Build the foundation once, properly, before anything lands on it

The assessment answers one question: what shape does the foundation need to be, given how this business is actually funded, staffed and regulated. Structure decisions are the expensive ones to reverse, so they get made on evidence.

• Current estate inventory. Every existing subscription or account, who owns it, what it runs and whether it is in a position to be moved under a hierarchy.
• Hierarchy shaped by funding. Management groups or organizational units modelled on how work is funded and regulated rather than the current org chart, because reorganisations happen and re-parenting later is disruptive.
• Control baseline agreed and classified. Each guardrail marked as enforce now, audit first or out of scope, with the exemption approver named before anything is switched to deny.
• IP address plan before the first workload. Ranges allocated across regions and environments, which is cheap now and very expensive once transit attachments and private circuits depend on them.
• Australian region reality check. Feature and region availability confirmed for Australia East and Australia Southeast, recorded with the verification date, because parity is not guaranteed.
• Operating model written down. Who owns connectivity, who approves an exemption, who answers an environment request, and what the response to drift is. Built before the platform, not after.

We start from the vendor's published accelerators and modules rather than hand-rolling equivalents, because the hand-rolled version looks faster for three months and then becomes an upgrade cliff nobody is funded to climb.

• Platform separated from applications. Identity, connectivity and management held in dedicated platform environments, with application environments placed beneath and inheriting from them.
• Vendor modules over bespoke code. Published accelerator and verified module patterns as the starting point, so upstream improvements arrive as an update rather than a reimplementation.
• Vending automated from the start. A new environment is produced by a pipeline that attaches policy, logging, network and access before anyone gets a login, not afterwards by checklist.
• Central transit, not a peering mesh. A hub topology with route segmentation and shared network constructs, because a peering mesh stops scaling past a small number of accounts.
• Logs written where they cannot be edited. A dedicated archive destination that workload environments can write to but not alter or delete, sized against retention and residency requirements.
• Everything through a pipeline. Every layer deployed from version-controlled code with drift treated as a defect, because out-of-band edits break the repeatability the foundation was bought for.

A landing zone is mostly a security deliverable wearing an infrastructure hat. The controls are only worth having if they are inherited automatically and can be evidenced without asking a workload team.

• Groups, never individuals. Human access granted through permission sets and role assignments to groups, so joiners and leavers are an identity change rather than a cloud change.
• Audit before deny. Preventive controls run in audit mode first, with the list of what would have been blocked published and reviewed before enforcement is turned on.
• Exemptions with an expiry. Every exception recorded against a named approver and a review date, because a permanent exclusion is how a control gets quietly disabled everywhere.
• Delegated administration. Security services operated from a delegated account rather than the management or root account, which stays out of day-to-day use.
• Encryption keys under your control. Customer-managed keys for centralised logging and platform data, with key access separated from the teams whose activity is being logged.
• Posture against one agreed baseline. A single documented standard both clouds report against, so a finding is a deviation from something you signed off rather than from a vendor default.

A foundation nobody knows how to use becomes a bottleneck, and a vending path slower than the portal will be bypassed. Adoption work here is mostly about making the governed route the easy route.

• The governed path made fastest. If requesting an environment properly takes longer than clicking around the portal, people will click around the portal. Speed is a control.
• Platform team enabled to operate it. Handover sessions on the hierarchy, the pipeline, the vending workflow and the exemption process, run against the real environment rather than slides.
• Application teams given a landing pattern. What they get by default, what they must not change, and how to ask for something the baseline does not allow.
• Runbooks for the predictable events. Onboarding an environment, opening a network path, adding a region, responding to drift and handling a failed policy remediation.
• Exemption process rehearsed. Walked through with a real blocked deployment before go-live, so the first genuine escalation is not also the first test of the process.
• Decisions recorded with their reasons. An architecture decision record per structural choice, so the next engineer inherits the reasoning and not just the result.

Landing zones decay in three specific ways: drift from console changes, accumulating skew because accelerator updates were skipped, and controls that were exempted once and never reviewed. Continuation watches those three.

• Drift detected and owned. Out-of-band changes surfaced against the deployed baseline and routed to a named owner rather than reported into a dashboard nobody opens.
• Accelerator and module currency. Upstream releases assessed and taken through your pipeline on an agreed cadence, because skipped upgrades eventually block the next change you need.
• Exemption register reviewed. Every exception revisited at its review date, with expired ones either renewed deliberately or removed.
• New region and service governance. Regions opted into and then actually governed, since an unreviewed region is a real gap rather than a theoretical one.
• Policy compliance interpreted, not just reported. Results lag and non-compliant is often a scope artefact rather than a control failure, so someone who understands the difference reviews it.
• Cost and tagging integrity. Attribution coverage tracked so showback stays accurate, with untagged spend chased before it becomes a reconciliation exercise.