AWS Cloud Migration Readiness Assessment: The 47-Point Checklist for MAP and Your Business Case
Quick summary: July 2026: MAP Mobilize should not start with more than five failed Platform/Security controls. 47-point readiness checklist (People, Platform, Security, FinOps) for Assess gates (CAF 3.0 + Migration Lens, after Migration Hub).
Key Takeaways
- July 2026: MAP Mobilize should not start with more than five failed Platform/Security controls
- 47-point readiness checklist (People, Platform, Security, FinOps) for Assess gates (CAF 3.0 + Migration Lens, after Migration Hub)
- As of July 19, 2026, AWS Migration Hub remains closed to new customers as of November 7, 2025
- Net-new programs should anchor on AWS Transform, AWS Transform MGN, and MAP, not legacy hub onboarding
- CAF 3.0 still frames organizational capabilities; your CFO funds waves with evidence
Table of Contents
As of July 19, 2026, AWS Migration Hub remains closed to new customers as of November 7, 2025. Net-new programs should anchor on AWS Transform, AWS Transform MGN, and MAP, not legacy hub onboarding. CAF 3.0 still frames organizational capabilities; your CFO funds waves with evidence.
This checklist is the 47-control readiness gate we attach to Assess → Mobilize: People (10), Platform (12), Security (13), FinOps (12). It complements CAF in practice, MAP funding, and migration cost surprises.
Why Assess artifacts matter more than slides
MAP Assess expects a defensible business case and migration plan. Auditors and AWS reviewers look for:
- Discovery inventory with owners (not just server names).
- TCO with parallel-run and data transfer line items.
- Wave plan with 7 Rs classification per workload (migration strategy guide).
- Risk register with rollback criteria.
The checklist below is how you prove those exist before replication agents touch production subnets.
The four pillars (summary)
People (10 controls)
Fails here mean cutover without on-call ownership or FinOps sign-off. Minimum bar: P1 executive sponsor, P4 skills plan, P10 FinOps liaison.
Platform (12 controls)
Fails here mean you will migrate into a heroic account. Minimum bar: PL1 Organizations, PL4 network topology, PL7 tooling path (MGN/DMS/Transform), PL10 central logging.
Security (13 controls)
Fails here mean audit findings post-cutover. Minimum bar: S1 SCPs, S3 Security Hub or documented deferral with risk acceptance, S13 org CloudTrail. Pair with cloud compliance services when scope spans HIPAA, PCI DSS, or SOC 2 alongside the cutover.
FinOps (12 controls)
Fails here mean surprise invoices. Minimum bar: F1 tag policy, F5 parallel-run budget, F6 data transfer model, F9 MAP tags if pursuing credits. Programs without dedicated FinOps capacity often partner with FinOps consulting through the parallel-run window so the invoice surprise lands on a dashboard, not a board slide.
Full tables with evidence columns: copy from the artifact (link below).
MAP gate: when Mobilize may start
Rule we use: ≤5 Fail across Platform + Security combined, zero Fail on P1 (sponsor) and F5 (parallel-run budget).
| Gate | Pass | Fail consequence |
|---|---|---|
| Assess complete | Discovery + TCO + wave plan stored | MAP phase slip; partner SOW change order |
| Mobilize start | Platform/Security threshold met | Replication without landing zone → tenancy refactor |
| First prod cutover | All S* controls Pass or accepted risk | Audit / breach exposure |
Sample deliverables (what “Pass” looks like)
- Discovery: CSV or Transform export: app name, owner, RTO/RPO, dependencies, data class.
- TCO: 36-month model with NAT, cross-AZ, licensing, and weeks of dual-run explicit.
- Wave 0: Landing zone + tagging + logging only (no app cutover).
- Runbook: Cutover + rollback + communications template.
What broke when readiness was skipped
When lift-and-shift readiness is enough vs not
Enough: regulatory window mandates datacenter exit; apps are ISV binaries you cannot refactor pre-cutover; discovery is complete.
Not enough: collations change, you need app-level changes for cloud networking, or data gravity requires refactor-first (7 Rs).
What to do this week
- Copy the 47-row checklist into your program wiki.
- Mark Pass/Fail with ticket links instead of oral “we’re fine.”
- Block Mobilize if Platform + Security fails exceed threshold.
- Schedule Migration Lens review on the pilot workload after Wave 0.
What this post does not cover
- Partner selection (when to hire a migration partner).
- DMS cutover drills (see migration mistakes post).
- Application modernization ROI (board business case).
- Industry-specific regulatory packs (HIPAA, PCI) beyond Security pillar references.
Services: AWS Cloud Migration · Related: Common migration mistakes (2026) · CAF + MAP + Well-Architected
If you only do one thing: Score Platform + Security before you install the first replication agent, not after the first failed audit.
Frequently asked questions
How is this different from the AWS Cloud Adoption Framework (CAF)?
When should we NOT start migration waves?
Does passing this checklist guarantee MAP funding?
What goes wrong if we skip Assess and jump to MGN replication?
How long should Assess take?
Where does AWS Transform fit after Migration Hub closed to new customers?
AWS Cloud Architect & AI Expert
AWS-certified cloud architect and AI expert with deep expertise in cloud migrations, cost optimization, and generative AI on AWS.
