Six steps from here you will have a one-page shortlist sheet listing at least three cloud migration consultancy options. The firms run down the left. The questions run across the top: delivery model, unit of price, the clearance level the firm can show, the artefact owed at the end of the engagement, and the lead who approves that artefact. An empty cell means the shortlist is unfinished. This page works backwards from that sheet and gives the order of work that fills it.
Cloud migration consultancy is sold as advice, and the packaging varies enough to make side-by-side scoring difficult. Pythian lists five stages, assess, define, migrate, test and support, and says its tooling uses AI to shorten the work. Vysiion sells a four-stage engagement of discover, define, assess and report through the UK Digital Marketplace under G-Cloud 14. IBM frames its own version as end-to-end, AI-powered migration services across public, private and hybrid clouds. Akita assesses existing infrastructure, workloads, hybrid, public or private requirements, pain points, security and compliance before it drafts a plan. Four suppliers, four products, one shared vocabulary. Work the steps in order and the overlap no longer muddles the shortlist.
1. The artefacts you are buying
Settle the list of deliverables before any supplier quotes a fee. Everything else in a proposal is scaffolding around that list.
- A current-state inventory with one responsible individual for every workload in scope.
- A placement decision for each workload, giving the target platform and the reason for it.
- A migration plan with a tested rollback and a maximum execution time for each step.
- A cutover runbook that identifies the role able to call off the migration and the evidence that would trigger that call.
Keep this step open until every item on that list has an individual responsible for approving it, and that individual is not the account manager. Where two suppliers would hand over different artefacts under the same heading, split the heading. A vague heading costs you the ability to score either proposal.
2. One scope for every quote
Ask each firm to price that identical list in a single unit. Vysiion publishes its rate on the Digital Marketplace G-Cloud 14 listing at £497 per unit per day, which gives you one anchor for a day-rate engagement. HJS Technology sells either a fixed-price discovery and migration package or a monthly retained advisory arrangement, so a retained proposal has to be turned into a total engagement cost before it can stand beside the others. Pythian opens with an assessment and then a roadmap. Audacia offers an initial consultation on the current setup and prices the work around what that finds. Three pricing shapes, three different purchases, until every firm quotes against the artefact list from step 1.
You can leave this step when you have three totals for the same list of artefacts. Rate cards measure effort. Totals measure what you are buying.
3. How each firm finds dependencies
Ask how dependencies will be located, since an inventory export lists assets without the connections between them. IBM says its discovery and assessment work gives in-depth analysis of the application landscape, infrastructure, network and data centre environment, and that this is what surfaces dependency identification and a readiness judgement. HJS Technology audits the servers, network switches, line-of-business software dependencies and user access permissions, and measures network throughput and application latency. Pythian reports that its assessment yields a technical blueprint of the current data landscape, exposes hidden application dependencies and maps workload profiles. Audacia assesses the existing infrastructure, dependencies, data flows and constraints with your own teams before a strategy is drafted.
Close this step when every workload in scope has a dependency list, a data classification and a recovery target, and one responsible individual has read all three. A firm that can show you the first and not the other two has run a stock take, not an assessment.
4. Where each workload lands
Ask each supplier to give a target platform for every workload and the reason behind it. Akita assesses hybrid, public or private cloud requirements alongside security and compliance needs before it drafts a plan. HJS Technology puts public, private and hybrid architectures beside each other and says a hybrid arrangement often suits organisations that need local file processing alongside offsite access. Cyber-Duck works cloud agnostically and selects a hosting setup to suit the organisation, optimising for resilience and cost-effectiveness. Pythian gives a treatment path for each workload, whether that is rehosting, replatforming or fuller modernisation.
The step is done when each workload has either a target platform with a documented reason or a documented decision to remain where it is. A consultancy that puts everything in the cloud has not finished the assessment, whatever its own delivery model happens to be.
5. Security evidence and clearances
Test the claims rather than the adjectives. Vysiion's entry on the Digital Marketplace lists ISO/IEC 27001 certification, Cyber Essentials, Cyber Essentials Plus, conformance to BS7858:2019 for staff vetting and government security clearance up to Developed Vetting, with cleared consultants who have worked in the public sector. HJS Technology advises buyers to check for ISO 27001 and Cyber Essentials accreditation and to confirm direct access to technical consultants rather than account managers, and it points to UK GDPR data sovereignty and the NCSC cloud security principles as tests any migration should meet. AIM Consulting lists the target provider's Well-Architected framework, spanning performance, security, networking, auditing, data engineering, DevOps and disaster recovery, as knowledge a consultant should have.
Move on once the certification scope includes the migration service itself, the clearance level matches your data classification, and the contract identifies the individual responsible for security through cutover.
6. Cutover approval and the rollback test
Ask for the cutover runbook and the rollback test log before you approve anything. Pythian says it reduces risk through comprehensive mapping and continuous data synchronisation for complex cutovers, and keeps support running around the clock after go-live. Cyber-Duck provisions the new environment with Infrastructure as Code, builds or maintains CI/CD pipelines, completes quality, accessibility, security and compliance tests, then runs the final data migration and the DNS switch. Audacia tests migrated systems and data to keep operations continuous through the transition. IBM applies a declarative, continuous migration approach with automation and generative AI across discovery, execution and optimisation.
Finish this step when the runbook identifies the role able to call off the migration, the evidence that would trigger such a call, the day the rollback was last exercised, and the maximum execution time for each step.
Fill those cells and the sheet is finished. It will not rank the firms for you, because the right choice depends on your environment, your data classes and how much disruption you can absorb. What it will show is which firms replied to the same questions in the same units. Leave an empty cell and mark it unresolved rather than guessing, because unresolved items are the risks you take into the engagement. Keep the sheet with the approved assessment and the runbook. Once the migration starts, those documents are what you manage against.
Sources
- Cloud Migration Consulting Services | Pythian
- Cloud Migration Consultancy - Digital Marketplace
- Cloud Migration Consulting | IBM
- Cloud Migration Services London, UK - Akita
- Cloud Consultancy Hampshire: Strategic Cloud Migration and Management
- Cloud Migration Consulting Services & Solutions | London, UK
- Cloud Migration Consulting | Cloud Adoption & Migration
- Cloud Migration Consulting: How Can It Help Your Business?
