Cloud Consultants near you

Discovery comes first, and it is mostly inventory: what systems exist, what data each holds, who uses them, what depends on what, and which vendor sits behind each one. A data map matters more here than in most IT projects, because the destination for each category of information is a decision you are about to make and later have to justify.

A pilot with a small group follows, chosen to include the awkward cases rather than the cooperative ones: the person with an enormous mailbox, the department with a shared drive structure nobody understands, the application with a hard-coded server name. Problems found here are cheap; the same problems found at cutover are not.

Cutover should have a written plan with a rollback point, a communication to staff about what changes for them, and support available in the following days when the questions arrive. Decommissioning the old environment comes last and deliberately late, after restores have been tested from the new platform. Aftercare is part of the project: agree in advance who answers questions in the weeks after the move and whether that time is included.

The Privacy Commissioner's guidance on transfers for processing is the clearest statement of what Canadian businesses must do when data is processed elsewhere. Organizations must be transparent about it: customers should be told in clear and understandable language that their information may be processed in another country and may be accessed by the courts, law enforcement and national security authorities of that jurisdiction, ideally at the time the information is collected. Contracts should require comparable protection and address policies, staff training and security measures, with audit and inspection rights retained. The guidance is also realistic about the limits: no contract can override the criminal, national security or other laws of the country where the data sits.

Quebec adds a step that applies before the transfer happens. A Quebec enterprise must carry out a privacy impact assessment, an évaluation des facteurs relatifs à la vie privée, before communicating personal information outside Quebec or entrusting the collection, use, communication or conservation of that information to someone outside the province. The assessment considers the sensitivity of the information, the purpose, the protection measures and the legal framework applicable where it is going, and the enterprise remains responsible for the information after it has been communicated. If your consultant proposes a region without asking whether you hold Quebec personal information, they have skipped a legal step, not a preference.

Practical consequences follow. Ask which regions the design will place data in, whether that includes backups, replicas, logs and support access as well as production, and whether support staff outside the country can view customer data while troubleshooting. Residency of the primary database is the question people ask; the other four are where the surprises live.

The Cyber Centre's cloud security risk management guidance sets out how responsibility divides by service model. With infrastructure as a service, the consumer organization manages user access, data, applications and the platform while the provider handles the underlying infrastructure and facilities. With platform as a service, the consumer manages user access, data and applications while the provider takes the platform and infrastructure. With software as a service, the consumer manages user access and data while the provider manages the application and everything beneath it.

In every model the consumer keeps user access and data, which is precisely where most cloud incidents originate. The guidance is explicit that organizations are ultimately responsible and accountable for the security risks incurred by using services offered by external suppliers. A provider's certifications describe the provider's half of the split and say nothing about whether your administrators use multi-factor authentication or whether a departing employee's account was disabled.

The guidance also treats security as continuing rather than a one-time authorization, with continuous monitoring during operation to detect deviations in both the provider's and the consumer's portions of the service. Ask a consultant to state plainly which half of each control belongs to you after the migration, because that list becomes your standing operational obligation.

A migration ends but the configuration keeps drifting: staff join and leave, applications are granted access, sharing links accumulate, and the provider changes defaults on its own schedule. The Cyber Centre's baseline controls include securing cloud and outsourced services and enforcing strong authentication, and its risk management guidance treats monitoring as continuous rather than a closing task. Neither is satisfied by a project sign-off.

Set a short recurring review: administrative roles and who holds them, accounts that should have been disabled, external sharing on your most sensitive repositories, third-party application consents, sign-in failures and unusual locations, and a restore test from the platform's backup. Agree whether this is work the consultant continues to do, work your IT support provider absorbs, or work someone internal owns, because the common outcome is that each assumes one of the others is doing it.

Keep the architecture documentation current and in your own possession, including tenant identifiers, domain registrar access, licence assignments and the design decisions behind the regions chosen. That document is what makes the next project affordable and what protects you if the relationship ends abruptly.

Your organization should own the tenant, the domain and the billing relationship, with the consultant holding delegated administrative access that can be revoked. This is easy to arrange at the start and genuinely difficult to unwind later, and it is the most frequent regret in cloud engagements. Ask directly whose name the subscription will be in before work begins, and confirm you have a global administrator account under your own control.

Agree what handover includes: architecture documentation, a record of configuration decisions, administrative credentials, licence inventory and any scripts or templates built for you. Where the consultant also supplies ongoing support, keep the project deliverables separate from the support agreement so that ending one does not strand the other. The Cyber Centre's contracting guidance suggests retaining legal ownership of your data and the right to end the arrangement if circumstances change materially, which applies just as well to a consultant who administers your tenant.

Ask about exit before you need it: how data is exported if you leave the platform, what format it comes out in, and what is lost in the process. Portability is a design decision made at migration time, and it is far cheaper to preserve then than to recover later.