Methodology
CAF and WAF, applied as controls
Both frameworks give sound guidance. Our work is turning that guidance into things deployed in the estate: Azure Policy assignments, pipeline gates and scheduled reviews with named owners.
Cloud Adoption Framework
Microsoft CAF describes seven methodologies. Strategy, Plan, Ready and Adopt run in sequence; Govern, Secure and Manage run alongside them for the life of the estate. In practice, most organisations we work with have a working landing zone from Ready and much less in place for Govern.
The usual pattern is that governance was written down during the build and then left as a document. Cloud risks are scattered or unrecorded, and policy statements lack an Azure Policy assignment to enforce them. Because of this, we start in the continuous three, Govern, Secure and Manage, since that’s where most of the risk in an established estate sits.
A note on naming: CAF on this site means the Microsoft Cloud Adoption Framework. The NCSC Cyber Assessment Framework, used for GovAssure, shares the acronym and is a separate exercise. If you’re preparing for GovAssure, mention it on the first call and we’ll take it into account when scoping.
Well-Architected Framework
Five pillars. Each one comes down to a question the design has to answer, followed by what we put in place to answer it.
- 1
Reliability
What happens when this fails, and how is recovery confirmed?
We test recovery objectives by running a restore and checking the result against the target.
- 2
Security
Can the control be shown to have been operating over time?
Controls are assigned as policy with an audit trail. Exemptions carry an expiry date and an owner.
- 3
Cost Optimisation
Who is accountable for each line on the bill?
Tagging maps to your cost centres and is enforced at deployment, so showback reports each cost against the team that incurred it.
- 4
Operational Excellence
Can someone who joined after the build repeat it?
Infrastructure as code with module standards, so knowledge of the estate lives in the code.
- 5
Performance Efficiency
Does the sizing match the measured load?
Rightsizing against measured demand, revisited on a regular cadence after the build.
Seven methodologies, and where we start
Most estates have been through the sequential four. The work almost always begins in the continuous three.
How we frame recommendations
Every recommendation we make takes one of three forms: a deployed control, a pipeline gate, or a scheduled review with a named owner. Each of these keeps running through a busy quarter, which is when governance held only in a document tends to slip.
Putting it into practice
The CAF Readiness Assessment applies this approach to your estate in three to four weeks and ends with a sequenced adoption plan.