Landing zone

A landing zone is the foundation everything else in the cloud stands on: how subscriptions and accounts are created, who has which permissions, how the network is built, which security rules apply and where the logs go.

from CZK 205,000

Small CZK 205,000 in 5 to 6 weeks, Medium CZK 380,000 in 8 to 10 weeks, Enterprise from CZK 750,000. Excl. VAT.

Book a consultation

What we offer

With the right foundation, new teams and applications get a secure environment in minutes. Without it, every project builds its own.

We design the landing zone with you and deploy it as code from our module catalogue. In Azure we follow the Microsoft Cloud Adoption Framework, in AWS AWS Organizations and Control Tower. You get a working environment, the code repository, documentation and a trained team.

We do not write applications. We work only on infrastructure, cloud and DevOps.

When it makes sense

You are starting in the cloud or moving your first larger systems into it.
Your cloud grew ad hoc and you want to put it in order before it grows further.
You need to meet NIS2, DORA or internal audit requirements.
New development teams need environments fast, but safely.

What you get

A new environment for a team or project with one pull request, not weeks of tickets.
Security rules enforced automatically (regions, encryption, public access, tags).
One network with controlled data flows and an on-prem connection.
Central logs and a security overview across all environments.
Everything as code: auditable, repeatable, with a change history.

What exactly we do

Structure and governance: Management groups or organisational units, subscriptions and accounts split by environment and team, policies as code (allowed regions and SKUs, mandatory tags, encryption, no public IPs where they do not belong), naming.
Environment creation (subscription vending): A new subscription or account through Terraform, with the right policies, network and monitoring from the start.
Identity and access: Groups in Entra ID or IAM Identity Center, least-privilege roles, PIM and just-in-time access, break-glass accounts, MFA.
Network: Hub-and-spoke, address plan, firewall with rules as code, private DNS and private endpoints, the first two spoke networks, and depending on the option an on-prem connection (VPN, ExpressRoute or Direct Connect).
Security and logging: Central Log Analytics or CloudTrail, Defender for Cloud or Security Hub and GuardDuty, Sentinel with baseline rules from Medium up, the CIS baseline.
Infrastructure as code: A Terraform/OpenTofu repository, remote state, a plan/apply pipeline with approval, module documentation.

Options and scope

The price depends mainly on the number of subscriptions and environments, the on-prem connection and compliance requirements. We confirm the option after the first call. The descriptions are indicative.

Option	Typical environment	Price	Duration
Small	1 cloud, 1 region, up to 3 subscriptions or accounts, 2 environments (non-prod and prod), no on-prem connection	CZK 205,000	5 to 6 weeks
Medium	1 cloud, up to 10 subscriptions, 3 or more environments, VPN or ExpressRoute / Direct Connect, Sentinel	CZK 380,000	8 to 10 weeks
Enterprise	Several regions or a second cloud, stricter NIS2 or DORA regime, specific network requirements	from CZK 750,000	depends on scope

Who works on it

Four people work on the landing zone. The effort in days is for the Small option and grows proportionally for the larger ones.

Lead (senior)
1.5 days

Responsible for
Runs the project, decides the subscription, identity and network model, approves the design with you, checks the deployment and leads the handover.

What you get from them
Main contact, approved design, handover
Senior
8 days

Responsible for
Runs the workshops, prepares the design (structure, network, policies, logging), reviews the code and verifies security.

What you get from them
Design, architecture, quality control
Middle
11 days

Responsible for
Deploys the landing zone from modules: policies, identities, hub network, firewall, logging, Defender and Sentinel, on-prem connection.

What you get from them
Deployed landing zone
Junior
4 days

Responsible for
Repository, state and pipeline, policy tests, runbooks and documentation.

What you get from them
Repository, tests, documentation

We assign work by complexity: juniors do routine work from templates, the middle takes the harder parts, and the senior owns the design, quality control and risk decisions. You do not need to decide who does what. The effort in days is indicative and only explains the price. The price is fixed and does not depend on the days actually worked.

How the project runs

The project has four phases and takes 6 weeks for the Small option; for Medium, phases 2 and 3 grow and the project takes 8 to 10 weeks in total. Policies first run in audit mode so nothing blocks your operations, and we switch to enforcement only after reviewing the findings with you.

Weeks 1 and 2: discovery and design
Goal: Agree how your cloud will be organised.
- Three 2 hour workshops: organisation and governance, identity and access, network and security.
- Requirements: compliance, regions, on-prem connection, existing resources and what to do with them.
- Design: structure, subscription model, identities and roles, network and address plan, policies, logging, naming and tags.
- Service Catalog v1: which cloud services to allow and under which rules.
- An estimate of the monthly running cost of the landing zone itself.
Output: A design document approved by you. Who: senior runs the workshops and writes the design, lead decides and approves
Weeks 3 and 4: foundation
Goal: Build the control layer: code, policies, identities, logs.
- Repository, remote state and a plan/apply pipeline with approval.
- Management groups or OUs, policies in audit mode.
- Identities: groups, roles, PIM, break-glass accounts.
- Central logging from all subscriptions.
Output: Control layer deployed as code. Who: middle deploys, junior repository and pipeline, senior review
Weeks 4 and 5: network and security
Goal: Build the network and the security overview.
- Hub network, firewall with rules as code, private DNS, private endpoints.
- The first two spoke networks.
- Defender for Cloud or Security Hub, Sentinel in the larger options.
- On-prem connection (Medium and up) together with your network team. The hub stays theirs.
Output: Working network and security monitoring. Who: middle, senior for network and security
Week 6: verification and handover
Goal: Prove the landing zone works and hand it to your team.
- Review of the audit-mode findings with you, switching policies to enforcement.
- Tests: a forbidden action must fail, a new environment must be created with one pull request.
- Runbooks: new environment, adding a network, policy exemption, using a break-glass account.
- A handover workshop for your team.
Output: Landing zone handed over, runbooks, trained team. Who: lead runs the handover, junior runbooks, middle tests

How we work together

Main contact: The project lead (a senior). Accountable for the result, deadlines, risks and decisions. Day to day you can talk to anyone on the team directly.
Communication: A shared Slack or Teams channel and a ticketing system of your choice. Every question and change leaves a trail.
Kick-off: At the start we confirm the scope, access, contacts and the dates of the key milestones.
Weekly status: A short 15 to 30 minute sync: what is done, what is next, what we need from you and which risks we see.
Final readout: We present the results to your team and management and go through the next steps.
Escalation: Junior → middle → project lead. If a deadline or a major risk is at stake, the project lead contacts you the same day.
Working hours: Working days, 8:00 to 17:00 Central European Time. Production changes happen in a window you choose, always through your change management.

What we need from you

The timeline holds if we have the following. If something is delayed, the schedule moves by the same time and we tell you straight away.

A project owner who makes decisions on the design.
Owner rights on the tenant or organisation for the duration of the project, and help from your Entra ID administrator with PIM and groups.
Access to the billing account (EA, MCA or AWS Organizations) to create subscriptions and accounts.
Your network team at the workshop and for the on-prem connection, including the on-prem IP ranges.
The list of existing subscriptions and a decision on what to do with them.
A person who approves the security policies.

Access and security

Every team member has their own named account. We do not use shared accounts.
We ask only for the permissions a phase needs. Where read access is enough, we work read-only.
We do not take data out of your environment. Our documents contain only the summaries the result needs.
When the project ends, you remove our access, or we remove it on request and confirm it.
If you wish, we sign an NDA before the kick-off.

What is included and what is not

Included in the price

Design and deployment of the landing zone within the chosen option
Policies, identities, network, logging and security monitoring as code
Environment creation through Terraform (subscription vending)
The first two spoke networks
Repository, pipeline, runbooks, handover workshop

Not included: priced separately or on your side

Moving existing resources and applications into the new structure (priced after the design)
The on-prem side of the VPN or ExpressRoute
Cloud fees for landing zone services (firewall, Sentinel, Defender) that you pay the provider
Running it after handover (offered as the Managed DevOps team)
24/7 on-call

If we find during the project that reality differs from what we assumed, we tell you before we work outside the scope. We send a short estimate of the impact on price and timeline and continue only once you agree.

Deliverables and acceptance

Deliverable	Contents	Form
Design document	Structure, identities, network, policies, logging, cost estimate	PDF and Word
Service Catalog v1	Allowed services and their rules	Document
Landing zone code	Terraform/OpenTofu, state, pipeline	In your repository
Deployed landing zone	A verified, working environment	In your cloud
Runbooks	New environment, network, policy exemption, break-glass	Markdown in the repository
Handover workshop	Training for your team	Recorded meeting

The project is done when:

Policies are enforced and the forbidden-action test fails.
A new environment is created with one pull request, with the right policies, network and logging.
Logs from every subscription or account land in central storage.
The break-glass procedure is verified.
Your engineer has created a new environment alone, following the runbook.

We hand over the deliverables and go through them with you. We incorporate comments in one round within 5 working days of receiving them.

Risks and how we handle them

Risk	How we handle it
Existing resources break the new policies	Policies first run in audit mode. We go through the findings with you and switch to enforcement only once agreed.
The network team has other priorities	We agree the dates for the hub and the connection in the first phase. The hub stays owned by your network team.
Tenant-level permissions are missing	You get the list of required permissions on day one, so there is time to arrange them.
Scope grows during the project	Changes go through a change request with an estimate of the impact on price and timeline.

Price and terms

from CZK 205,000 excl. VAT for the Small option. Medium CZK 380,000, Enterprise from CZK 750,000.

Design only (phase 1): CZK 72,000. The price of each option already includes the design: if you order the deployment within 3 months, the CZK 72,000 is credited and you pay the option price in total.
The landing zone code lives in your repository and you can keep changing it. The contract sets the terms for using the modules from our catalogue.
Prices exclude VAT, invoiced in CZK or EUR.
Work outside the scope: a separate quote, always in advance.

What can follow

Next steps

1A short 30 minute call: we look at your environment and check that the service fits what you need.
2We confirm the scope, the start date and the contact people.
3We send the contract and the list of access we need to start.

Frequently asked questions

What happens to our existing subscriptions?

The design decides which to keep, move or close. Moving the resources is priced separately, because its scope is only clear after the design.

Why modules from your catalogue instead of code from scratch?

The modules are proven on other projects, which shortens delivery and lowers the price. The code still lives in your repository and your team can read it.

Will the new policies block our operations?

No. Policies first only report violations. They start enforcing only after we have reviewed the findings with you.

Tell us what you are working on.

Thirty minutes, free. We reply within one working day.