Checklists you can run today.

Four phases — assess, plan, migrate, operate — with the decisions that keep a migration to weeks instead of years.

• Inventory every application, server and integration — including the undocumented ones
• Decide per app: rehost, replatform, replace with SaaS, or retire
• Choose the region deliberately — in-country options cover data-residency requirements
• Design the landing zone, identity (SSO + MFA) and connectivity before anything moves
• Set RTO/RPO targets and build backup + disaster recovery to meet them
• Pilot one low-risk workload end to end, then migrate in dependency waves
• Tag every resource for cost from day one and review the bill monthly

When something goes wrong, panic costs time and time costs money. Write this one page now, keep a copy offline.

• Who to call — the response owner, IT lead, management and legal, with phone numbers
• How to isolate a machine or account without destroying evidence
• Where the backups are, and the tested steps to restore them
• Which systems get priority when bringing things back online
• What to tell staff and customers — and who is authorised to say it
• When and how to notify the regulator of a qualifying data breach
• The post-incident review: what happened, what closed the gap, what changed