Cloud Architecture Review

A paid diagnostic audit of your cloud in Azure or AWS. In 1.5 to 2 weeks we find out how your environment is really built, where the biggest risks are and what it should look like to carry further growth.

CZK 73,000

1.5 to 2 weeks, Azure or AWS, read-only access. Excl. VAT.

Book a consultation

What we offer

The result is not a generic list of recommendations. You get a target architecture and a roadmap: concrete steps, their order, effort and prices. The document is written so you can decide the budget from it and present it to management.

We audit read-only. We change nothing in your environment.

We do not write applications. We work only on infrastructure, cloud and DevOps.

When it makes sense

Your cloud grew step by step without a single design, and nobody has a full picture of what runs in it and why.
A bigger change is coming: a new product, a migration, an acquisition, an audit or NIS2 preparation.
You suspect you pay more for the cloud than you should, but do not know where to start.
A new CTO or head of infrastructure needs an independent view of the current state.
Your internal team needs material for management on why and where to invest.

What you get

A full picture of what you have in the cloud and how the parts connect.
A risk rating in six areas with a traffic light, clear to engineers and management alike.
A target architecture, with options where there is more than one way.
A roadmap over three horizons with effort and prices.
A list of quick wins you can do straight away, even without working with us further.

What exactly we do

We assess the environment in six areas. Each gets a traffic light (green: fine, amber: works but with risks, red: needs action), always backed by concrete findings.

Governance and environment structure: Management group or organisational unit structure, split of subscriptions and accounts, environment separation, policies, naming and tags.
Identity and access: Entra ID or AWS IAM, assigned roles, privileged accounts, PIM and just-in-time access, service accounts and secrets management, MFA.
Network: Topology (hub-and-spoke, Virtual WAN, Transit Gateway), address plan, on-prem connectivity, firewall, private endpoints, DNS and services exposed to the internet.
Security: Defender for Cloud or Security Hub, logging and SIEM, encryption, vulnerability management and alignment with the CIS baseline.
Operations and reliability: Monitoring and alerts, backups and verified restore, redundancy and disaster recovery, runbooks, Kubernetes clusters and their versions.
Automation and cost: Infrastructure as code, CI/CD for infrastructure, drift between code and reality, cost structure and quick savings.

Who works on it

Three people work on the review. It is led by a senior who owns the conclusions and presents them to your management.

Lead (senior)
1 day

Responsible for
Runs the project, holds scope and deadline, decides the target architecture, checks the quality of the conclusions and presents them to management.

What you get from them
Main contact, final presentation, agreed direction
Senior architect
4 days

Responsible for
Interviews your people, assesses the six areas, designs the target architecture and builds the priced roadmap.

What you get from them
Traffic-light assessment, target architecture, roadmap
Middle
2 days

Responsible for
Technical data collection: configuration export, resource inventory, network and identity analysis, cost breakdown. Prepares the current-state map.

What you get from them
Inventory, current-state map and diagram

We assign work by complexity: juniors do routine work from templates, the middle takes the harder parts, and the senior owns the design, quality control and risk decisions. You do not need to decide who does what. The effort in days is indicative and only explains the price. The price is fixed and does not depend on the days actually worked.

How the project runs

The review has four phases and typically takes 10 working days. We schedule the readout around your management, usually at the end of week two or the start of week three.

Days 1 and 2: preparation and kick-off
Goal: Agree the scope, get access and arrange interviews.
- A 60 minute kick-off: goals of the review, the questions you want answered, subscriptions or accounts in scope.
- Read-only access (Azure: Reader, Security Reader and Cost Management Reader; AWS: ReadOnlyAccess and SecurityAudit).
- Collecting existing documentation: diagrams, address plan, security policies, earlier audits.
- An interview plan with 3 to 5 people on your side.
Output: Confirmed scope, working access, interview plan. Who: lead and senior architect
Days 2 to 5: data collection and interviews
Goal: Get a complete, verified picture of the current state.
- Automated configuration export and resource inventory (Azure Resource Graph, AWS Config and Organizations).
- Analysis of the network, identities and assigned roles.
- Security score from Defender for Cloud or Security Hub, and its verification.
- Cost breakdown for the last 3 months by service and environment.
- 45 minute interviews: infrastructure, development, security, network, finance if relevant.
Output: Resource inventory and current-state map with a diagram. Who: middle collects and processes data, senior architect runs the interviews
Days 6 to 8: assessment and target architecture
Goal: Name the risks and propose where the environment should go.
- Traffic-light assessment of the six areas with reasoning and references to concrete findings.
- A list of the main risks with impact and likelihood.
- Target architecture design, with options and their pros and cons where there is more than one way.
- Ongoing consultation of open points with your technical contact.
Output: Assessment, risk list and target architecture (draft). Who: senior architect, review and decisions by the lead
Days 9 and 10: roadmap and readout
Goal: Turn the conclusions into a plan you can decide on and start.
- A roadmap over three horizons: 0 to 3 months (quick wins), 3 to 6 months, 6 to 12 months.
- Effort, dependencies and a price from our catalogue for every step.
- A 60 to 90 minute readout for management and the technical team.
- Handover of the final document and diagrams.
Output: Final document, priced roadmap, presentation. Who: lead and senior architect

How we work together

Main contact: The project lead (a senior). Accountable for the result, deadlines, risks and decisions. Day to day you can talk to anyone on the team directly.
Communication: A shared Slack or Teams channel and a ticketing system of your choice. Every question and change leaves a trail.
Kick-off: At the start we confirm the scope, access, contacts and the dates of the key milestones.
Weekly status: A short 15 to 30 minute sync: what is done, what is next, what we need from you and which risks we see.
Final readout: We present the results to your team and management and go through the next steps.
Escalation: Junior → middle → project lead. If a deadline or a major risk is at stake, the project lead contacts you the same day.
Working hours: Working days, 8:00 to 17:00 Central European Time. Production changes happen in a window you choose, always through your change management.

What we need from you

The timeline holds if we have the following. If something is delayed, the schedule moves by the same time and we tell you straight away.

A contact person who decides the scope and can arrange access and people for interviews.
Read-only access to every subscription or account in scope, by day two at the latest.
Access to costs (Cost Management Reader or Cost Explorer).
3 to 5 people for 45 minute interviews during the first week.
Existing documentation if you have it (diagrams, address plan, policies, earlier audits).
Management attending the final readout.

Access and security

Every team member has their own named account. We do not use shared accounts.
We ask only for the permissions a phase needs. Where read access is enough, we work read-only.
We do not take data out of your environment. Our documents contain only the summaries the result needs.
When the project ends, you remove our access, or we remove it on request and confirm it.
If you wish, we sign an NDA before the kick-off.

What is included and what is not

Included in the price

Assessment of one cloud (Azure or AWS) in six areas
Current-state map and diagram
Prioritised risk list
Target architecture with options
Roadmap over three horizons with effort and prices
Readout for management and the team
Answers to questions about the document for 10 working days after handover

Not included: priced separately or on your side

Implementing the proposed changes (offered as separate projects following the roadmap)
A second cloud (priced separately)
On-prem infrastructure (we assess only its connection to the cloud)
Penetration tests and application code audits
Legal assessment of regulatory compliance

If we find during the project that reality differs from what we assumed, we tell you before we work outside the scope. We send a short estimate of the impact on price and timeline and continue only once you agree.

Deliverables and acceptance

Deliverable	Contents	Form
Document	Current state, six-area assessment, risks, target architecture, roadmap	PDF and Word
Diagrams	Current state and target architecture	draw.io and PDF
Risk list	Risks with impact, likelihood and recommended step	Excel
Roadmap	Steps over three horizons with effort and prices	Part of the document
Readout	Presentation of the conclusions for management and the team	Meeting and PDF

The project is done when:

We have handed over the document, diagrams and risk list.
The readout has taken place.
We have incorporated one round of your comments.

We hand over the deliverables and go through them with you. We incorporate comments in one round within 5 working days of receiving them.

Risks and how we handle them

Risk	How we handle it
Access is delayed	We move the interviews forward and start data collection as soon as access works. The schedule moves by no more than the delay.
Key people have no time for an interview	We offer a short written questionnaire and a 20 minute call instead of a 45 minute interview.
The environment is bigger than assumed	We tell you after data collection and propose either a narrower scope or a price adjustment. Nothing grows without your consent.
Concerns about access to sensitive data	We work only with configuration and metadata and never access application data.

Price and terms

CZK 73,000 excl. VAT, fixed price.

Duration: 1.5 to 2 weeks from the moment we have access.
Prices exclude VAT, invoiced in CZK or EUR.
Work outside the scope: a separate quote, always in advance.

What can follow

Next steps

1A short 30 minute call: we look at your environment and check that the service fits what you need.
2We confirm the scope, the start date and the contact people.
3We send the contract and the list of access we need to start.

Frequently asked questions

Do you need write access?

No. The review is strictly read-only and we change nothing in your environment.

How does the review differ from the NIS2 analysis?

The review assesses architecture, operations and cost as a whole. The NIS2 analysis maps the specific legal requirements onto your infrastructure. They often follow one another.

Do we then have to order the implementation from you?

No. The roadmap works for your own team or another supplier too. The quick wins are written so they can be done right away.

What if we have both Azure and AWS?

The second cloud is priced separately. It usually pays to start where most of your workload runs.

Tell us what you are working on.

Thirty minutes, free. We reply within one working day.