IT Perfection · Calculators

Free Cloud Migration Calculator

Cloud Migration Calculator from IT Perfection helps business owners, IT managers, and technical teams review workloads, licensing, connectivity, support and related operational risk.

Created by Ali Hassani, CISO - 25+ years of IT, cybersecurity, compliance, Microsoft infrastructure, network security, and IT operations experience.

Start Free AssessmentSchedule IT ReviewLearn About Ali Hassani

Assessment overview

What this tool reviews

Cloud Migration Calculator from IT Perfection helps business owners, IT managers, and technical teams review workloads, licensing, connectivity, support and related operational risk.

The scorecard is built for business owners, IT managers, and administrators who need to confirm evidence quality, access boundaries, logging coverage, exception status, and remediation priority before a project, audit, renewal, or support review.

Important disclaimer

This tool is for initial guidance only and does not replace a professional cybersecurity audit, compliance assessment, penetration test, architecture review, or legal/compliance review.

Interactive scorecard

Cloud Migration Calculator scorecard

Answer each item using available configuration records, access lists, logs, ticket history, screenshots, backup evidence, or vendor console data. Results are calculated locally in the browser and are not submitted to IT Perfection.

1. Workloads

Review workloads design, evidence location, control ownership, and recurring validation records. Evidence to review: collect invoices, tenant license assignments, Azure cost exports, project backlog, utilization metrics, and business impact assumptions.

Do the records for workloads identify the control owner, approved baseline, evidence location, and most recent validation date?

Review guidance, technical context, and business impact
Why it matters

Workloads must be traceable to an approved configuration, named owner, and dated validation record. Without that evidence, teams cannot prove the control is configured as intended or determine whether exceptions are still justified. Review evidence for license utilization, reserved capacity, consumption forecast, run-rate variance, TCO, labor load, downtime model, migration dependency.

Business impact

Weak workloads controls can leave stale access, unmonitored changes, unsupported assets, or untested recovery paths in production. The result is longer triage time, weaker audit evidence, and higher remediation cost. It can increase remediation cost and delay recovery.

What Workloads are

Workloads are the cloud migration calculator control area that defines expected configuration, ownership, supporting evidence, and review cadence. A reviewer should be able to confirm the current state from system exports, admin-console settings, monitoring records, tickets, and maintained documentation. For workloads, the relevant evidence usually includes collect invoices, tenant license assignments, Azure cost exports, project backlog, utilization metrics, and business impact assumptions. Review the related license utilization, reserved capacity, consumption forecast, run-rate variance, TCO, labor load, downtime model, migration dependency, then confirm which systems or users are affected, which logs prove the control is operating, and how exceptions are approved, tracked, and revisited. Common review sources include Microsoft 365 billing, Azure Cost Management, finance reports, PSA/ticketing reports, capacity dashboards, spreadsheet model.

2. Licensing

Cost, compliance, and operational coverage alignment for service plans. Evidence to review: collect invoices, tenant license assignments, Azure cost exports, project backlog, utilization metrics, and business impact assumptions.

Can the team prove that licensing matches the intended configuration and was reviewed after material changes?

Review guidance, technical context, and business impact
Why it matters

Licensing must be traceable to an approved configuration, named owner, and dated validation record. Without that evidence, teams cannot prove the control is configured as intended or determine whether exceptions are still justified. Review evidence for license utilization, reserved capacity, consumption forecast, run-rate variance, TCO, labor load, downtime model, migration dependency.

Business impact

Weak licensing controls can leave stale access, unmonitored changes, unsupported assets, or untested recovery paths in production. The result is longer triage time, weaker audit evidence, and higher remediation cost. Risk increases when ownership, evidence, or exceptions are not documented.

What Licensing is

Licensing is the operating area where policy, configuration, monitoring, and support records need to agree with the actual environment. A reviewer should be able to confirm the current state from system exports, admin-console settings, monitoring records, tickets, and maintained documentation. For licensing, the relevant evidence usually includes collect invoices, tenant license assignments, Azure cost exports, project backlog, utilization metrics, and business impact assumptions. Review the related license utilization, reserved capacity, consumption forecast, run-rate variance, TCO, labor load, downtime model, migration dependency, then confirm which systems or users are affected, which logs prove the control is operating, and how exceptions are approved, tracked, and revisited. Common review sources include Microsoft 365 billing, Azure Cost Management, finance reports, PSA/ticketing reports, capacity dashboards, spreadsheet model.

3. Connectivity

Review connectivity design, evidence location, control ownership, and recurring validation records. Evidence to review: collect invoices, tenant license assignments, Azure cost exports, project backlog, utilization metrics, and business impact assumptions.

Are exceptions, ownership, monitoring records, and response evidence for connectivity documented well enough for audit or incident response?

Review guidance, technical context, and business impact
Why it matters

Connectivity must be traceable to an approved configuration, named owner, and dated validation record. Without that evidence, teams cannot prove the control is configured as intended or determine whether exceptions are still justified. Review evidence for license utilization, reserved capacity, consumption forecast, run-rate variance, TCO, labor load, downtime model, migration dependency.

Business impact

Weak connectivity controls can leave stale access, unmonitored changes, unsupported assets, or untested recovery paths in production. The result is longer triage time, weaker audit evidence, and higher remediation cost. Risk increases when ownership, evidence, or exceptions are not documented.

What Connectivity is

Connectivity is the technical and administrative control set used to prove this part of the environment is configured, maintained, and reviewed. A reviewer should be able to confirm the current state from system exports, admin-console settings, monitoring records, tickets, and maintained documentation. For connectivity, the relevant evidence usually includes collect invoices, tenant license assignments, Azure cost exports, project backlog, utilization metrics, and business impact assumptions. Review the related license utilization, reserved capacity, consumption forecast, run-rate variance, TCO, labor load, downtime model, migration dependency, then confirm which systems or users are affected, which logs prove the control is operating, and how exceptions are approved, tracked, and revisited. Common review sources include Microsoft 365 billing, Azure Cost Management, finance reports, PSA/ticketing reports, capacity dashboards, spreadsheet model.

4. Support

Review support design, evidence location, control ownership, and recurring validation records. Evidence to review: current invoices, asset counts, support tickets, downtime history, revenue or productivity assumptions, and growth forecasts.

Do the records for support identify the control owner, approved baseline, evidence location, and most recent validation date?

Review guidance, technical context, and business impact
Why it matters

Support must be traceable to an approved configuration, named owner, and dated validation record. Without that evidence, teams cannot prove the control is configured as intended or determine whether exceptions are still justified. Review evidence for assumption register, cost model, utilization baseline, sensitivity analysis, business-impact inputs.

Business impact

Weak support controls can leave stale access, unmonitored changes, unsupported assets, or untested recovery paths in production. The result is longer triage time, weaker audit evidence, and higher remediation cost. It often becomes visible during audits, renewals, or outside reviews.

What Support is

Support is the cloud migration calculator control area that defines expected configuration, ownership, supporting evidence, and review cadence. A reviewer should be able to confirm the current state from system exports, admin-console settings, monitoring records, tickets, and maintained documentation. For support, the relevant evidence usually includes current invoices, asset counts, support tickets, downtime history, revenue or productivity assumptions, and growth forecasts. Review the related assumption register, cost model, utilization baseline, sensitivity analysis, business-impact inputs, then confirm which systems or users are affected, which logs prove the control is operating, and how exceptions are approved, tracked, and revisited. Common review sources include billing portals, asset inventory, ticketing reports, finance exports, capacity dashboards.

5. Documentation

Operational runbooks, evidence repositories, and procedure accuracy. Evidence to review: sample recent tickets and changes, verify approval and rollback records, compare documentation against production, and confirm named owners.

Can the team prove that documentation matches the intended configuration and was reviewed after material changes?

Review guidance, technical context, and business impact
Why it matters

Documentation must be traceable to an approved configuration, named owner, and dated validation record. Without that evidence, teams cannot prove the control is configured as intended or determine whether exceptions are still justified. Review evidence for SLA, RACI, change advisory review, rollback plan, runbook accuracy, configuration management, evidence repository, operational KPIs.

Business impact

Weak documentation controls can leave stale access, unmonitored changes, unsupported assets, or untested recovery paths in production. The result is longer triage time, weaker audit evidence, and higher remediation cost. It can increase remediation cost and delay recovery.

What Documentation is

Documentation is the operating area where policy, configuration, monitoring, and support records need to agree with the actual environment. A reviewer should be able to confirm the current state from system exports, admin-console settings, monitoring records, tickets, and maintained documentation. For documentation, the relevant evidence usually includes sample recent tickets and changes, verify approval and rollback records, compare documentation against production, and confirm named owners. Review the related SLA, RACI, change advisory review, rollback plan, runbook accuracy, configuration management, evidence repository, operational KPIs, then confirm which systems or users are affected, which logs prove the control is operating, and how exceptions are approved, tracked, and revisited. Common review sources include ticketing system, documentation portal, change calendar, asset inventory, monitoring alerts, configuration exports.

6. Monitoring

Telemetry collection, alert thresholds, and escalation workflows. Evidence to review: inspect zone changes, resolver paths, DHCP scope utilization, alert thresholds, log retention, NTP synchronization, and monitoring coverage gaps.

Are exceptions, ownership, monitoring records, and response evidence for monitoring documented well enough for audit or incident response?

Review guidance, technical context, and business impact
Why it matters

Monitoring must be traceable to an approved configuration, named owner, and dated validation record. Without that evidence, teams cannot prove the control is configured as intended or determine whether exceptions are still justified. Review evidence for forwarders, secure dynamic updates, DHCP failover, reservations, lease scope utilization, syslog, SNMP, NetFlow, SIEM correlation.

Business impact

Weak monitoring controls can leave stale access, unmonitored changes, unsupported assets, or untested recovery paths in production. The result is longer triage time, weaker audit evidence, and higher remediation cost. Risk increases when ownership, evidence, or exceptions are not documented.

What Monitoring is

Monitoring is the technical and administrative control set used to prove this part of the environment is configured, maintained, and reviewed. A reviewer should be able to confirm the current state from system exports, admin-console settings, monitoring records, tickets, and maintained documentation. For monitoring, the relevant evidence usually includes inspect zone changes, resolver paths, DHCP scope utilization, alert thresholds, log retention, NTP synchronization, and monitoring coverage gaps. Review the related forwarders, secure dynamic updates, DHCP failover, reservations, lease scope utilization, syslog, SNMP, NetFlow, SIEM correlation, then confirm which systems or users are affected, which logs prove the control is operating, and how exceptions are approved, tracked, and revisited. Common review sources include DNS/DHCP consoles, SIEM, syslog server, network monitoring dashboards, packet captures, availability reports.

7. Ownership

RACI clarity for approvals, maintenance, and review obligations. Evidence to review: sample recent tickets and changes, verify approval and rollback records, compare documentation against production, and confirm named owners.

Do the records for ownership identify the control owner, approved baseline, evidence location, and most recent validation date?

Review guidance, technical context, and business impact
Why it matters

Ownership must be traceable to an approved configuration, named owner, and dated validation record. Without that evidence, teams cannot prove the control is configured as intended or determine whether exceptions are still justified. Review evidence for SLA, RACI, change advisory review, rollback plan, runbook accuracy, configuration management, evidence repository, operational KPIs.

Business impact

Weak ownership controls can leave stale access, unmonitored changes, unsupported assets, or untested recovery paths in production. The result is longer triage time, weaker audit evidence, and higher remediation cost. Risk increases when ownership, evidence, or exceptions are not documented.

What Ownership is

Ownership is the cloud migration calculator control area that defines expected configuration, ownership, supporting evidence, and review cadence. A reviewer should be able to confirm the current state from system exports, admin-console settings, monitoring records, tickets, and maintained documentation. For ownership, the relevant evidence usually includes sample recent tickets and changes, verify approval and rollback records, compare documentation against production, and confirm named owners. Review the related SLA, RACI, change advisory review, rollback plan, runbook accuracy, configuration management, evidence repository, operational KPIs, then confirm which systems or users are affected, which logs prove the control is operating, and how exceptions are approved, tracked, and revisited. Common review sources include ticketing system, documentation portal, change calendar, asset inventory, monitoring alerts, configuration exports.

8. Testing

Validation frequency, test evidence quality, and remediation verification. Evidence to review: sample recent tickets and changes, verify approval and rollback records, compare documentation against production, and confirm named owners.

Can the team prove that testing matches the intended configuration and was reviewed after material changes?

Review guidance, technical context, and business impact
Why it matters

Testing must be traceable to an approved configuration, named owner, and dated validation record. Without that evidence, teams cannot prove the control is configured as intended or determine whether exceptions are still justified. Review evidence for SLA, RACI, change advisory review, rollback plan, runbook accuracy, configuration management, evidence repository, operational KPIs.

Business impact

Weak testing controls can leave stale access, unmonitored changes, unsupported assets, or untested recovery paths in production. The result is longer triage time, weaker audit evidence, and higher remediation cost. It often becomes visible during audits, renewals, or outside reviews.

What Testing is

Testing is the operating area where policy, configuration, monitoring, and support records need to agree with the actual environment. A reviewer should be able to confirm the current state from system exports, admin-console settings, monitoring records, tickets, and maintained documentation. For testing, the relevant evidence usually includes sample recent tickets and changes, verify approval and rollback records, compare documentation against production, and confirm named owners. Review the related SLA, RACI, change advisory review, rollback plan, runbook accuracy, configuration management, evidence repository, operational KPIs, then confirm which systems or users are affected, which logs prove the control is operating, and how exceptions are approved, tracked, and revisited. Common review sources include ticketing system, documentation portal, change calendar, asset inventory, monitoring alerts, configuration exports.

Printable report

Downloadable and printable Cloud Migration Calculator report

Free Cloud Migration Calculator Report
Ali Hassani, CISO and IT infrastructure consultant

Ali Hassani, CISO

Created by Ali Hassani, CISO - 25+ years of IT, cybersecurity, compliance, and infrastructure experience.

Certifications: CISSP, CCISO, CCNP, CCNA, MCSE, MCSA Security, MCITP, MCP, and MCTS. View Ali's IT Perfection profile.

Complete the assessment and calculate results to populate this report with your score, findings, recommendations, and priority roadmap.

Client support resources

IT Perfection can review the evidence, validate findings, and help prioritize remediation for managed IT, Microsoft 365, Azure, endpoint security, backup, servers, network infrastructure, and co-managed IT.

Schedule an IT reviewManaged IT servicesCybersecurity servicesMicrosoft 365 managed servicesOC Security Audit vCISO servicesCISA cybersecurity resources

Disclaimer: This free tool is a preliminary self-assessment and educational resource. It does not replace a professional cybersecurity audit, compliance assessment, penetration test, or legal/compliance review.

Ali Hassani, CISO and IT infrastructure specialist

Ali Hassani expertise

Cloud Migration Calculator guidance backed by real infrastructure experience

Ali Hassani is a cybersecurity consultant, virtual CISO, network security engineer, and IT infrastructure specialist with more than 25 years of experience helping organizations design, secure, audit, and support business IT environments.

Learn About Ali HassaniSchedule IT Review

Related resources

Internal links and authoritative references

IT Perfection links

Free IT Management ToolsIT Assessment Tools HubServer management and infrastructure supportContact IT Perfection

Authoritative references

Microsoft Security documentationCISA resources and toolsNIST Cybersecurity FrameworkCIS Critical Security ControlsOC Security Audit