Cloud Readiness Assessment Checklist: Is Your Business Ready to Move?

Many owners come to the cloud question having already decided to go. A server is aging out, a lease is ending, or staff want to work from anywhere. That’s fine, but deciding to go and being ready to go are different things, and the gap between them is where migrations get expensive. This checklist sits alongside our guide to cloud migration services for Ontario businesses.

I’m Adam Bowles, Partner and CEO at ACT360. Below: what a readiness assessment is and how it differs from a migration checklist, the ten areas it covers, the questions to ask your software vendors, where your data will live, how to score the results, and what to do when the answer is “not yet.”

A cloud readiness assessment is a structured review of your business, systems, data, security and contracts that tells you whether you’re ready to move to the cloud, what needs fixing first, and which systems shouldn’t move at all.

It comes before the migration plan, not inside it. A cloud migration checklist assumes the decision is made and walks through how to move: inventory, approach, rollback, validation. A readiness assessment asks the earlier questions. Why are we doing this? Will our software work there? Is our internet up to it? Who is accountable for the data once it’s in someone else’s data centre?

It’s a common decision to get to. Statistics Canada’s Survey of Digital Technology and Internet Use found cloud computing was the most commonly used information and communication technology among Canadian businesses in 2023, at 48%. Common doesn’t mean simple, though. The questions in this checklist are cheap to answer before a move and expensive to answer after one.

A complete assessment covers ten areas: the business reason, systems and applications, vendor support, internet, identity and security, data, backup and recovery, contracts and exit terms, people, and budget. Each one gets a clear ready, fix-first or stop result.

It’s normal for several areas to come back fix-first. Watch especially for integrations nobody remembered and vendors whose cloud version is priced differently. Both are easier to deal with now than in the week after cutover.

Ask each software vendor whether the version you run is supported in the cloud, how licensing changes, what it connects to, and what a move would cost. Get the answers in writing, because they decide what moves and when.

1. Is our version supported in the cloud, on Microsoft Azure or as the vendor’s own hosted service? Some older versions are supported only on a local server.
2. Does the licence change? Moving from a perpetual licence to a subscription can change the monthly cost a lot.
3. What does it connect to? Accounting exports, scan-to-folder, email, a client portal, a payroll file. Each connection has to keep working after the move.
4. Who does the move, the vendor, your IT partner, or both, and what does the vendor charge for it?
5. Can we get all our data out later, in a usable format, if we change products?

The dependency question is the one that bites. Microsoft’s Cloud Adoption Framework guidance on assessing workloads for migration says to identify all external dependencies and catalog upstream and downstream integrations, and to validate the results with people who know the system, because automated tools miss undocumented ones.

Timing matters too. Windows Server 2016 reaches the end of extended support on January 12, 2027, according to Microsoft’s lifecycle page. If that’s what your applications run on, the vendor conversation can’t wait until next year.

Usually not as ready as people assume. Once email, files and applications live in the cloud, your internet connection becomes the front door to all of them, and every account becomes a target that’s reachable from anywhere.

Start with the connection. Measure what the office uses today, especially upload, which backups and file sync depend on. Then decide what happens when it drops: a second connection from a different provider, with a firewall that switches over on its own, is the usual answer for an office that can’t stop working.

Then look at accounts. Microsoft’s shared responsibility model is direct about what stays with you whatever you buy: your data, the devices that connect to your cloud services, your user accounts, and access management, including multifactor authentication and conditional access. The provider secures its data centre. It doesn’t secure a shared password on your front desk computer.

• MFA on every account, with no exceptions for the owner or the shared reception login.
• Admin accounts kept separate from daily-use accounts, and as few of them as possible.
• Former staff and old service accounts removed before anything moves, not after.

If any of this is shaky, fix it first. Our cybersecurity services usually start exactly here, because a cloud move done on top of weak accounts just moves the weakness somewhere easier to reach.

Your business stays accountable for its data wherever it’s stored. Before you move, know what data you hold, whether any of it has to stay in Canada, and what your contract says about location, access and getting it back.

The Canadian Centre for Cyber Security puts it plainly in its guidance on the benefits and risks of cloud services: cloud providers are responsible for the security of the cloud, and your organization is accountable for securing what you put in it. The same guidance says your organization is responsible for making sure the provider meets your data residency requirements, and lists getting locked in to a cloud service as a risk to weigh.

Privacy law points the same way. The Office of the Privacy Commissioner’s guidelines for processing personal data across borders explain that an organization that hands personal information to a service provider stays responsible for it, and has to use contracts or other means to keep a comparable level of protection.

For Microsoft 365, location is something you can confirm. Microsoft’s Product Terms data residency commitments say that for a tenant provisioned in Canada, core customer data at rest, including Exchange mailboxes, SharePoint and OneDrive files, and Teams chats, is stored in Canada. Other services and add-ons can differ, so check each one you plan to use.

Contracts deserve a careful read. The Cyber Centre’s recommended contract clauses for cloud services note that some services and data centres may not be in Canada, and suggest asking about charges for moving data in and out. Ask those questions before you sign, while you still have leverage.

Mark each of the ten areas ready, fix first, or stop. Any stop means you don’t start yet. Fix-first items can be worked on in parallel with planning. When everything is ready or fixed, you have a business that can move.

Typical fix-first items are MFA gaps, an untidy file share, or a missing second internet connection. Typical stops are an unsupported line-of-business application, data you’re not allowed to move without client consent, or a contract that won’t let you take your data with you.

“Not yet” is a legitimate answer. A 35-person commercial painting contractor came to us with a failing server and a $60,000 replacement quote. The assessment turned up a planned ERP replacement that would take its Sage accounting system off-premise within a couple of years, so moving it to the cloud now would have meant migrating it twice. We sized a $25,000 bridge server, including installation and migration, and built the plan around the ERP timeline. The painting contractor case study has the details.

Once the assessment says you’re ready, it becomes the input to a phased migration plan: what moves first, what waits, what stays, and how you’d roll back each step if something goes wrong.

The low-risk systems usually go first: email, calendars and Teams, then files once permissions are cleaned up. Line-of-business applications and servers come later, with the vendor involved. Our cloud migration checklist for Ontario businesses covers that planning in order, and plants with machines on the floor should also read our guide to cloud migration for manufacturing in Ontario.

The assessment also tells you what the work involves. When an Ontario law firm moved off a vendor-locked Remote Desktop Services setup to Microsoft Azure, we found data bleed-through between client files and years of accumulated group policy causing instability. Fixing those was part of the project, and afterward documents that had taken 3 to 5 minutes to open opened immediately. The law firm cloud migration case study covers the project. Problems like these are far cheaper to find in an assessment than during a cutover weekend.

We use the Assess and Comprehend steps of our ACTION approach. That means looking at what you have and how it performs, then understanding how the business works and where it’s headed, before recommending anything. The output is a plain-language list of what’s ready, what needs fixing, and anything we’d advise you not to move yet, with the reasons.

We’re based in Barrie, and our page on cloud migration services in Barrie covers how we work with businesses across Simcoe County. Wherever you are in Ontario, the approach is the same: understand the business first, then decide what the technology should do.

A cloud readiness assessment is the cheapest part of a cloud move and the easiest one to skip. Check the ten areas, be honest about the stop signs, and let the results decide the order of the work. If the answer is “not yet,” that’s money saved, not time lost.

If you’d like a second opinion before you commit, our free IT Readiness Assessment is a 30-minute review of your servers, applications, internet, security and plans, with a short list of what to fix first. You can also call 705-739-2281 or email [email protected].