Methodology
CAF and WAF, applied as controls
Both frameworks are excellent and both are routinely reduced to a slide deck. The difference is whether the guidance ends up deployed.
Cloud Adoption Framework
CAF describes six stages: Strategy, Plan, Ready, Adopt, Govern and Manage. In practice almost every organisation we meet is further along in Ready than they think and further behind in Govern than they will admit.
The landing zone got built. The governance disciplines were written down and then not implemented as anything enforceable: cost, security baseline, resource consistency, identity, deployment acceleration. So we start at Govern and Manage, which is unglamorous and is where the actual risk sits.
Well-Architected Framework
Five pillars, each of which is really one uncomfortable question.
- 01
Reliability
What happens when this fails, and how do you know it recovered?
Recovery objectives get tested rather than documented. A restore that has never been run is a hypothesis.
- 02
Security
Can you evidence that the control was operating, not just that it exists?
Controls are assigned as policy with an audit trail. Exemptions carry an expiry date and an owner.
- 03
Cost Optimisation
Who is accountable for this line on the bill?
Tagging maps to your cost centres and is enforced at deployment, so showback reflects reality.
- 04
Operational Excellence
Is this repeatable by someone who was not there when it was built?
Infrastructure as code with module standards, so the estate does not depend on institutional memory.
- 05
Performance Efficiency
Is it sized for the load you have or the load you imagined?
Rightsizing against measured demand, revisited on a cadence rather than at build time only.
The test we apply
For any recommendation: can it be expressed as a deployed control, a pipeline gate, or a scheduled review with a named owner? If it can only be expressed as a document, it will not survive the first busy quarter, and we would rather say so than bill for writing it.
Which of your governance controls could you evidence today?
Not describe, evidence. Most estates can do fewer than they think, and finding out takes one conversation rather than an audit.