Utility cloud migration cost and security incident
An energy utility has 200 applications, and 30% now run in the public cloud. The monthly cloud bill has risen 240% in a year, and 18% of provisioned workloads are idle outside business hours. Three teams each created separate cloud accounts with no central tagging. A security incident exposed a public storage bucket containing outage schedules for two days before detection. The CFO wants a spending freeze on cloud migration. The CTO wants to finish migrating all 200 apps within 12 months. The regulator requires data residency in-country and auditable change control. The utility has no FinOps function, no landing zone, and no cloud center of excellence. Application owners are skeptical of shared services because a previous internal platform team was disbanded after 18 months. Some workloads are latency-sensitive grid-control systems that must remain on-premises. The executive committee asks for a decision on the freeze and a 12-month plan.
1. Should the CFO's cloud spending freeze be accepted? Diagnose the causes of the 240% bill increase and the security incident.
Read the worked answer
A blanket freeze treats symptoms, not causes. The 240% increase is consistent with lift-and-shift, missing tagging, no rightsizing, 18% idle workloads, and separate accounts without guardrails. The public bucket incident points to missing landing-zone controls, least privilege, encryption, and detection. A long freeze would stop new migration but not reduce existing waste, and it could delay security remediation. Accept a short pause on new migrations to fix foundations, not an open-ended freeze. The causes are operating-model gaps: no FinOps, no landing zone, no center of excellence, and no shared accountability between finance, security, and engineering. The previous platform team's disbandment explains skepticism but does not remove the need for guardrails. The CTO's 12-month all-apps target is not credible without workload placement criteria. Recommend a 30-day baseline and remediation before resuming.
2. Recommend a 90-day remediation plan covering FinOps, security, and workload placement. How would you decide which apps remain on-premises?
Read the worked answer
Days 1-30: inventory all accounts and workloads; tag by application, owner, environment, and data class; enable cost dashboards and showback; close public buckets; enforce encryption, logging, and least privilege; define a landing zone with policy as code. Days 31-60: rightsize the top 20 workloads; schedule non-production shutdown; buy commitments only after a baseline; create a FinOps guild with finance, engineering, and security. Days 61-90: publish placement criteria and assess applications. Keep latency-sensitive grid-control systems on-premises or at the edge; keep regulated data in-country; allow bursty analytics in cloud where audit and residency are satisfied. Use a structured assessment: retain, rehost, replatform, refactor, repurchase, or retire. Resume migration only for workloads that pass placement and guardrail checks. Measure cost per transaction, idle percentage, tagging coverage, mean time to detect incidents, and migration readiness.