
• Enable Default Encryption and Managed KMS
• Activate Audit Logging with Tamper-Evident Storage
• Provision PCI-DSS Hardened Payment Processing Environment
• Provision Managed Kubernetes Cluster with Compliance Defaults
• Configure Data Residency Controls and Regional Locking
• Provision Dedicated Hosts with FIPS 140-2 Modules
• Set Up Role-Based Access Boundaries with MFA
• Enable Transparent Egress Billing and Usage Alerts
• Provision Storage Tiering with Lifecycle Policies
• Deploy Managed AI Inference Service in Certified Region
• Provision Terraform Provider with Prebuilt Compliance Modules

Provision FedRAMP-certified Compute Instances

• Which FedRAMP impact level do your workloads require? Options: FedRAMP Low, FedRAMP Moderate, FedRAMP High, Unsure — need guidance
• What types of workloads will run on these instances (e.g., web tier, application servers, analytics)? List primary workload types and any special requirements.
• Estimate the expected instance footprint at launch (CPU cores and RAM per node) and anticipated scale over 12 months. Options: Small (<=8 vCPU), Medium (9-32 vCPU), Large (>32 vCPU), Custom — see details
• Do you require single-tenant / dedicated compute (hardware isolation) versus multi-tenant instances? Options: Dedicated hosts required, Shared tenancy acceptable, Mix of both
• What uptime or SLA targets must compute meet (percent uptime, RTO for critical services)? Options: 99.9%, 99.95%, 99.99%, Custom/Not sure
• Are there specific OS images, hardening standards (CIS, STIG), or baseline configurations we should apply? Options: CIS Benchmarks, DISA STIGs, Customer baseline (provide), Use provider default

Deploy HITRUST-compliant Managed Database

• Which database engines do you plan to use? Options: PostgreSQL, MySQL, Microsoft SQL Server, Oracle, Other
• What is the expected database size and IOPS profile at go‑live and projected 12 months out? Options: <100GB, 100GB-1TB, 1TB-10TB, >10TB, Unknown — need sizing
• Does the data include PHI or other HITRUST-sensitive categories that require special handling? Options: Yes — PHI, Yes — Other sensitive data, No, Unsure
• What RPO/RTO requirements do you have for the database (backup frequency, maximum acceptable data loss)? Options: RPO < 1 hour, RPO < 24 hours, RTO < 1 hour, RTO < 24 hours, Custom — specify
• Do you require customer-managed keys (BYOK) for DB encryption or provider-managed keys? Options: Provider-managed keys, Customer-managed KMS (BYOK), HSM-backed keys required, Unsure — discuss
• Are cross-region replication, read replicas, or analytics replicas required as part of the managed DB offering? Options: Cross-region replication, Read replicas, Analytics replicas, None

Create Isolated Compliance VPC with Network Controls

• What isolation model do you prefer for the VPC/network (per-application, per-environment, per-tenant)? Options: Per-application, Per-environment (prod/stage/dev), Per-tenant / dedicated VPC, Hybrid
• Which inbound/outbound connectivity patterns are required (Internet only, VPN, Direct Connect/PrivateLink, partner peering)? Options: Internet only, Site-to-site VPN, Dedicated private interconnect (Direct), Partner peering/private links
• Which network controls do you require by default (security groups, NACLs, stateful firewall, IDS/IPS, WAF)? Options: Security groups / microsegmentation, NACLs, Stateful firewall, IDS/IPS, WAF, All of the above
• Do you need explicit egress filtering or proxying for traffic leaving the VPC (e.g., approved outbound IPs, TLS inspection)? Options: Egress filtering required, Egress proxy required, No egress controls required
• Are private DNS, internal load balancers, and service discovery required within the isolated network? Options: Private DNS, Internal load balancers, Service discovery (Consul/ECS/K8s), None
• Do you require network segmentation proof (diagrams, segmentation tests) for auditors/regulators? Options: Yes — diagrams and test evidence, Yes — diagrams only, No

Enable Default Encryption and Managed KMS

• Do you require provider-managed keys, customer-managed keys (BYOK), or HSM-backed keys for encryption at rest? Options: Provider-managed, Customer-managed BYOK, HSM-backed (FIPS), Mix depending on data type
• Which assets must be encrypted by default (compute disks, databases, object storage, backup snapshots)? Options: Compute disk volumes, Managed databases, Object storage, Backups/snapshots, All of the above
• Do you require key rotation policies, dual-control for key deletion, or separation of duties for KMS admin roles? Options: Automatic rotation, Manual rotation, Dual-control for deletion, Separation of duties
• Are FIPS 140-2/140-3 validated cryptographic modules required for your environment? Options: Yes — FIPS 140-2/3 required, No, Unsure — need guidance
• Will keys be used across multiple regions or must keys be region-locked? Options: Region-locked keys, Multi-region keys allowed, Mix by data classification
• Do you require audit logging and exportable key usage reports for compliance reviews? Options: Yes — full audit trail, Basic logging only, No

Activate Audit Logging with Tamper-Evident Storage

• Which sources should forward logs by default (compute, databases, network devices, containers, IAM events)? Options: Compute, Databases, Network devices, Containers/K8s, IAM events, All of the above
• What retention period is required for audit logs for compliance (months/years)? Options: 90 days, 1 year, 3 years, 7+ years, Custom — specify
• Do you require tamper-evident/WORM storage and chain-of-custody evidence for stored logs? Options: WORM/tamper-evident required, Standard immutable snapshots sufficient, No special immutability required
• Do you need logs forwarded to an existing SIEM, or should we provide a hosted log analytics instance? Options: Forward to customer SIEM, Provide hosted SIEM/log analytics, Both
• What volume of logs (GB/day) do you estimate so we can size retention and storage tiers? Options: <1GB/day, 1-10GB/day, 10-100GB/day, >100GB/day, Unknown — need help estimating
• Which personnel should have access to audit logs and what RBAC restrictions are required?

Provision PCI-DSS Hardened Payment Processing Environment

• Does your environment handle cardholder data directly, or will a tokenization/third-party gateway be used? Options: Directly handles cardholder data, Tokenization/third-party gateway, Hybrid
• What PCI level / SAQ type do you expect to demonstrate (e.g., SAQ A, SAQ D)? Options: SAQ A, SAQ A-EP, SAQ D, Not sure — need assessment
• Are there required quarterly external vulnerability scans and annual penetration tests to include in scope? Options: Quarterly scans and annual pen-test required, Only scans required, No external testing required
• Which encryption and TLS requirements must be enforced for payment traffic? Options: TLS 1.2 minimum, TLS 1.3 required, Strong cipher suites only, Customer-specified
• Do you require segmentation evidence demonstrating separation of cardholder environment from other systems? Options: Yes — segmentation evidence, No
• Are there preferred WAF rulesets, fraud detection integrations, or payment gateways we must support?

Provision Managed Kubernetes Cluster with Compliance Defaults

• What Kubernetes control plane model do you prefer (managed control plane, self-managed, or hybrid)? Options: Fully managed control plane, Self-managed (customer-managed nodes), Hybrid
• What compliance defaults are required (network policies, Pod Security Standards, admission controllers, image scanning)? Options: Network policies enforced, Pod Security Standards enforced, Admission controllers/OPA/Gatekeeper, Image vulnerability scanning, All of the above
• Estimate cluster size (number of nodes) and expected pod density for initial migration. Options: Small (<=3 nodes), Medium (4-10 nodes), Large (>10 nodes), Unknown — need assessment
• Do you require private container registries with signed images and SBOM support? Options: Private registry with image signing, Public registry allowed, SBOM required, Not required
• What RBAC model and service account restrictions are required for operator/CI/CD access? Options: Strict RBAC with least privilege, Team-level roles, Admin access for ops, Custom — specify
• Do you need built-in backup/restore for cluster state and persistent volumes? Options: Yes — full backups, Snapshots only, No — customer handles backups

Configure Data Residency Controls and Regional Locking

• Which regions or countries must data remain in for residency/compliance reasons?
• Which data classes are subject to residency controls (PII, PHI, payment data, logs, backups)? Options: PII, PHI, Payment card data, Audit logs, Backups, All of the above
• Is cross-region replication or disaster recovery permitted if the destination is the same jurisdiction? Options: Allowed within same jurisdiction, Not permitted, Allowed with encryption and approval
• Do you require automated region-locking enforcement and drift detection for storage and databases? Options: Yes — automated enforcement, Audit-only (reporting), No enforcement required
• Are legal hold, e-discovery, or regulator access controls required for region-locked data? Options: Legal hold required, E-discovery required, Regulator access controls required, None
• What latency or locality constraints exist for users or systems accessing region-locked data? Options: Low latency required (<50ms), Moderate latency acceptable, Batch processing only, Unknown

Provision Dedicated Hosts with FIPS 140-2 Modules

• How many dedicated hosts are required at launch and what growth do you expect in 12 months? Options: 1-2 hosts, 3-10 hosts, 10+ hosts, Unknown — need estimation
• Do hosts need FIPS 140-2 validated crypto modules for all cryptographic operations? Options: Yes — FIPS 140-2 required, No, Partial — only for certain services
• Is single-tenant physical isolation mandatory for regulatory reasons, or is logical isolation sufficient? Options: Physical single-tenant required, Logical isolation sufficient, Hybrid
• What hardware profiles (CPU, RAM, GPU) and OS families are required on the dedicated hosts?
• Do you require provable attestation, telemetry, or certificates for host integrity to present to auditors? Options: Attestation/certificates required, Telemetry only, No attestation required
• Are maintenance windows and reboot policies constrained by regulatory commitments or business operations? Options: Yes — constrained windows, No — flexible, Requires prior approval per change

Set Up Role-Based Access Boundaries with MFA

• Which identity provider(s) will you integrate for SSO (Okta, Azure AD, ADFS, other)? Options: Okta, Azure AD, OneLogin, ADFS, Other
• Which MFA methods are acceptable for your organization (hardware token, TOTP, push, U2F/WebAuthn)? Options: Hardware token, TOTP (authenticator apps), Push notifications, U2F/WebAuthn, Other
• How many distinct roles or access boundaries are required (e.g., dev, ops, security, auditors)? Options: 1-2, 3-5, 6-10, 10+
• Do you require just-in-time privileged access, approval workflows, or session recording for privileged sessions? Options: Just-in-time access, Approval workflows, Session recording, None
• Are break-glass procedures and emergency access controls required and who should own them? Options: Yes — defined break-glass, No, Unsure — need help defining
• Do auditors or third parties need read-only access to specific logs or resources? Options: Yes — auditors need access, No, Only via time-limited access

• Statement of Work (SOW)
• Master Services Agreement (MSA)
• Committed Spend & Pricing Annex
• Billing, Invoicing & Payment Terms
• Egress & Data Transfer Addendum
• Storage Tiering & Retention Addendum
• Service Level Agreement (SLA)
• Data Processing Agreement (DPA)
• Security & Penetration Test Addendum
• Compliance Evidence & Certification Appendix
• Acceptance Criteria & Go‑Live Checklist
• Reserved Capacity & Allocation Schedule
• Implementation & Migration Plan
• Change Order & Scope Amendment Process
• Data Return, Deletion & Offboarding Agreement
• Governance, Escalation & QBR Cadence
• Legal & Regulatory Contact Annex
• Signature & E‑Sign Execution

• Success Review & Validation
• Estate Consolidation & Next-Migration Planning
• Committed Spend & Cost Optimization Review
• Operational Rhythm: Issues, Enhancements & Shared Channel Governance
• Quarterly Success Steering (Executive Review)

• Provision the shared channels, add initial members and post the triage matrix and runbook links.
• Ensure capacity and cost implications are modeled for committed-spend planning.
• Surface high-risk migrations requiring additional validation or pilot activity.
• Publish the wave plan as a living artifact with owners, dates, acceptance criteria, and runbook links.
• Perform PoC/pilot for any top-risk workload identified before scheduling full migration.
• Update committed-spend forecast to reflect reserved capacity or tier changes required by planned waves.
• Spend vs Commitment Summary
• Reconcile committed spend and confirm any required adjustments or additional purchases.
• Identify immediate cost-reduction actions that do not compromise compliance or availability.
• Agree on financial owner actions and timeline for implementing optimizations.
• Deliver a detailed cost report with recommendations and estimated savings for each optimization.
• Execute agreed reserved capacity purchases or contract amendments via procurement.
• Track and report savings in the next success review cycle.
• Shared Channel Purpose & Access
• Create a single source-of-truth shared channel with clear access, triage, and escalation rules.
• Define SLAs and owners to reduce time-to-resolution for incidents.
• Establish a repeatable enhancement intake and prioritization process tied to business and compliance value.
• Introductions & Purpose
• Populate the enhancement backlog with initial candidate items and score them for prioritization.
• Schedule recurring triage and grooming meetings and publish the cadence to stakeholders.
• One-sentence Current State
• Secure executive approval for the next migration waves and any committed-spend changes.
• Align senior stakeholders on strategic priorities, risk acceptances, and reporting expectations.
• Ensure funding and procurement path is clear for proposed expansions.
• Produce an executive one-pager summarizing KPIs, risks, proposed waves, and decision requests.
• Obtain formal sign-off on budget/commit changes and document procurement actions.
• Schedule the next quarterly steering meeting and assign a dashboard owner for monthly updates.
• Demonstrate evidence that each agreed success signal has been met or document precise remediation required.
• Obtain customer validation and formal acceptance (or a documented remediation plan with owners and deadlines).
• Identify and prioritize any critical residual risks that block broader estate migration.
• Deliver a packaged acceptance artifact set (metrics, logs, compliance evidence) for archiving and audit.
• Create remediation tickets with owners, SLAs, and verification steps for unmet success signals.
• Schedule follow-up validation meeting aligned to remediation completion dates.
• Inventory Snapshot & Dependencies
• Produce an agreed prioritized migration backlog (waves) with owners and acceptance criteria for each wave.
• Egress, Storage & Tiering Analysis
• Prioritization Criteria
• KPIs & Success Signals Review
• Triage Workflow & Severity Matrix
• Current State (one-sentence)
• Strategic Opportunities & Risks
• Outcome Metrics & Evidence
• Wave Definition & Templates
• Reserved Capacity & Discount Opportunities
• Response & Resolution SLAs
• Cost & Capacity Modelling per Wave
• Recommended Next-Wave Investments
• Enhancement Backlog Process
• Consequence Assessment
• Quick Wins & Optimization Roadmap
• Gaps, Remediations & Timeline
• Decisions & Approvals
• Forecast & Contract Implications
• Timeline, Windows & Owners
• Meeting Cadence & Reporting
• Acceptance Decision & Sign-off Criteria
• Finance & Procurement Next Steps
• Runbooks, Playbooks & Tooling Links
• Risk Register & Mitigation
• Governance & Reporting Cadence