{"id":20075,"date":"2023-09-14T18:18:52","date_gmt":"2023-09-14T12:48:52","guid":{"rendered":"https:\/\/www.cigniti.com\/blog\/?p=20075"},"modified":"2023-09-15T15:29:37","modified_gmt":"2023-09-15T09:59:37","slug":"three-steps-assure-cloud-migration-success-detailed-assessment","status":"publish","type":"post","link":"https:\/\/www.cigniti.com\/blog\/three-steps-assure-cloud-migration-success-detailed-assessment\/","title":{"rendered":"3 Steps to Assure Cloud Migration Success: A Detailed Assessment"},"content":{"rendered":"
[vc_row][vc_column][vc_column_text]Gartner predicts that by 2026, 75% of organizations will adopt a digital transformation model predicated on the cloud as the fundamental underlying platform.<\/em> [Source: Garner Press Release: April 19, 2023]<\/span><\/p>\n Every organization has a cloud strategy and vision with annual goals, yet the business risky cloud migrations have aged in backlogs or implemented with straying budgets & timelines. \u2018Assurance\u2019 is the most critical factor in business readiness, scoping, budgeting, and concluding the cloud migration. It is either underplayed in programs or overdone, with significant wait times at multiple check gates. These approaches lean on value in the overall enterprise cloud migration\/adoption journey.<\/p>\n The checks and compliance for the system(s) to be migrated, cut across different teams, roles, levels & vendors with every-clashing priorities. The assurance state must be traceable to a report\/dashboard, and leadership can trigger at any stage of the project \u2013 pre \/ at \/ post-migration. The blog below describes a detailed cloud migration assurance assessment approach.<\/p>\n The objective of the assessment is not to blame any team or role but to identify ways to improve quality across migration activities to assure \u2018Business Stakeholders\u2019 on migration success.<\/em><\/p>\n Motto – All gaps will be treated as process gaps<\/em><\/p>\n Project-Level Assurance:<\/strong><\/p>\n It is essential to start the assessment by understanding the organization’s approach & facilitation to implement standard project delivery. Assess the completeness & clarity of the project approach.<\/p>\n Below are topics grouped under standard categories \u2013 Tools, People, and Processes.<\/p>\n Additionally, depending on the assessment duration & migration progress, there are specific assurance practices that can be pursued in-depth at a particular project phase (Pre-Migration, At Migration, and Post Migration). Though the assessment covers all areas for analysis, a few touchpoints are more effective at a particular phase in the project.<\/p>\n Completing the data analysis across the above areas will help qualify an organization’s assurance on the approach for cloud migration at the project level. During Cigniti\u2019s Cloud Assurance engagements, we found significant gaps across project planning & governance more frequently.<\/p>\n The technical cloud migration assessment is addressed in this step. Though called upon at a high level in previous steps, the detailed sub-focus areas presented below point to the direction a consultant can probe & explore to gather insights.<\/p>\n Start with a quick check on the cloud architecture approach & documentation for both Prod and non-prod environments:<\/p>\n Then, an assurance deep-dive on critical areas: Security, Data, Performance, and Verification and validation<\/em>.<\/p>\n A consultant can ask the below questions to gain assurance perspective for each area:<\/p>\n Q1) Has the selected <area> recognized, documented, reviewed, and approved by relevant stakeholders?<\/p>\n Q2) What state of implementation is the team currently in \u2013 Not yet implemented \/ Partially implemented \/ Blocked \/ Implemented \/ Not Applicable<\/p>\n Q3) What is the approach to validate\/verify the? <area> Who is responsible and accountable?<\/p>\n Q4) Can the team generate a report on the <area> quality assurance aspects with any quantifiable metric or KPI?<\/p>\n<\/div>\n The consultant will gather raw findings data by gathering inputs via documentation reviews, team & individual discussions, tool walkthroughs & metric reports analysis.<\/p>\n By categorizing & prioritizing these findings, the consultant arrives at critical gaps & necessary recommendations. A readiness\/maturity score can be calculated by scoring individual questions & areas with weightage, which helps quantify the migration against a numerical baseline.<\/p>\n <\/p>\n Categorizing recommendations can be done in many ways:<\/p>\n Core Aspects of a Final Report:<\/strong><\/p>\nStep 1 – Planning & Expectations:<\/h2>\n
\n
Step 2 – Understand & Assess:<\/h2>\n
\n\n
\n Tools & Automation<\/strong><\/td>\n <\/td>\n People Operations<\/strong><\/td>\n <\/td>\n Standard Process<\/strong><\/td>\n<\/tr>\n \n Lifecycle Management<\/strong><\/td>\n Requirements<\/td>\n <\/td>\n Teams & Departments<\/strong><\/td>\n Roles & Responsibilities<\/td>\n <\/td>\n Vision<\/strong><\/td>\n Goals \/ Objectives<\/td>\n<\/tr>\n \n Development<\/td>\n <\/td>\n Cross-team RACI<\/td>\n <\/td>\n Key Results \/ KPIs<\/td>\n<\/tr>\n \n Testing<\/td>\n <\/td>\n Vendor Management<\/td>\n <\/td>\n Epics & backlogs<\/td>\n<\/tr>\n \n Operations<\/td>\n <\/td>\n Communication Channels<\/strong><\/td>\n Escalations<\/td>\n <\/td>\n Methodology<\/strong><\/td>\n Project Methodology<\/td>\n<\/tr>\n \n Code pipelines<\/td>\n <\/td>\n Progress<\/td>\n <\/td>\n Planning & Demand<\/td>\n<\/tr>\n \n Test Automation<\/strong><\/td>\n Unit<\/td>\n <\/td>\n Audit & Compliance<\/td>\n <\/td>\n User Story Management<\/td>\n<\/tr>\n \n Integrations<\/td>\n <\/td>\n Risk management<\/td>\n <\/td>\n Delivery Execution<\/td>\n<\/tr>\n \n Systems<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Monitoring & Control<\/td>\n<\/tr>\n \n End-to-End<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Release Management<\/td>\n<\/tr>\n \n Security<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Change Management<\/td>\n<\/tr>\n \n Performance<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Retrospective<\/td>\n<\/tr>\n \n Reporting<\/strong><\/td>\n Dashboards<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Assurance<\/strong><\/td>\n Strategy & Plan<\/td>\n<\/tr>\n \n Alerts<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Design – types & levels<\/td>\n<\/tr>\n \n Monitoring<\/strong><\/td>\n Non-Production<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Execute – progress & control<\/td>\n<\/tr>\n \n Production<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Data & Environment<\/td>\n<\/tr>\n \n Documentation<\/strong><\/td>\n All above<\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Defects & Incidents<\/td>\n<\/tr>\n \n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Governance<\/strong><\/td>\n Metrics, SLAs, KPIs<\/td>\n<\/tr>\n \n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Reporting analytics<\/td>\n<\/tr>\n \n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Risk management<\/td>\n<\/tr>\n \n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Config management<\/td>\n<\/tr>\n \n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n <\/td>\n Knowledge management<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\nExample<\/em>: People & Operations<\/span> – Analyzing different teams across departments, individual roles for gaps in responsibilities in quality ownership, RACI matrix on accountability across teams with other priorities. The communication channels for transparent & compliant workflows which can be audited. Team’s knowledge of how different changes, risks, and escalations are handled.<\/p>\n\n\n
\n Pre-Migration<\/strong><\/td>\n <\/td>\n At-Migration<\/strong><\/td>\n <\/td>\n Post-Migration<\/strong><\/td>\n<\/tr>\n \n Migration Plan<\/strong><\/td>\n Approach & Business Outcome<\/td>\n <\/td>\n Monitor & Alerts<\/strong><\/td>\n Effort & Schedules<\/td>\n <\/td>\n Assurance<\/strong><\/td>\n Functional – feature, regression, etc.<\/td>\n<\/tr>\n \n Lifecycle of migration<\/td>\n <\/td>\n Resiliency – Infra, Network failover, etc.<\/td>\n <\/td>\n Non-Functional – security, perf, data<\/td>\n<\/tr>\n \n Quantifiable KPIs – Costs, ROI, etc.<\/td>\n <\/td>\n System Health<\/td>\n <\/td>\n Business – workflows, user experience<\/td>\n<\/tr>\n \n Risk & compliance<\/td>\n <\/td>\n Risk & mitigation plan<\/td>\n <\/td>\n Monitoring<\/strong><\/td>\n Performance<\/td>\n<\/tr>\n \n Readiness Assessment<\/strong><\/td>\n Cloud Strategy – E2E<\/td>\n <\/td>\n Quality<\/strong><\/td>\n In-flight validations<\/td>\n <\/td>\n Security<\/td>\n<\/tr>\n \n Security & Perf – roadmap, tools, assurance, metrics<\/td>\n <\/td>\n Data aggregations<\/td>\n <\/td>\n Data<\/td>\n<\/tr>\n \n Change & release management<\/td>\n <\/td>\n Functional testing<\/td>\n <\/td>\n Tools & Auto-scanners<\/td>\n<\/tr>\n \n <\/td>\n <\/td>\n <\/td>\n Security Compliance<\/td>\n <\/td>\n Fin-Ops<\/strong><\/td>\n Reports<\/td>\n<\/tr>\n \n <\/td>\n <\/td>\n <\/td>\n Quantity<\/strong><\/td>\n Workload sizing<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n \n <\/td>\n <\/td>\n <\/td>\n Data volume & batch<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n \n <\/td>\n <\/td>\n <\/td>\n Synchronization times<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n \n <\/td>\n <\/td>\n <\/td>\n Compression & encryption<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n \n <\/td>\n <\/td>\n <\/td>\n Tools<\/strong><\/td>\n Reusable framework(s)<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\nRationale<\/em>: During the pre-migration phase, the team cannot provide data on synchronization times \/ Pen-testing reports \/ Performance actuals. Similarly, post-migration, the readiness report is not a checkpoint, but a Fin-Ops report is more valuable & monitored daily.<\/p>\nArchitecture Level Assurance:<\/h2>\n
\n
\n\n
\n Security\u00a0<\/strong><\/td>\n <\/td>\n Data<\/strong><\/td>\n<\/tr>\n \n Approach<\/strong><\/td>\n Lifecycle<\/td>\n <\/td>\n Storage<\/strong><\/td>\n Types & volume<\/td>\n<\/tr>\n \n NFRs & Use Cases<\/td>\n <\/td>\n Locations – constraints, etc.<\/td>\n<\/tr>\n \n Audit & Governance KPIs<\/td>\n <\/td>\n Policies & lifecycle<\/td>\n<\/tr>\n \n IAM<\/strong><\/td>\n Access Matrix – privileges, personas, etc.<\/td>\n <\/td>\n Disaster Recovery<\/td>\n<\/tr>\n \n Automation<\/td>\n <\/td>\n Quality<\/strong><\/td>\n Accuracy – Dirty data, Sync, etc.<\/td>\n<\/tr>\n \n ITSM<\/td>\n <\/td>\n Completeness – data checks, fallback, etc.<\/td>\n<\/tr>\n \n Infrastructure<\/strong><\/td>\n Hardware & software, Platforms, etc.<\/td>\n <\/td>\n Integrity – aggregations, referential, etc.<\/td>\n<\/tr>\n \n Environments – IAC, VMs, Gateways, etc.<\/td>\n <\/td>\n Consistency – profiling, conventions, etc.<\/td>\n<\/tr>\n \n Network<\/strong><\/td>\n Boundary – VPC, Zones, Firewalls, etc.<\/td>\n <\/td>\n Precision – truncations, etc.<\/td>\n<\/tr>\n \n Hardening<\/td>\n <\/td>\n Governance – automation, schedule, etc.<\/td>\n<\/tr>\n \n Integrations<\/td>\n <\/td>\n Warehouse<\/strong><\/td>\n Architecture – layers, schema, procedures, etc.<\/td>\n<\/tr>\n \n Traffic Monitoring<\/td>\n <\/td>\n Integration – ingestion, messaging, etc.<\/td>\n<\/tr>\n \n Logging<\/td>\n <\/td>\n Tools – pipelines, analytics, etc.<\/td>\n<\/tr>\n \n Data<\/strong><\/td>\n Encryptions<\/td>\n <\/td>\n Transformation<\/strong><\/td>\n Queries – types, perf, refresh, etc.<\/td>\n<\/tr>\n \n Backups<\/td>\n <\/td>\n Automation – masking, etc.<\/td>\n<\/tr>\n \n Tools<\/strong><\/td>\n Continuous Testing<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n \n Vulnerability scans<\/td>\n <\/td>\n Performance<\/strong><\/td>\n<\/tr>\n \n Threat management<\/td>\n <\/td>\n System & Network Assurance<\/strong><\/td>\n SLAs & Baselines<\/td>\n<\/tr>\n \n Patch management<\/td>\n <\/td>\n Resiliency, Reliability & Responsiveness<\/td>\n<\/tr>\n \n Container scans<\/td>\n <\/td>\n Availability, Scalability & Latency<\/td>\n<\/tr>\n \n Analytics & notifications<\/td>\n <\/td>\n Concurrency, Redundancy & Replication<\/td>\n<\/tr>\n \n <\/td>\n <\/td>\n <\/td>\n Disaster Recovery<\/td>\n<\/tr>\n \n Verification & Validation<\/strong><\/td>\n <\/td>\n Bandwidth & iOPs<\/td>\n<\/tr>\n \n Quality Engineering<\/strong><\/td>\n Requirements<\/td>\n <\/td>\n Automation<\/strong><\/td>\n Allocations – Compute, Storage, etc.<\/td>\n<\/tr>\n \n Design techniques<\/td>\n <\/td>\n Alerts & limits<\/td>\n<\/tr>\n \n Test cases – Interoperability, config, etc.<\/td>\n <\/td>\n Cost<\/td>\n<\/tr>\n \n Coverage & Traceability<\/td>\n <\/td>\n Integrations<\/strong><\/td>\n Connections & downstream, etc.<\/td>\n<\/tr>\n \n Monitoring<\/strong><\/td>\n Analytics – models, predictions, real-time, etc.<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n \n FinOps – Trends, Permissions, etc.<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
\nExample: Data Assurance<\/em> – Under the \u2018Storage\u2019 area, analyze assurance practices for different types of data & sizes – check for data storage policies, data lifecycle & archiving strategy, data structures & their encryption strategy, and lastly, data at rest & transit.<\/p>\nStep 3 \u2013 Assurance Outcome<\/h2>\n
\n
\n
Conclusion<\/h2>\n