Cloud exit strategy checklist: 14-control readiness test

An exit strategy that has never run is an assumption with a document attached.

Check a statement only when your team has evidence that it works today. Plans, diagrams and vendor assurances do not count as completed tests.

Framework basis Adapted primarily from AWS Prescriptive Guidance, with portability and contract controls from UK Government guidance and EBA cloud exit recommendations.

Control area 01Scope and triggerThe workloads included in the exit are explicitly named and prioritized.Business triggers, decision thresholds and measurable success criteria are approved.A practical target environment and accountable exit owner are named.

Control area 02Data and architectureEvery authoritative dataset, backup and technical dependency is inventoried.We have completed an export into open, usable formats and measured its time and cost.Every proprietary API and managed service has a named replacement or refactoring plan.The application has been built and run outside the primary provider.

Control area 03Continuity and recoveryPerformance, capacity, RTO and RPO baselines are recorded for the target to meet.Emergency credentials work without the provider’s primary SSO.The cutover runbook includes rollback, DNS, networking and customer communication.A tabletop or technical rehearsal has challenged the assumed time, people and bandwidth.

Control area 04Contract and closureTermination rights, notice periods, committed spend and provider transition support are recorded.Migration staffing, dual-running cost, egress cost and temporary capacity are budgeted.The contract covers usable data return and verifiable deletion of live, backup and archive copies.

0 / 14 controls verified

The point: you do not need to leave today. You need evidence that leaving remains possible.