Cloud Migration Checklist 2026: A Complete Phase-by-Phase Guide

The cloud computing market will pass $900 billion this year. Over 94% of enterprises already use cloud services. Nobody's debating whether to migrate anymore.

The conversation now is entirely about how to do it without blowing a budget, missing a deadline, or accidentally leaving a storage bucket exposed to the internet.

And yet, migrations still go wrong all the time:

38% of migration projects exceed their original budget, with the average overrun at 23% above plan (IDC)
31% miss their timelines, usually because of legacy application complexity, and nobody fully scoped
62% of cloud migration projects either fail outright or end up significantly harder than expected

Here's a detailed checklist covering every phase, with real numbers from 2025-2026 research and honest advice where conventional wisdom falls short.

Where things actually stand

A few numbers worth knowing before you plan anything:

Metric	2026 data
Global cloud market size	~$905B to $1.18T (depends who you ask)
Cloud migration services market	$31.5B, growing at 22.4% CAGR
Enterprise cloud adoption	94%+
Enterprise workloads in the cloud	60%+ (projected 75% by 2028)
Hybrid cloud strategies	51% of enterprises
Multi-cloud environments	64% of enterprises
Cloud spending wasted on unused resources	25-35% (32-40% without FinOps)
Migrations completed on time and on budget	65% (up from 54% in 2022)
DIY vs. provider-assisted on-time rate	49% vs. 71%
Average large enterprise migration timeline	12-18 months

That wasted-spending row should concern anyone signing off on a cloud budget.

Organizations without formal FinOps practices waste 32-40% of their cloud spend (FinOps Foundation, 2026). Even mature programs still waste 15-20%. It never fully goes away — it just gets smaller with discipline.

Phase 1: Pre-migration assessment

Most blown budgets and missed timelines trace back to this phase — or rather, to skipping it.

Organizations that conduct a formal readiness assessment have 2.4x higher success rates. That's a staggering multiplier for what amounts to doing your homework.

Inventory everything (and I mean everything)

Catalog all hardware, software, applications, databases, message queues, cron jobs, and third-party integrations.

You can't migrate what you haven't cataloged. Use automated discovery tools:

AWS Application Discovery Service (now part of AWS Transform, late 2025)
Azure Migrate
Google Cloud migration tools

These scan your environment, map servers, discover dependencies, and estimate initial costs. Manual spreadsheets work for small environments, but anything over 50 servers needs tooling.

Map dependencies thoroughly

Which apps talk to each other? Which databases do they need? What about message queues, cron jobs, and external API calls?

The Uptime Institute's 2025 survey found that 38% of failed migration projects hit unanticipated dependency conflicts during testing. I've watched teams migrate an application only to realize its database was still on-prem with no connectivity path.

Give this step at least two full weeks for a mid-sized environment.

Capture baseline performance over 30 days

Record:

CPU utilization
Memory usage
IOPS
Network throughput
Latency metrics

You'll need this to validate that things work the same (or better) after the move. Without baselines, you can't tell if post-migration performance issues are real regressions or just how the workload always behaved.

Figure out compliance early

Which data falls under GDPR, HIPAA, SOC 2, PCI DSS, or industry-specific mandates?

This shapes architecture decisions and provider selection. Retrofitting compliance after migration is miserable and expensive. About 80% of organizations worry about compliance in the cloud, and for good reason — the shared responsibility model means your provider handles infrastructure security, but you own configuration, access controls, and data governance.

Calculate total cost of ownership honestly

Include:

Licensing
Data transfer fees
Storage tiers
Egress fees
Automated discovery tooling (~$0.10-$0.25 per resource hour)
Staff training
Ongoing management

The listed price of a cloud instance is almost never what you'll actually pay.

For a mid-sized enterprise (200-500 servers), total migration investment typically runs $300K to $500K including all phases.

Classify workloads by criticality and risk

Tag each workload by:

Business criticality
Technical complexity
Compliance requirements
Performance needs

Identify quick wins (low risk, low complexity) and high-risk areas that need more design work. This classification feeds directly into your migration sequence.

Phase 2: Pick your strategy

Not every workload needs the same approach. This is where the "7 Rs" framework comes in — originally developed by Gartner, popularized by AWS, and now the industry standard.

The 7 Rs of cloud migration

Rehost (lift and shift): Move as-is. Fastest approach, but organizations that only rehost see ~40% lower ROI compared to those that modernize. About 52% of cloud users still default to this, which explains a lot of cost overruns later.

Replatform: Make targeted changes (managed databases, containerized deployments) without rewriting everything. Good middle ground.

Refactor/re-architect: Rebuild for cloud-native. Expensive upfront, but cloud-native apps improve developer productivity by ~25%. Best for high-value, high-traffic workloads.

Repurchase (drop and shop): Replace with a SaaS equivalent. Sometimes the best strategy is to stop running the software yourself.

Retire: Turn it off. Plan for retiring 10-25% of your application portfolio during migration. That's free cost savings.

Retain: Keep it on-prem. 25% of organizations have repatriated at least one workload from cloud back to on-prem. Top reasons:

Cost (54%)
Performance requirements (31%)
Data sovereignty (27%)

Not everything belongs in the cloud. Pretending otherwise is how you end up moving things twice.

Relocate: Hypervisor-level move. Less common but useful for VMware-based environments.

Choose your cloud provider(s)

Market share breakdown: AWS ~32%, Azure ~23%, Google Cloud ~12%. Together the big three control ~66%.

But market share shouldn't be your deciding factor:

Microsoft-heavy stack? Azure often wins.
BigQuery-centric data warehouse? GCP makes sense.
Linux/Docker/Kubernetes? AWS has the deepest ecosystem.

Pro tip: Apply for cloud credits before you start. AWS Activate, Google for Startups, and Microsoft for Startups collectively offer up to $600,000 in total credits across all three providers.

Set success metrics upfront

Define what good looks like before the project starts:

Cost optimization targets (e.g., 20-30% reduction in run-rate costs)
Resilience targets (RPO/RTO, availability SLAs)
Time-to-market improvements (release frequency, lead time for changes)
Timeline milestones

If you don't define these upfront, you'll argue about them after.

Plan your migration sequence

Start with low-risk, low-dependency workloads.

For smaller organizations, a common order:

Email (lowest risk, early user wins)
File storage
Applications
Servers

Moving servers last means you have a functioning cloud environment to fall back on.

For larger enterprises, plan 8-12 months per complex wave including discovery, pilots, migration, hypercare, and optimization.

Use AI-powered migration tools

AI-driven migration planning has matured significantly. Tools now handle:

Automated dependency mapping
ML-driven cost and performance predictions
Automated data synchronization and validation
Real-time failure detection with auto-recovery

The AI migration tools market is growing at ~28% annually, and the tooling is genuinely useful now — not just marketing hype.

Phase 3: Build and secure the target environment

Design your cloud environment before you start moving things into it. Security goes in now, not later.

This matters more than ever:

80% of companies experienced a serious cloud security issue in 2023-2024
45% of all data breaches now occur in cloud environments
Organizations face 1,925 cyberattacks per week on average (Q1 2025)

Design the target architecture

Blueprint your network topology, compute resources, storage tiers, and redundancy.

Use Infrastructure as Code (Terraform, CDK, or Pulumi) from day one. Manual console changes create configuration drift, and drift is how misconfigurations accumulate quietly.

Plan for autoscaling from the start rather than bolting it on after your first traffic spike.

Implement zero-trust security

Gartner predicted that 99% of cloud security failures through 2025 would be the customer's fault. That prediction held up.

The numbers are sobering:

23% of cloud security incidents caused by misconfigurations
82% of those misconfigurations are human error
$3.86 million — average cost of a misconfiguration-driven breach
186 days to identify + 65 days to contain

Enforce least-privilege access everywhere. No exceptions.

Set up IAM properly

IAM misconfigurations are a primary attack vector.

Leaked credentials were the initial access point in 65% of cloud breaches (RSAC, 2025).

Use role-based access control
Enforce MFA everywhere (not just for admins)
Stop storing credentials in scripts or config files
Use managed identities or secret vaults
Review access during employee offboarding — inadequate offboarding creates persistent access risks

Encrypt everything

Data at rest and in transit. No "we'll get to it later."

Only 65% of cloud users currently encrypt sensitive data. A third of organizations are running production workloads without basic encryption in place.

Establish governance and FinOps policies early

This determines whether you end up in the 15-20% waste camp or the 32-40% one.

Define tagging standards and naming conventions
Set resource provisioning rules and budget alerts
Set up cost allocation models (attribute spending to teams, products, features)
Assign cost ownership to engineering leads at minimum
Consider a dedicated FinOps team (59% of organizations now have one)

Deploy CSPM tools

Automated configuration scanning catches misconfigurations before attackers do.

AWS Security Hub runs 300+ automated checks against your account and produces a scored security posture report. Deploy this before migration.

Set up a multi-account structure

Don't run dev, staging, and production in a single account.

Experiments in dev can impact production, and billing becomes opaque. Establish a landing zone with separate accounts for each environment from day one.

Deploy monitoring before migration

You need observability from day one, not as a reaction to your first outage.

32% of cloud assets sit unmonitored, and each hides an average of 115 vulnerabilities (Orca Security). Track application performance, resource utilization, cost trends, and security events from the start.

Phase 4: Execute the migration

Follow the plan, test constantly, and don't let the early waves going smoothly trick you into cutting corners on the later ones.

Phased migrations deliver 20-40% better TCO than big bang approaches, which spike costs by 50%+ due to systemic risk.

Stage a test environment

Mirror production as closely as possible. Run your migration there first. This catches issues before they matter.

Migrate data before compute

This trips up a lot of teams. Moving compute before data causes race conditions and data loss risks.

Migrate data first with change data capture (CDC), then cut over the applications.

Migrate in waves

Batch workloads by priority and dependency. Validate each wave before starting the next.

Start with 1-2 low-risk workloads as a pilot to refine your tooling, then gradually increase wave size as confidence builds.

Validate data integrity after each wave

Row counts
Checksums
Application-level data validation
Both automated and manual checks

"It looks fine" is not a validation strategy. 18% of migration projects require rolling back at least some workloads. Catching problems early is cheaper than rolling back later.

Run functional, load, and stress testing

Confirm all applications, APIs, and integrations work against your Phase 1 baselines
Don't assume matching on-prem specs gives identical cloud performance — storage tiers have different IOPS and throughput characteristics
Test under realistic load conditions, not just synthetic benchmarks

Test security and compliance

Scan for vulnerabilities, verify encryption, and confirm compliance controls are active.

Run CSPM tools against the migrated environment. Your newly migrated environment will be tested by attackers faster than you think.

Get real users to test end-to-end

Latency, DNS resolution, and auth flows all behave differently in the cloud. Synthetic tests won't catch everything.

Schedule cutover windows during off-hours or weekends with rollback procedures ready.

Document rollback procedures for every wave

Not a plan you create under pressure at 2am, but one you've documented and rehearsed in advance.

Phase 5: Post-migration optimization

Migration day is closer to halftime than a finish line.

Enterprises that actively optimize cut infrastructure costs by an average of 35% within 18 months
Post-migration optimization yields an additional 15-20% savings beyond initial migration benefits
Those that don't optimize watch costs climb quietly until someone notices a bad quarterly bill

Right-size your resources

Almost everyone over-provisions during migration.

Review actual usage after 2-4 weeks and downsize anything running at 10-20% utilization.

But don't buy reserved instances too early. Wait for real production usage data before committing. Locking in the wrong instance sizes is a common and expensive mistake. Rightsizing alone saves 15-25%.

Set up real FinOps practices

Budget alerts are a start, but real FinOps means ongoing financial accountability:

Reserved instances/savings plans: 40-72% savings vs. on-demand for predictable workloads
Spot instances: for fault-tolerant jobs
Scheduling non-production environments to shut down outside business hours: 10-20% savings
Mature FinOps practices reduce waste by 30-50% within the first year

Breakeven point for most migrations is 12-18 months. Full ROI including agility gains usually materializes in years 2-3.

Optimize storage

Move infrequently accessed data to cheaper tiers automatically. Set lifecycle policies so this happens without manual intervention.

Review storage regularly — orphaned volumes and snapshots accumulate faster than you'd think.

Enable autoscaling

Resources should scale with actual demand in both directions. Bursty workloads, test environments left running, and underused instances are the common culprits behind cost creep.

Run a security audit

The mean time to identify and contain a breach is 241 days in 2026 — a 9-year low thanks to better AI tools, but still nearly eight months of exposure.

Continuous monitoring isn't optional. Organizations using AI and automation in security operations reduced their breach lifecycle by an additional 80 days.

Document everything while it's fresh

Architecture, runbooks, incident response procedures, lessons learned, migration decisions and their rationale.

You'll forget the details faster than you expect. Build a knowledge base so the next migration wave doesn't start from scratch.

Train your team (and keep training them)

43% of companies cite lack of talent as the reason for migration delays
78% of organizations say cloud expertise gaps are their biggest challenge
45% of IT staff feel overwhelmed by the pace of cloud changes
Cloud certifications increase salaries by ~10% on average (helps with retention too)

This isn't something you solve with a one-week bootcamp. Budget for ongoing certifications and hands-on learning.

Establish a Cloud Center of Excellence

A CCoE sets standards, shares best practices, maintains golden paths for common patterns, and keeps governance consistent as your footprint grows.

33% of businesses have already created one. If you don't have a formal CCoE, at least designate cloud champions across teams.

Mistakes that keep happening

Treating migration as a one-time project

Cloud environments change constantly. Without regular optimization, costs drift upward and security configs go stale.

Quarterly reviews help — but only if someone acts on the findings. Migration should be seen as an operating model shift, not a one-shot move.

Ignoring egress costs

Moving data out of cloud environments is where surprise bills come from.

82% of cloud customers cited managing cloud spending as their main challenge in 2024, and egress fees are often the line item they never modeled. Map your data flows and estimate egress costs before committing to an architecture.

Neglecting the people side

Technology migrates cleanly. Habits don't.

While 78% of organizations claim to have adopted DevOps practices, only 41% report consistent implementation across departments. If your team isn't trained, they'll build workarounds that undermine everything.

Assuming cloud equals secure

Cloud providers secure their infrastructure. You secure your configurations, access controls, and data.

45% of all data breaches now occur in cloud environments
82% of cloud misconfigurations are human error
AI-driven phishing projected to account for 42%+ of global intrusions by end of 2026

The shared responsibility model hasn't changed. Attackers are actively targeting leaked credentials and misconfigured IAM.

Mismanaging vendor lock-in

A HashiCorp 2026 survey found 72% of enterprises worry about vendor lock-in, yet 58% keep building within a single provider because it's convenient.

If portability matters, invest in it architecturally from the start. Kubernetes, Terraform, and container-first strategies help.

Skipping the rollback plan

18% of migration projects require rolling back at least some workloads. Every wave needs a documented, tested rollback procedure.

If something breaks, you need a clear path back that doesn't depend on someone figuring it out under pressure.

Not planning for AI workloads

This is the newer mistake.

GPU-intensive AI workloads now account for 18% of total cloud spend at AI-forward enterprises, up from 4% in 2023. If your organization is investing in AI/ML (48% cite AI capabilities as a migration driver), factor those infrastructure requirements in from the start.

Retrofitting for AI later is expensive.

What comes after

The organizations that get lasting value from cloud migration treat it as a phased, documented process that evolves into an ongoing operating model.

They invest in assessment upfront, build security into the architecture, test more than feels necessary, and keep optimizing long after the migration is done.

Adapt this checklist to your organization's size and complexity. If the scope exceeds what's outlined here, bring in specialists — companies using dedicated migration providers complete on time 71% of the time versus 49% for those going it alone.

Migration is just one part of the work. How you operate, optimize, and govern what's in the cloud afterward determines whether the move was actually worth it.

The breakeven point is 12-18 months. Full ROI comes in years 2-3. Plan accordingly.

Call experts