What should be in the data room before a review?

The data room requires twelve months of billing history, current architecture documentation, and access. A read-only role in each account is preferred over documentation alone.

How does a cloud bill help in due diligence?

Cloud spend acts as a proxy for architecture and technical maturity. It reveals whether a company optimises costs through reserved instances or auto-scaling.

What defines a lift-and-shift system?

A lift-and-shift system runs patterns from a previous data centre without cloud-native optimisations. It often lacks autoscaling and data lifecycle policies.

Getting Started With Cloud Architecture Due Diligence

"The workloads sit in somebody else's data centre, so what is there left to buy?"

The boundary is the right place to start, as it comes up inside the first ten minutes of a cloud diligence call. Cloud architecture due diligence establishes what a target owns, what it has delegated, what it has configured, what it pays for, and what it could not walk away from quickly even if it chose to. A managed service removes operational tasks; it does not remove the decisions that produced them, and it does not remove the invoice those decisions generate.

What does cloud architecture due diligence cover?

Dextra Labs lists the areas a full engagement may cover as architecture, codebase, infrastructure, security, data and privacy, intellectual property and licensing, product roadmap, team capability, artificial intelligence components, and operations. The depth applied to each area is set by the risk profile of the transaction rather than by headcount, which is why two companies of a similar size can justify very different scopes. A glossary definition at nhimg.org defines cloud due diligence as an evidence-based review of whether a provider can safely hold the parts of a workload that a customer intends to outsource, and the reader can map it to controls including AC-2 for account management, CP-9 for system backup and CA-3 for system interconnections in NIST SP 800-53 Rev 5, alongside A.5.19 and A.5.20 of ISO/IEC 27001:2022. Those frameworks share a property that matters here: they set out obligations rather than products. The exercise is not a test of whether the cloud works. It is an assignment of answerability for the specific parts of the environment that fail.

What has to be in the data room before the review starts?

Three items decide whether the rest of the work is worth the fee: twelve months of billing history, current architecture documentation, and access. Dextra Labs advises that architecture diagrams, system documentation, security reports and roadmaps, ready in advance, reduce the time spent gathering basic information and let the assessment start on analysis. Hava argues that cloud environments change so frequently that documentation is rarely current at the time a buyer requests it, so a read-only role or cross-account access added to the provider accounts is the more durable answer, because it shows what is running rather than what was drawn. Dextra Labs reports that early access to repositories, cloud environments and technical stakeholders shortens an engagement, and that delay in granting it extends one. The request at the start is therefore narrow: the bills, a read-only role in each account, and a named engineer who can explain what the diagrams leave out.

What does the cloud bill reveal that the architecture diagrams do not?

Cloud spend is a proxy for architecture, and it is the only proxy that has been kept continuously. Vaultinum sets out the case for reading cost as a signal of technical maturity, citing Flexera's 2023 State of the Cloud Report for savings of up to 72 per cent on cloud expenses through reserved instances. The same source reports an e-commerce platform that cut its cloud expenses by 40 per cent after it replaced continuously running virtual machines with auto-scaling and serverless computing. The cloud due diligence checklist for PE transactions assigns companies with low cost-management maturity an optimisation potential of 25 to 40 per cent, identifies tag coverage above 80 per cent and reserved instance or savings plan coverage above 60 per cent for steady-state workloads as signs of a company that watches what it spends, and classifies a monthly bill growing 30 per cent year over year with no explanation tied to revenue growth as a warning sign. The same checklist gives a bill treated as a single line item, with no breakdown by product, environment or team, as the bad case.

The cloud bill is the audit trail of every architectural decision that was never written down.

How do you tell a cloud-native system from a lift-and-shift one?

The architecture part of the same checklist starts from one question: whether the application is cloud-native or was a lift-and-shift migration. A lift-and-shift system is a provider's data centre running patterns imported from the previous one, sized to a demand that has since changed. The separating questions are mundane. Is autoscaling configured for variable workloads, or does capacity sit provisioned for a peak that comes twice a year? Are databases sized to current demand, or to the demand that existed when they were created? Is there a data lifecycle policy that shifts aging data to cheaper storage tiers, or has the same data accumulated at the top tier since launch? Is the architecture multi-tenant or single-tenant, and does anyone know the cost difference? The same checklist sets out the bad case plainly: oversized instances with no autoscaling, databases still on the instance size they were provisioned with two years ago, and storage costs growing unchecked at 20 to 30 per cent a year with no lifecycle policy. It rates architectural inefficiency the largest category of cloud waste by potential cost and the most expensive to fix, and calls for 6 to 18 months and dedicated engineering resources in the plan. Hava's case for architecture diagrams rests on the questions a diagram answers faster than a repository: how resources are provisioned, where load balancing sits, whether any component is a single point of failure once its dependencies are drawn, and which external systems the design depends on.

Where does security sit in a cloud architecture review?

Security is not a separate workstream running in parallel with the architecture. It is a property of the configuration, which is why the same evidence answers both questions. The glossary definition at nhimg.org advises testing a provider's security claims against concrete artefacts rather than marketing language, covering access control, encryption, logging, vulnerability management, backup and recovery, segregation of duties, and the operational processes behind them. The same checklist wants to know whether the environment is organised with service control policies, whether identity and access management roles follow least privilege, whether multi-factor authentication is enforced for all console access including root, whether any storage bucket or database is publicly reachable, and whether audit logs are enabled and retained for at least twelve months. The bad pattern it sets out is a single account with root credentials shared across a team, no multi-factor authentication, and a last security assessment given as never. The same source values a major breach at $1 million to $10 million in direct costs and estimates security remediation after a review at $50,000 to $200,000. A compliance gap does not appear in EBITDA. It appears in the indemnity, or in the timetable.

What ties the target to its provider?

A commercial relationship can be as hard to leave as a technical one. The checklist asks whether an enterprise discount programme or private pricing agreement is active, on what terms and commitment levels and with what expiry; whether the company buys through a partner or reseller; whether marketplace commitments or third-party licences are tied to the cloud account; and what support plan level is in effect and how much of it is used. The same source states an enterprise support plan costs $15,000 a month or more where utilisation is low, and gives 5 to 15 per cent of total cloud spend as the saving available to a company that qualifies for an enterprise discount programme and has not negotiated one. The nhimg.org glossary definition includes the exit test: data return, deletion assurances, backup portability, and dependence on proprietary services, because a provider that becomes the only practical path for authentication, logging, monitoring or recovery concentrates risk that cannot be reduced later without migration work.

What does the assessment cost, and what does it produce?

Sparkle Technologies reports that technology due diligence for a private equity or venture deal typically costs between $10,000 and $150,000 in 2026, split into a red-flag review at $10,000 to $35,000 delivered in days, a standard assessment at $35,000 to $95,000 over one to two weeks, and a comprehensive platform engagement at $60,000 to $150,000 or more, with the same scope from a large advisory practice landing at $50,000 to $150,000. Dextra Labs gives indicative pricing for its own tiers: a one-week review at $5,500, a comprehensive engagement of three to four weeks at $22,000 to $50,000, and a remediation workshop retainer at $12,000 to $15,000 a month over three to six months, with a focused review quoted at $5,000 to $25,000 in the United States, AED 12,000 to AED 70,000 in the United Arab Emirates and SGD 7,000 to SGD 20,000 in Singapore. The Digital Marketplace listing for Equal Experts sets the price for assessment work at £250 to £1,500 a person a day. Sparkle Technologies adds that the tiers are depth grades rather than quality grades: a red-flag review on a small add-on can be exactly the right purchase, and the same review on a large platform acquisition is a false economy.

What comes back is judged by whether a committee can act on it. Sparkle Technologies holds that each finding in the report needs three things: the risk in plain terms, its materiality as a deal-breaker, a cost to absorb or noise, and its remediation cost in money and time, ready for the model. A report a partner who does not write code cannot act on has failed at its job, however thorough the appendix. The point of the exercise is not a verdict on the cloud. The due diligence report is a costed, evidenced account of what the buyer is taking on and which parts of it will need money spent before the thesis works.