# What Should an IT Head Check Before Moving Critical Workloads to the Cloud? > Source: > Published: 2026-09-11 10:13:37+00:00 tl;dr: Moving a critical application to the cloud is not simply a matter of choosing AWS, Microsoft Azure, or Google Cloud and shifting servers. Before migration, an IT Head needs to answer much harder questions: What data is moving? Who can access it? What systems does the application depend on? What happens if the cloud service becomes unavailable? How will the organization meet regulatory requirements? What will the migration actually cost? And, most importantly, how will security be maintained after the migration? The questions are becoming more important in India as cloud adoption accelerates. Gartner forecasts that end-user spending on public cloud services in India will reach $17.5 billion in 2026, a 28.1% increase from 2025. Gartner identifies demand for AI-ready infrastructure, application modernization, digital sovereignty and scalable IT models as major drivers. At the same time, the risk environment is getting harder to ignore. CERT-In recorded 29,44,248 cyber security incidents in India during 2025, up from 20,41,360 in 2024. IBM reported that the average total cost of a data breach in India reached ₹22 crore in 2025, 13% higher than the previous year. For an IT Head, the real question is therefore not: "Should we move to the cloud?" It is: _ *"Are we ready to move this particular workload to the cloud without creating a security, compliance, cost or business-continuity problem?"* Cloud has changed the way enterprises build and operate IT infrastructure. Applications no longer sit inside one data centre behind one network perimeter. A modern business application may depend on cloud databases, APIs, identity providers, SaaS platforms, third-party integrations, remote users, endpoint devices, backup environments and multiple network paths. That makes migration less about moving infrastructure and more about understanding relationships. A server can be migrated successfully while the business application still fails because an old API was missed, a DNS dependency was overlooked, a firewall rule was not recreated, an identity service was unavailable, or a backup process was never tested in the new environment. This is one reason recent cloud security research is focusing heavily on identity and configuration rather than the simple question of where the workload is hosted. Google Cloud's M-Trends 2025 research found that exploits were the most common initial infection vector at 33%, followed by stolen credentials at 16%. Mandiant also specifically highlighted risks introduced during cloud migrations and attacks targeting unsecured data repositories. Its Cloud Threat Horizons research for the second half of 2025 found that 83% of incidents involving major cloud and SaaS-hosted environments involved identity issues as an initial access vector, while data theft was the objective in 73% of cloud-related incidents reviewed. That changes the migration conversation. A cloud project should be treated as an IT transformation and security project at the same time. One of the most common migration mistakes is starting with the question: AWS, Azure or Google Cloud? The better first question is: Which workloads should actually move, and why? Every critical workload should be assessed before a migration decision is made. At minimum, an IT team should document: An application inventory is useful, but an application dependency map is even more important. `For example, an ERP system may appear to be one application. In reality, it may depend on an identity platform, database cluster, DNS, file storage, payment gateway, backup infrastructure, email services, internal APIs and third-party applications.` If even one critical dependency is ignored, a migration can create downtime. ``` A practical NS3 approach ``` At NS3, the right way to approach a cloud migration is not to begin with infrastructure procurement. The first step should be understanding the current IT environment, identifying dependencies and determining which workloads are suitable for migration. That assessment creates the basis for the migration architecture instead of forcing the business into a technology choice too early. Not every piece of data carries the same level of risk. An enterprise may have: Before migration, the IT team needs to know exactly where sensitive information exists and where it will be stored after migration. This is particularly important because India's data protection environment has changed significantly. The Government of India notified the Digital Personal Data Protection Rules, 2025 in November 2025. The rules establish requirements around reasonable security safeguards, including encryption or masking, access controls, logging and monitoring, data backups, security provisions in contracts with Data Processors, and measures for detecting and responding to unauthorized access. The rules also require specified information about a personal data breach to be provided to the Data Protection Board within 72 hours, subject to the framework and applicable timelines. The important point for an IT Head is simple: `Putting personal data in the cloud does not transfer responsibility for protecting that data to the cloud provider.` The organization still has to understand how the data is collected, accessed, processed, retained, monitored and deleted. One of the most dangerous assumptions in cloud adoption is: "The cloud provider handles security." It does not work that way. AWS, for example, explicitly describes cloud security as a shared responsibility. The provider secures the infrastructure of the cloud, while customers remain responsible for security within the cloud, depending on the services they use. That means an enterprise can still create a serious security problem through: Incorrect IAM permissions Exposed storage Weak passwords Missing MFA Insecure APIs Poor network segmentation Unpatched workloads Publicly accessible management interfaces Misconfigured security groups Excessive administrator privileges Inadequate logging Poor key management Unprotected backup environments The cloud can provide excellent security controls, but those controls need to be correctly designed and operated. Traditional IT security was built heavily around network boundaries. Cloud changes that model. Users, administrators, applications, APIs and machines may all need access to cloud resources from different locations. NIST's cloud and zero trust guidance therefore places much stronger emphasis on identity, authentication, authorization and continuous verification. In cloud-native environments, security policies need to consider both network and identity layers. Before migration, an IT Head should ask: Who needs access? What exactly do they need to access? Why do they need that access? How often should the access be reviewed? What happens when the employee leaves or changes roles? A strong cloud migration plan should include: This area deserves particular attention because identity remains one of the major paths into cloud environments. Google Cloud's M-Trends 2025 research reported stolen credentials as the second most common initial infection vector in its investigations, while its later cloud threat research found identity issues in 83% of cloud and SaaS incidents reviewed for H2 2025. A cloud migration changes network traffic. Traffic that previously moved between servers inside a data centre may now move between: The architecture therefore needs to be redesigned rather than simply copied. An IT Head should review: Connectivity How will the office and data centre connect to the cloud? Will the organization use dedicated connectivity, VPN, SD-WAN or a combination? Segmentation Which systems should be isolated? Should production, development and testing environments communicate with one another? Internet exposure Which applications actually need to be public? Which services should remain private? East-west traffic How will traffic between cloud workloads be controlled? DNS and routing What changes will occur when applications move? Remote access How will employees, vendors and administrators access the environment securely? Monitoring Can the security team see traffic across both cloud and on-premises environments? Network architecture needs to be designed with security, performance and resilience together. Cloud migration creates a period where old and new environments coexist. This is often one of the weakest stages of the project. An enterprise might have: Data centre → VPN → cloud → SaaS → third-party API with different security controls at every point. Before moving a critical workload, organizations should assess: Vulnerabilities CERT-In has specifically warned that data breach and data leak incidents can result from compromised or misconfigured cloud instances, including AWS S3, Azure Blob and Google Cloud storage. Its advisory recommends checking public accessibility, securing cloud access tokens, separating production from testing and backup environments, and encrypting data at rest and in transit. For critical workloads, security testing should happen before migration, during migration and after the environment becomes operational. Cloud breaches are useful lessons because many of them do not happen because the underlying cloud platform was "hacked." They happen because something around the platform was poorly configured, over-permissioned, exposed, or insufficiently monitored. `Case Study: Angel One's AWS security incident` In February 2025, Indian stockbroker Angel One disclosed that some of its AWS resources had been compromised. The company said an external forensic partner was engaged to investigate the incident and that its client securities, funds and credentials were not affected. It also said it immediately changed credentials associated with its AWS cloud environment and other applications after being alerted by its dark-web monitoring partner. The incident is important for IT leaders because it highlights a practical reality: Cloud security does not end when the migration is complete. Credentials need to be managed. Environments need to be monitored. Unusual access needs to be investigated. Incident response needs to exist before an incident happens. `Case Study: Capital One` A more widely studied example is the 2019 Capital One breach. Capital One disclosed that approximately 100 million people in the United States and around 6 million in Canada were affected. The company estimated incremental costs of roughly $100 million to $150 million in 2019 related to customer notification, credit monitoring, technology and legal support. Technical analysis of the incident identified a chain involving a misconfigured firewall, access to an EC2 instance, IAM permissions and S3 data. Capital One itself also made an important point: the vulnerability was not inherently a "cloud problem." The infrastructure involved could have existed in other environments as well. That is an important lesson for enterprises considering migration. Moving to the cloud does not create security risk by itself. Poor architecture, configuration, and governance create the risk. An organization should never discover its recovery strategy during an outage. Before migrating a critical application, define: The cloud can improve resilience, but only when resilience is deliberately designed. A backup that exists but has never been restored is not a recovery strategy. For critical applications, IT teams should conduct actual recovery exercises and document: These questions should be answered before production migration. Compliance needs to be treated as an architecture requirement, not a document that gets reviewed at the end. The relevant requirements depend on the industry. For example, India's financial sector has specific technology outsourcing requirements. RBI's Outsourcing of IT Services Directions, 2023 include requirements around cloud computing services and require regulated entities to maintain a clear exit strategy for outsourced IT activities. The exit strategy is expected to address continuity and alternatives if the relationship with the service provider ends. SEBI's Cybersecurity and Cyber Resilience Framework for regulated entities also addresses areas including asset inventory, classification of critical systems, vulnerability assessment, audits, outsourcing, cloud service providers, log management and data security. This leads to an important migration question: If we have to leave this cloud provider, can we actually get our data and workloads out safely? That is where exit strategy becomes important. Vendor lock-in does not always happen because an organization signs a long contract. It can happen technically. Once applications begin depending heavily on proprietary databases, cloud-specific APIs, managed services and custom architectures, moving to another platform may become expensive and difficult. Before choosing a cloud architecture, ask: Not every organization needs a multi-cloud architecture. But every organization should understand its exit risk. Cloud can reduce capital expenditure, but that does not automatically mean it will reduce the total cost of IT. A migration budget should include: Before migration During migration After migration A workload that is poorly sized can create unnecessary recurring costs. The organization therefore needs a baseline: What does this workload cost today? Then compare it with: What will the same business service cost in the cloud? The answer should not be based only on virtual machine pricing. A cloud environment can work perfectly in a test environment and still perform poorly at production scale. Critical workloads should be evaluated for: Performance testing should use realistic business workloads. A finance application, ERP system or customer-facing platform should not be considered migration-ready simply because the application successfully starts in the cloud. The question is: Does it perform at the level the business requires? There is a temptation to change everything at once. That can turn a manageable migration into a high-risk transformation. A better approach is to decide whether each workload should be: A stable legacy application may only need a controlled rehosting strategy. Another application may benefit from modernization. The correct choice depends on business value, technical debt, security requirements and expected lifecycle. Once an application enters the cloud, the IT team needs visibility into: Logging should be useful, centralized and monitored. India's regulatory environment makes this especially relevant. CERT-In's directions require specified cyber incidents to be reported within six hours of noticing or being informed of them, and CERT-In's guidance also emphasizes log management and retention. The Digital Personal Data Protection Rules, 2025 also include visibility through logs and monitoring, along with retention of relevant logs and personal data for specified security purposes. That means an organization should know before migration: What will we log? Where will those logs go? Who will monitor them? How long will they be retained? Can we investigate an incident from those logs? A cloud incident should not become a meeting where everyone asks: "Who has access to the console?" Before production migration, document the response process. The response plan should involve IT, cybersecurity, business owners, legal and management where required. This is particularly important because incident response timelines can be short. CERT-In's six-hour reporting requirement and the DPDP framework's breach notification obligations mean organizations need operational readiness, not just policies sitting in a folder. Large migrations demonstrate why cloud transformation should begin with understanding the existing environment. In a September 2026 account published by Express Computer, Providence India described a healthcare transformation involving 51 hospitals and more than 1,000 clinics, with over 32,000 servers decommissioned, 2,000+ applications retired and 650+ applications migrated to the cloud. The teams emphasized understanding dependencies between applications, identity services, devices and clinical services rather than treating migration as a simple server-movement exercise. Healthcare is a particularly demanding environment, but the underlying lesson applies across industries: A workload does not exist in isolation. Its dependencies are part of the workload. `How NS3 can help organizations approach cloud migration` For an enterprise, cloud migration should not be treated as a one-time infrastructure project. It connects IT infrastructure, networking, cybersecurity, business continuity, compliance and ongoing support. This is where an experienced technology partner can add value. NS3's approach should be centered around understanding the existing environment first, then designing the target infrastructure around business requirements. That can include: Assessment Review the current infrastructure, applications, dependencies, security posture and business requirements. Architecture Design the appropriate cloud or hybrid architecture based on workload requirements, connectivity, identity, security and resilience. Security Build security into the architecture through access controls, network segmentation, endpoint and workload protection, monitoring and governance. Migration Plan workload movement in controlled phases with testing, validation and rollback options. Business Continuity Design backup, disaster recovery and recovery processes around actual business requirements. Managed Support Continue monitoring and supporting the environment after migration instead of treating the project as finished once the workload is live. For organizations operating a hybrid environment, this integrated approach is especially important because cloud and on-premises infrastructure will often continue to coexist. Cloud adoption in India is growing quickly. Gartner expects public-cloud spending in the country to reach $17.5 billion in 2026, driven in part by AI infrastructure, modernization and the need for more scalable IT models. But growth in cloud adoption does not remove the fundamentals of IT. Businesses still need: The organizations that benefit most from clouds are not necessarily those that migrate the fastest. They are the ones that understand what they are moving, why they are moving it, what could go wrong, and how they will operate the environment after the migration. For an IT Head, the right cloud migration question is therefore not: "Can we move this workload to the cloud?" It is: "Can we move this workload to the cloud while keeping the business secure, compliant, available and financially sustainable?" That is the standard a critical workload should meet before migration. Follow [Ns3TechSolutions](https://ns3techsolutions.com/) for more information.