AWS Workload Foundations Assessment

Know what your workload needs before you scale or migrate it.

We assess one workload against the AWS foundations it depends on, then give you a prioritised path to a secure, resilient and maintainable outcome.

Book a qualification call

A paid, fixed-scope engagement. We agree the deliverables, schedule and fixed fee after a qualification call, before work begins.

One workload · Architecture and control review · A decision you can act on

Who this is for

You may be preparing a workload for AWS, planning to modernise one that already runs there, or questioning whether its current foundation can support the next stage of growth. The assessment gives a technology or platform leader a grounded decision before committing to a migration, expansion or remediation programme.

We focus on one workload and the accounts, services and integrations it relies on. Where shared infrastructure affects that workload, we trace the dependency and its owner rather than treating an entire landing zone as part of the assessment.

What you receive

A workload and dependency map

We document the workload’s main components, data flows, account boundaries and external dependencies. For a migration candidate, the map includes the current environment and the AWS decisions that remain open. For an existing AWS workload, it describes how the service runs today.

Prioritised findings

We assess the controls and operational capabilities that matter to this workload: identity and access, network boundaries, data protection, logging, recovery, deployment and cost visibility. You receive prioritised findings with the business impact, dependencies and owner of each recommended action.

A recommended target pattern

We set out the architecture and operating changes needed to proceed safely, with alternatives where the right choice depends on cost, risk or delivery effort. The recommendation distinguishes improvements that are prerequisites from those that can follow a first release.

An executive decision and delivery plan

You receive a proceed, remediate or reshape recommendation, a sequenced plan and an indicative effort and cost range with its assumptions. We review it with the sponsor and the people who will own the workload.

The assessment establishes a plan for one workload; it does not implement the changes or promise a particular saving.

How the assessment works

Stage	What we do	What you take away
Discover	Agree the workload, intended outcome, stakeholders and evidence available	A bounded assessment scope and information request
Examine	Review architecture, configuration and operating practices with the relevant teams	A workload map and prioritised findings
Design	Compare the viable target patterns and sequence the required controls	A recommended architecture and delivery path
Decide	Walk through trade-offs, effort, cost and ownership	An executive decision brief and next steps

Your team provides a workload owner, relevant platform and security contacts, architecture or operational documentation, and access to agreed evidence. Read-only AWS access may help where the workload already runs on AWS; we agree the minimum access needed during qualification. We do not ask for credentials or sensitive records in the initial enquiry.

The foundation we examine

• Identity and network boundaries: who and what can reach the workload, including cross-account paths and administrative access.
• Data and protection: where information lives, how it is encrypted, backed up and recovered, and which retention decisions need an owner.
• Resilience and operations: failure modes, observability, deployment and patching responsibilities, and recovery objectives.
• Cost and capacity: the available usage and spend baseline, scaling decisions and opportunities to reduce avoidable running time.

We review the controls in the context of the workload’s purpose. A diagram alone cannot establish that a boundary works; the findings distinguish configured controls from behaviour that needs verification.

Delivery in practice

The AWS engineering sandbox case study shows how account and network boundaries shape a usable development environment. The assessment applies the same architectural and security reasoning to the workload you need to run or migrate, with its own evidence and owners.

Scope and commercial terms

• Fixed fee after qualification. We agree the workload, evidence, participants, deliverables, schedule and fee before work begins.
• One workload. A portfolio review or a full landing-zone redesign needs a separate scope.
• One consolidated feedback round. Your team brings its comments together for review against the agreed deliverables.
• Implementation is separate. Migration, remediation, configuration changes and ongoing operations are not standard assessment deliverables.
• Specialist assurance is separate. Penetration testing, formal compliance certification and a guarantee of security are not part of this assessment.

You can use the recommendation with your own team or another delivery partner. There is no obligation to commission implementation with us.

Questions before you start

Do we need to be on AWS already?

No. We can assess an existing AWS workload or a workload being prepared for migration. The evidence and target-pattern work differ, so we agree the approach during qualification.

Will you change production systems?

The standard engagement reviews agreed evidence and produces a decision and plan. It does not make production changes. Any hands-on validation or implementation needs its own scope and approvals.

Can you assess our whole cloud estate?

This package focuses on one workload and the foundations it depends on. If you need a portfolio-wide assessment, we can scope that separately after understanding the estate and the decision you need to make.