Skip to content

Company
- Home
- About us
- Our Team
- Engagement Models
- Partners
- Clients
- Careers
- Contact Us
Services
- App Innovate
- App Xcelerate
SMB Solutions
- NexGen AppVirtuX
- Digital Workspace Solutions
INDUSTRIES
Resources

Company
- Home
- About us
- Our Team
- Engagement Models
- Partners
- Clients
- Careers
- Contact Us
Services
- App Innovate
- App Xcelerate
SMB Solutions
- NexGen AppVirtuX
- Digital Workspace Solutions
INDUSTRIES
Resources

Get Started

Our Team

Home
Our Team

Vijay Pegallapati

Vijay is a key contributor at Ojasvi, driving innovation and growth through cutting-edge technology solutions tailored for SMBs, with a strong focus on Cloud and Modernization. His extensive expertise working with technology companies in Growth Strategy, and Clients Success fuels his commitment to solving complex customer challenges and delivering impactful, scalable solutions that foster business success. With over 24 years of experience, Vijay has forged strategic partnerships and closed numerous high-value deals, earning a reputation for excellence.

He holds an MBA in International Business from Symbiosis Institute for Management Studies and another Master’s in Advanced Accounting and Statistics from Kakatiya University, India. Further enhancing his credentials, he has specialized certifications in Strategic Management, AI, ML, and Insurtech from the prestigious Wharton School of Business.

A former professional athlete during his academic years, Vijay continues to channel his competitive spirit into his professional and personal life. In his free time, he enjoys traveling, volunteering, and supporting community initiatives, demonstrating his passion for making a positive impact both inside and outside the workplace.

Close

William Shih

With over 17 years of experience in the marketing industry, William Shih has done exceptionally well crafting strategies that fuel business growth and amplify brand presence. A graduate in economics from National Taiwan University, William blends sharp analytical skills with creative ingenuity, delivering data-driven campaigns that maximize ROI. His collaborative leadership style and innovative approach have consistently delivered exceptional outcomes. At Ojasvi, William spearheads marketing efforts, driving the company toward sustained success.

Outside the world of marketing, William channels his strategic expertise into real estate. As a versatile investor and dealmaker, he has many accomplishments in the field.

In his personal life, William’s love for adventure shines through. Whether hiking along picturesque trails, diving into water sports, or exploring breathtaking landscapes, he thrives on connecting with nature. His passion for the outdoors inspires his energy, creativity, and relentless drive to seek new horizons.

Close

Relevant Technology Solutions offers comprehensive IT services and solutions across various markets. Since our inception in 2020, we have focused on Custom Application Development, Application Modernization, Independent Testing Services, Cloud, Managed Services, and End User Computing Solutions…

Learn more.

Connect with us

Icon-facebook Icon-linkedin X-twitter Pinterest

Services

App Innovate
App Xcelerate

App Innovate
App Xcelerate

SMB Solutions

NexGen AppVirtuX
Digital Workspace Solutions

NexGen AppVirtuX
Digital Workspace Solutions

Compliance

Privacy Policy
Terms Of Use

Privacy Policy
Terms Of Use

RESOURCES

News
Case Studies
Brochure

Contact info

USA Office

410 E. Santa Clara Street, Suite # 939, San Jose, CA 95113

(408)660-8936

India Office

Prakruti Dew Drops Plaza 1-8-557/1, Unit 104 Road transport Corporation Crossroads, Hyderabad, Telangana 500 020

+918498812457
+1(408)660-8936

Privacy Policy
Terms Of Use

Privacy Policy
Terms Of Use

error: Content is protected !!

"*" indicates required fields

Step 1 of 7

14%

Cloud Governance Assessment Questionnaire

Digital transformation often requires skills across multiple roles and departments. This Migration assessment questionnaire will walk you through a series of questions to evaluate your company’s readiness for cloud migration in various areas.

Please take a moment to complete the questionnaire

How did you build your cloud governance team?

Your cloud governance team oversees cloud governance for your organization's cloud. Your team is responsible for assessing risks, documenting cloud governance policies, and reporting on the progress of cloud governance. They need to understand your organization's needs and ensure that cloud governance policies minimize risks.*

We defined the functions of our cloud governance team. Outline the specific tasks and responsibilities that the team must handle to manage your organization's cloud governance effectively.

We selected the members of our cloud governance team. Select the individuals that are responsible for overseeing and managing cloud governance within your organization.

We defined the authority of our cloud governance team. Empower your cloud governance team to effectively implement and oversee cloud governance.

We defined the scope of our cloud governance team. Establish the boundaries of your cloud governance team’s responsibility.

None of the above.

How do you assess cloud risks?

Every technology presents organizational risk. Risks are undesirable outcomes. When your organization adopts the cloud, your cloud governance team needs to identify the risks so they can create cloud governance policies to manage those risks.*

We identify cloud risks.Catalog a comprehensive list of cloud risks. Know the risks so you can create governance policies that effectively mitigate them.

We analyze cloud risks.Assign a qualitative or quantitatove ranking to each risk so you can prioritize them by severity. Consider the probability and the impact of a risk to determine its priority. Prefer quantitative risk analysis over qualitative for more precise risk prioritization.

We document cloud risks.Document each risk and the details of the risk analysis. Create a list of risks, called a risk register, that contains all the information you need to identify, categorize, prioritize, and manage risks.

We communicate cloud risks.Clearly convey the identified cloud risks to your executive sponsor and executive-level management. It's important to ensure that your organization prioritizes cloud risks.

We review cloud risks.Review cloud risks to ensure the risks are valid and accurate. Perform reviews regularly in response to specific events. Maintain, update, and remove risks as needed.

None of the above

How do you document cloud governance policies?

Cloud governance policies specify what should or shouldn't occur in the cloud. Your cloud governance team should create one or more cloud governance policies for each identified risk.*

We defined an approach for documenting cloud governance policies.Establish an approach for creating, maintaining, and updating the rules and guidelines that govern the use of your cloud services. Produce cloud governance policies that don’t require frequent updates, and consider the effects of cloud governance policies across your cloud environment.

We define cloud governance policies.Create cloud governance policies that outline how to use and manage the cloud to mitigate risks. Create a governance framework that manages risk.

We distribute cloud governance policies.Grant access to everyone who needs to adhere to cloud governance policies. Look for ways to make adherence to the cloud governance policies easier for people in your organization.

We review cloud governance policies.Assess and update cloud governance policies to ensure they remain relevant and effective in governing cloud environments. This approach helps maintain the policies alignment with evolving regulatory requirements, technological advancements, and organizational objectives.

None of the above.

How do you enforce cloud governance policies?

Cloud governance enforcement refers to implementing controls and procedures that align cloud activity to cloud governance policies. Atier your cloud governance team assesses cloud risks and creates cloud governance policies to manage those risks, they must ensure that cloud governance policies are enforced. They must delegate governance enforcement responsibilities, which empowers each team or individual to enforce cloud governance policies within their area of responsibility*

We defined an approach for enforcing cloud governance policies. Establish a systematic strategy to enforce cloud governance policies. Use a combination of automated tools and manual oversight to enforce policies efficiently.

We automatically enforce cloud governance policies.Use cloud management and governance tools to automate the enforcement of governance policies. Incorporate these tools to help set up guardrails, monitor configurations, and ensure compliance.

We enforce cloud governance policies manually as needed.In cases where you can’t automate the enforcement of cloud governance policies, enforce cloud governance policies manually. Sometimes a tool limitation or cost makes automated enforcement unpractical.

We review policy enforcement mechanisms.Regularly review and update policy enforcement mechanisms. Keep cloud governance policy enforcement aligned with current needs, including developer, architect, workload, platform, and business requirements.

None of the above.

How do you monitor cloud governance?

Continuously monitor your cloud environment to ensure that it aligns with cloud governance policies. Find an effective way to monitor governance and progressively reduce non-compliance issues to zero.*

We configured cloud governance monitoring.Implement monitoring solutions to track compliance with your organizational cloud governance policies.

We configured cloud governance alerts.Configure alerts based on specific compliance metrics or events that indicate a deviation from your governance policies.

We developed a remediation plan.Develop a targeted action plan to address any non-compliance events. When non-compliance is detected, carry out the remediation plan to correct the deviations and minimize the risk and impact on your cloud environment.

We audit cloud governance regularly.Even with automated monitoring, conduct periodic manual reviews and audits to validate compliance monitoring processes and ensure that automation tools are functioning correctly.

None of the above.

Do you have a centralized data governance and management view across your organization?

Initial. Your organization does not have a centralized data governance and management view across your organization.Your organization does not have a centralized data governance and management view across your organization.*

Evolving - Your organization has plans for a centralized data governance and management view across your organization.Your organization has plans for a centralized data governance and management view across your organization.

Acceptable - Your organization has researched and understand data management landing zone concept and its benefits.Your organization has researched and understand data management landing zone concept and its benefits.

Advanced - Your organization has a centralized data governance and management view across your organization.Your organization has a centralized data governance and management view across your organization

Optimized. - Your organization has implemented data management landing zone to provide the foundation for your platform's centralized data governance and management across your organization. Implement data management landing zone to provide the foundation for your platform's centralized data governance and management across your organization.

"*" indicates required fields

Step 1 of 40

2%

Planning Cloud Journey Assessment Questionnaire

Digital transformation often requires skills across multiple roles and departments. This Cloud planning assessment questionnaire will walk you through a series of questions to evaluate your company’s readiness for moving to cloud & strategy.

Please take a moment to complete the questionnaire

Did you select a cloud provider but haven't deployed anything yet?

Did you select a cloud provider but haven't deployed anything yet?*

Deployed VMs or PaaS services but not a workload (or a list of IT assets that support specific business functions).

Deployed a workload (or a list of IT assets that support specific business functions.

Deployed multiple workloads (or a list of IT assets that support specific business functions.

What areas interest you?*

Estimating the cost of operating in the cloud.

Architecting your current environment in the cloud.

Getting the cloud infrastructure ready in preparation for deploying a workload to the cloud.

Deploying a workload to the cloud.

Managing operations.

Operational fitness.

Process improvement.

What are the motivations for your cloud transformation?*

Estimating the cost of operating in the cloud.

Architecting your current environment in the cloud.

Reduce capital expenses.

Scale to meet geographic or market demands.

Increase business agility.

Optimize internal operations.

Build new technical capabilities.

Modernize security posture and controls.

Improve customer experiences and engagements.

None of the above.

Don't know.

Do your developers understand cloud-computing concepts and general cloud computing models and services, such as public, private and hybrid cloud services, like IaaS, PaaS, and SaaS?*

Are you responding to any critical business events, mergers, and acquisition, end of support for mission-critical technologies, or response to regulatory compliance change?*

Have you got any plan for the business outcomes that you want when you move to the cloud?*

Do these outcomes have associated business drivers, KPIs, and necessary technical capabilities?*

Have you developed a business case or performance economic assessment that could help provide business justification for moving to the cloud?*

Have you selected an initial cloud workload?*

Does your organization use a financial model to account for IT costs, for example a cost-center, chargeback, or profit-center model?*

Do you understand how to manage costs with Cloud planning journey?*

Does your organizaton need to run workloads across public cloud and on premises (hybrid cloud)?*

Do assets within your workload require connectivity to an on-premises servers/ datacenter?*

Does your organization need to run workloads across multiple cloud providers, for example Azure and Amazon Web Services or Google Cloud Platform?*

Do you have an approved and comprehensive project plan to drive your organization through transformation?*

Do you have a thorough inventory of assets, including applications, software, hardware, operating systems, and system performance metrics in place?*

Have you assessed the inventory of your current digital estate, such as apps, data, infrastructure, and process?*

What are you doing to create a skills readiness plan? Are you willing to work with Services provider like us for IT Talent?*

Are you moving apps to the cloud without making any modifications and without the risk and cost associated with code changes?*

Are you making major revisions to incorporate new capabilities, meet scalability requirements, apply innovative DevOps practices, or minimize the use of virtual machines to work effectively on a cloud platform?*

Are you rebuilding an app from scratch by using Microsoft/AWS cloud technologies to expedite business innovation, use cloud-native technologies, and take advantage of advancements in services, such as AI and containerization?*

If you decide to migrate/innovate, have you identified the minimum viable product for migration/innovation and corresponding tools?*

Have you thought about the order and relevance of processes that are used in relocating workloads ? The processes are migrate, modernize, innovate, and relocate.*

Align to different phases in the cloud adoption journey and find the right guidance.

Have you done a migration readiness assessment?*

Have you categorized your workloads for migrate, modernize, innovate, and relocate?*

How are you governing your cloud environments?*

Identify business risks and your risk tolerance. Mitigate those risks with governance and compliance policies. Execute recurring governance processes to monitor policy adherence.

Have you documented the evolving business risks and the business tolerance for risks?*

Do you have policies and security settings in place that ensure you adhere to compliance requirements?*

Have you implemented processes to monitor violations and adherence to corporate policies?*

Do you have a clear inventory of assets across multiple clouds and have visibility into the run state of each asset?*

Have you documented the criticality and business value of each workload?*

Have you established clear performance expectations and business interruptions time/value metrics?*

Have you established controls and processes to ensure each state is properly configured and running in a well-governed environment?*

Are all your managed assets protected and able to be recovered by using baseline management tooling?*

Do you have monitoring strategy in place for each of the cloud deployment models? The models are infrastructure (compute, storage, and server workloads), application (end-user, exceptions, and client), and network resources.*

Have you aligned your strategy, plan, and architecture with the Zero Trust principles?*

Has your organization modernized security strategies, architectures, and technologies as you've adopted and operated in the cloud?*

Have you selected and implemented the security benchmark that's aligned with your organization's needs, regulatory compliances, and controls?*

"*" indicates required fields

Step 1 of 52

1%

Devops Capability Assessment

Digital transformation often requires skills across multiple roles and departments. This DevOps assessment questionnaire will walk you through a series of questions to evaluate your company’s readiness to adopt continuous processes throughout.

Please take a moment to complete the questionnaire

Describe how your team plans, prioritizes, and schedules work.

An Agile development team typically operates from a backlog of requirements, often referred to as user stories. The backlog is prioritized to ensure that the most critical user stories are at the top. The product owner is responsible for managing the backlog, which includes adding, modifying, and reordering user stories based on customer needs. One of the most significant impediments to an Agile team's productivity is an ill-defined backlog. To consistently deliver high-quality software each sprint, it's essential to have well-defined requirements. <br> By completing features in accordance with the requirement specifications*

Within time-boxes, such as sprints or iterations lasting 1-4 weeks

Our goal is to achieve a continuous, one-piece flow of product backlog items, prioritized by their stack rank

We formulate measurable experiments based on hypotheses and utilize production data to evaluate the outcomes

We use other tools for planning

None of the above

Describe the methodology is used to estimate work.

Estimating in Agile software development differs from estimating in traditional IT delivery. Agile teams estimate the workload for the upcoming sprint and, potentially, a portion of the backlog for future sprints.In contrast, sequential IT delivery teams seek to provide precise estimates for the entire project, which may span many months or even years.*

T-shirt sizing

Planning poker

Dot voting

Story points

Story Counting

Swim Lane Sizing

None of the above

Can you describe how much work - equivalent to the number of sprints - is present on your backlog or to-do list?

During sprint planning, the team selects backlog items to include in the upcoming sprint based on priority and their estimation of what can be completed during that sprint. Breaking down these items into smaller tasks helps the sprint team better prioritize their work.*

Undefined, or unclear

A couple of sprints

More than a couple of sprints but less than three month's worth of work

Three month's worth of work or more but no more than six months

Up to a year's worth of work

More than a year's worth of work

Can you describe how many products your team is currently working on simultaneously?

Managing too many projects simultaneously can result in decreased morale among lower-level teams. When resources are stretched thin, they spend more time 'context switching' between projects, which significantly impacts their productivity.*

A couple of sprints

More than a couple of sprints but less than three month's worth of work

Three month's worth of work or more but no more than six months

Up to a year's worth of work

More than a year's worth of work

Can you describe how many products your team is currently working on simultaneously?

Managing too many projects simultaneously can result in decreased morale among lower-level teams. When resources are stretched thin, they spend more time 'context switching' between projects, which significantly impacts their productivity*

We work exclusively on one product.

We have a few things we are working on.

We work on dozens of products.

There are too many to count.

How do members of the team collaborate?

In your DevOps journey, inadequate communication can result in unfavorable outcomes. It is essential to maintain regular communication and collaboration within your team. Consider conducting daily stand-up meetings and leveraging tools such as work items, ChatOps, and other mechanisms for effective collaboration.*

We hold daily stand-up meetings and collaborate using work items, ChatOps, and other mechanisms.

We use e-mail or instant messaging for communication as needed.

We opt for weekly calls to ensure that we stay updated on our project.

Our teams operate in silos, and communication primarily occurs when issues arise.

None of the above

How does the team gather and measure feedback from customers and users?

Collecting feedback from your end-users and incorporating it into your development process is crucial for providing an excellent customer experience. A team adds value to the customer when they receive feedback and then adjust their backlog according to that feedback.*

Manual testing, user acceptance testing, or general acceptance criteria.

Direct email, phone, or web contact forms, web meetings, or chat.

In-product qualitative feedback (e.g., Send-a-Smile) and surveys such as Net Promoter Score (NPS).

We maintain ongoing engagement with our stakeholders, capturing and responding to feedback, as well as transforming and implementing new ideas into functionalities within our applications.

None of the above

How do coordinate or split work up across teams?

Agile assumes that each team possesses all the necessary resources to deliver an increment of work independently. This involves creating cross-functional teams equipped with the knowledge and permissions required to build, test, and deploy a product from start to finish with minimal external interaction, which may not be achievable by a single team alone.*

We have a Project Management Office that handles it.

We utilize a "Scrum of Scrums" approach.

We conduct demos for other teams working on components that interface with our system.

We maintain a Portfolio Board.

We have an open office space, ensuring that everyone is kept in the loop.

We regularly share our backlog with other teams to keep them informed.

None of the above

Describe how your team collaborates, shares risks, innovates, and learns.

In Agile, there are several effective methods for sharing project information with your team. Not having a structured way to share information with the team can result in poor collaboration, increased project risks, and reduced innovattion. Encouraging collaboration and consistently practicing it tends to lead to the generation of beter ideas, greater buy-in, and improved outcomes.*

We isolate ourselves to avoid being held responsible for failures, and risk-taking is discouraged.

There is some communication. When mistakes occur, the responsible person is held accountable.

Communication and collaboration are strong among teams, and innovation is actively encouraged.

There is high cooperation among teams. Risks are shared, and failure leads to learning and inquiry to help the team improve. Innovation is not only encouraged but also implemented.

None of the above

Describe how your team handles risk with a project.

Risk is defined as uncertainty in a project. Agile projects tend to have fewer quality risks compared to traditional projects due to iterative cycles that aim to mitigate risks continuously. In an Agile team, anyone can identify risks and propose mitigation strategies.*

Prepare a clearly detailed project scope.

Define requirement specifications and acceptance criteria.

Obtain sign-off from stakeholders on the scope agreement.

Establish and implement a change control process that stakeholders are aware of and agree to.

Develop and implement a change control process that the stakeholders are aware of and agree to

Monitor project progress against the defined scope. For example: By holding regular review meetings. (based on the needs and priorities of the team)

None of the above

Describe how your team regularly comes together to share and evaluate new ideas.

In an agile team, sharing ideas is an integral part of the iterative process. By making ideas known to the team, it fosters an environment of experimentation and innovation.*

We document the ideas and revisit them every few sprints to determine which ones to pursue.

We try to allocate some time in the upcoming sprint to explore certain ideas that have been suggested.

We can engage in discussions with the team, and for promising ideas, we follow up promptly. This is why we have dedicated slack time in our schedule.

None of the above

Describe how your team manages code?

As teams scale, the number of stakeholders who depend on and contribute to codebases can quickly increase. Without a strategy in place to manage changes to their source code, teams expose themselves to significant risks, including ongoing confusion, errors, and decreased productivity*

Use a common code repository (for example: Git based repo) for source files

Use a common code repository (for example: Git based repo) for configuration files

Have a defined branching structure

Have a defined branching policy that is enforced daily

Manage branch and repository permissions

Utilize artificial intelligence solutions (such as GitHub Copilot) to boost Developer productivity

Enforce check-in comments and workflows for code commits

None of the above

Describe what files do you keep under source control?

A version control system tracks changes to a file or a set of files over me, allowing you to recall specific versions later. You should aim to place all application-related files under source control.*

Application source code

Application source code and tests

Application source code, tests and configuration files

All files used to build, test, configure, deploy, run and document our service

None of the above

Describe how your team merges changes into a shared branch?

In Git, each developer saves changes to their own local code repository. As a result, there can be many different changes in a single commit. Git provides tools for isolating changes and later merging them back together. Git repositories otien have one or more shared branches where developers collaborate and eventually contribute their changes. The top level shared branch is usually called "main".*

Use Pull Requests to pull code changes back into the parent branch

Directly merge changes into the parent branch without a pull request

Directly change source code in the shared branch

None of the above

Describe the branch strategy in place to control pull/push requests?

In Git, branches, which serve as lightweight pointers to work in progress, help manage this separation. Once the work created in a branch is completed, it can be merged back into the team's main (or trunk) branch. While there are various valid methods, it is essential to have a clearly defined strategy in place and ensure that it is understood.*

We keep new work in separate branches and merge it only when finished, usually within weeks or months

We have no branches and develop only in the trunk or master

We use branches that live for a few days at most and commit all changes to the master or trunk at least daily

We maintain traceability on code changes but treat branches as temporary by using topic branches that we squash-merge to master when the work is complete

None of the above

Describe how the team monitors and reviews code changes?

All code changes should be peer-reviewed and approved, regardless of the scope of the change, as even one-line code updates frequently introduce bugs to a system. Pick the option that represent the most common practices for your team or organization.*

We do not have a policy; however, some code changes may undergo review, and at times, the reviewer may also be the requestor

We review code changes through live peer reviews or pair programming

Some code is reviewed, and we capture the review history using a pull request workflow or its equivalent

We ensure that all code changes are peer-reviewed before being commited to the master or trunk through a pull request workflow, branch policies, or their equivalent, and we enforce branch policies

None of the above

Describe how your team deals with cross-team code dependencies?

Do you store compiled code in version control? Do you duplicate components? Do you have inefficient processes for managing dependencies? If the answer is 'yes,' you should consider sharing and reusing code across the organization using packages.*

We track work items in a spreadsheet or document

We use a work item tracking system

The dependencies are published as packages to a repository, so we can track the dependencies in our code. We publish our own artifacts as well so other teams that depend on us can see the new artifacts.

We have full access to the source code of other teams and can build our own version of the dependencies if necessary (inner source)

We have an open-source model, so anyone can contribute and use our code as well as we can use other team's code

We use an ad-hoc or manual process for communicating dependencies.

None of the above

Describe how your team performs static code analysis?

Static analysis tools enable you to enforce coding standards, identify common errors, and address failures to follow best practices. Many static analysis tools can also be extended to implement custom rules and enforce your own policies. The following products are examples of static code analysis tools: SonarQube, SonarCloud, ESLint, FindBugs*

Static code analysis is performed early in development, before software testing begins.

Static code analysis is performed later in development, after software testing begins.

Static code analysis is performed after development, before deployment begins.

None of the above

Continuous Integration and Continuous Delivery (CI/CD)

Describe how your team gets notified about the build status and failures?

Sometimes failures happen, so it is important to ensure you have visibility into your pipeline. Receive a notification from the build system. Notifications may be delivered via a communication app such as Teams, SMS, or e-mail*

Receive alerts through IT service management tools

Receive alerts from DevOps build system directly

Teams review the status manually on a regular basis

None of the above

Continuous Integration and Continuous Delivery (CI/CD)

Describe how frequently your team refactors code or addresses technical debt?

Code refactoring is defined as the process of restructuring computer code without changing or adding to its external behavior and functionality. The primary benefit of refactoring is to enhance the quality of code and reduce technical debt.*

We do this when we have time

We plan to do this once every quarter

We use stabilization sprints to perform this kind of work

We continually do this

We do this on a set weekly interval

We do not refactor code in our team / A separate team handles it

Continuous Integration and Continuous Delivery (CI/CD)

Describe how your team release/deployment process works?

The entire end-to-end CI/CD deployment process should be understood, and ideally, as much of the deployment process as possible should be automated.*

Use environments for development and testing stages that simulate the production environmentMaintaining production-like environments for your pre-production stages means that if issues occur in production, you are far more capable of developing, testing, and releasing hotfixes/updates quickly.

Manage and actively resolve any technical debt in your environments technical debt includes anything that increases the complexity of the database workload or code, usually incurred due to delivery pressures.

There is a systematic approach to the development and release process The use of source code control systems, such as Azure Repos or GitHub, and build and release systems, such as Azure Pipelines or GitHub Actions, should be understood, including the corresponding processes for accessing, reviewing, and approving changes.

The application can be deployed automatically from scratch without any manual operations Manual deployment steps introduce significant risks, where human error is concerned and also increase overall deployment times.

There is a documented process for any portions of the deployment that require manual intervention Without detailed release process documentation, there is a much higher risk of an operator improperly configuring settings for the application.

N-1 or N+1 versions can be deployed via automated pipelines, where N is the current deployment version in production N-1 and N+1 refer to roll-back and roll-forward. Automated deployment pipelines should allow for quick roll-forward and roll-back deployments to address critical bugs and code updates outside of the normal deployment lifecycle.

The application deployment process leverages blue-green deployments and/or canary release Blue/green or canary deployments are ways to gradually release new features or changes without impacting all users at once.

Releases to production are gated by having it successfully deployed and tested in other environments Deploying to other environments and verifying changes before going into production can prevent bugs from reaching end-users.

Feature flags are used to test features before rolling them out to everyone To test new features quickly and with lower risk, feature flags are a technique to help frequently integrate code into a shared repository, even if incomplete. It allows for deployment decisions to be separated from release decisions.

None of the above

Continuous Integration and Continuous Delivery (CI/CD)

Choose the deployment strategy that your team uses. If you use several, choose the one that is most frequently used.

To ensure that the software connects with the operations system effectively, business goals must align with the DevOps deployment. By merging software development and IT operations, an effective DevOps deployment approach can achieve this.*

Blue/Green- Version B is released alongside version A, then the traffic is switched to version B.

Canary - The rollout takes place in a set of adoption "rings" or "groups".

A/B testing - The amount of users seeing version B is increased over time until the rollout is complete.

Rolling - Version B is slowly rolled out and replacing version A.

Recreate - Version A is terminated then version B is rolled out.

Shadow - Version B receives real-world traffic alongside version A and doesn’t impact the response.

None of the above

Continuous Integration and Continuous Delivery (CI/CD)

Describe the approval process for production deployments?

The quality signals used to approve deployments should be constantly tracked every day. While it's not critical for every service to always be available, teams should approach their DevOps delivery and operation stages with the mindset that they can and should deploy new versions without having to take them down at any time. Please choose the option that most closely reflects the most common method used in your team or organization.*

The approval process is infrequent or manual

The decision from the program/project office serves as the approval for deployment

We hold meetings before the deployment that establish our approval

We utilize gates and team approvals to manage our deployment

None of the above

Continuous Integration and Continuous Delivery (CI/CD)

Describe how your team rolls out new features to users?

Feature flagging allows DevOps teams to make new capacity available to only a small segment of application users as organizations roll out new features. Assuming all goes well, the DevOps teams can confidently make that functionality available to all users.*

We deploy when the appropriate manager approves

We run a full test suite in a production-realistic environment and proceed with deployment after obtaining any necessary approvals

We use progressive deployment with feature flags or exposure control and monitor telemetry to determine whether to continue the rollout

All changes get deployed continuously but we use feature flags to control which users have access to new features in production

None of the above

Continuous Integration and Continuous Delivery (CI/CD)

Describe how your team is using feature flags to test features before rolling them out to all users?

"Feature flags" (or "feature toggles") comprise another technique used for experimentation and "dark launches." Feature flags can toggle features on or off for different end-users based on their identity and group membership. Feature flags assist developers with code branch management, testing in production, and selective activation.*

Developers and testers test new features and functionality

Use for creative purposes, such as A/B testing

Using for progressive experimentation

Beta Feedback and Feature Targeting

Hypothesis-Driven Development

None of the above / Feature Flags not implemented

Continuous Integration and Continuous Delivery (CI/CD)

Describe your team's standard for testing?

If your team is atempting to use DevOps to deliver sotiware frequently into production, continuous testing is vital. Continuous testing, when done correctly, provides rapid and continuous insight into the health of the most recent build of your application.*

Testing that validates conformance to requirements and addresses identified bugs

Testing that is both fast and thorough enough to provide feedback in the continuous integration and continuous delivery flow

Testing that fosters continuous improvement in user satisfaction, quality of service, and performance on business objectives

Testing that covers the most used functionality, data, code paths, and configurations, with coverage measured against them

None of the above

Continuous Integration and Continuous Delivery (CI/CD)

Describe how your team runs tests on a built code package?

While most testing should occur within the testing and staging environments, it's beneficial to run a subset of tests against the production system.*

Perform regular disaster recovery (DR) and business continuity drills. Are you testing your high availability (HA) and DR processes to ensure your workload is available in the case of a disaster?

Automate testing for code and environment configuration deployments. Automating tests is the best way to ensure that they are repeatable, comprehensive, and exhaustive.

We use manual testing when necessary. Some processes can't be automated. How do you ensure that those manual processes are still adequately tested?

We create unit tests during development and run them as part of our build process.

None of the above

Continuous Integration and Continuous Delivery (CI/CD)

Describe how your team is testing and validating your applications?

Regular testing should be conducted as a part of every major change and, if possible, on a recurring basis to validate existing thresholds, targets, and assumptions. This also ensures the validity of the health model, capacity model, and operational procedures.*

The application is tested for performance, scalability, and resiliency

At least a subset of tests is also performed in the production environment

Tests for performance, scalability, and resiliency are conducted as part of each major change

Fault injection tests are being utilized

Smoke tests are performed during application deployments

Unit and integration testing is part of the application deployment process

All these tests are automated and performed periodically

Failing tests at least temporarily block a deployment and lead to a deeper analysis of the issue

Business Continuity 'fire drills' are executed to test regional failover scenarios

Regular security and penetration testing is performed

Tests are regularly updated and validated to reflect any necessary changesTests and test data should be reviewed and updated after each major application change, update, or outage.

Mocks and stubs are used to test external dependencies in non-production environmentsMocks and stubs can help validate external dependencies and increase test coverage when accessing those external dependencies is not possible, for example, due to IP restrictions.

None of the above

Continuous Integration and Continuous Delivery (CI/CD)

Describe how your team uses tests in environments other than production?

Software testing is not a new concept, but testing in a traditional environment differs significantly from testing in a DevOps environment*

We test all environments with unit, acceptance, functional, and integration tests

We use a continuous and automated process that enables ongoing testing of all our environments

We leverage test automation as much as possible

We continually revise the testing plan with an up-to-date automated testing scope

None of the above

Continuous Integration and Continuous Delivery (CI/CD)

Describe the code scanning tools used as part of the continuous integration (CI) process?

Make sure that static code scanning tools are integrated into the continuous integration (CI) process.*

Credential/Secret Scanner

Dependency Scanning

Source code analysis toolssuch as: OWASP scanners or CodeQL

Vulnerability Scanning Tools

SAST Tools

None of the above

Continuous Integration and Continuous Delivery (CI/CD)

Describe when your team conducts security testing.

Establish a minimum-security baseline that takes into account both security and compliance controls. Ensure that these controls are integrated into the DevOps process and pipeline.*

As part of the pull request and code review flow before code is committed.

Security tests are run In the continuous integration and continuous delivery pipeline.

Before any production update or Before a major release.

None of the above

How extensively is security testing conducted, and what is your team's approach to incident response in the event of a breach?

Conducting security and penetration tests, like checking for open ports or potential vulnerabilities, is crucial to ensure the overall safety and smooth operation of the system. In case prevention measures fall short, responding promptly and mitigating the security breach can help reduce harm and limit the impact within a confined area.*

Penetration testing is conducted either internally or by a third-party entity to assess the existing security defenses of this workload and ensure their validation.

Regular simulated atracks, including phishing campaigns, are executed against users of this workload to enhance preparedness and resilience.

A comprehensive security training program is established and consistently updated to keep the security personnel associated with this workload well-informed and equipped with the necessary skills.

Incident response playbooks are crafted to facilitate a swiftunderstanding of the workload and its components, enabling incident responders to efficiently mitigate atacks and conduct investigations.

None of the above.

What code scanning tools are utilized in the continuous integration (CI) workflow?

Make sure that static code scanning tools are seamlessly integrated into the continuous integration (CI) process.*

Credential Scanner

Dependency Scanner

OWASP source code analysis tools

Vulnerability Scanning Tools

SAST Tools

None of the above

How does your team make sure that there is enough of a focus on security while writing code?

Secure coding involves the creation of software that mitigates security-related vulnerabilities by adhering to industry best practices and security standards, thereby avoiding potential flaws in the development process.*

Robust authentication and authorization measures are implemented to ensure data security against unauthorized access. Examples of this are: enforcing strong password policies and incorporating twofactor authentication.

To prevent data leakage during the transmission process between sources, secure channels (HTTPS) are implemented, along with the encryption of data in transit.

Sensitive data is encrypted at rest.

Access is restricted to authenticated users only and authentication is implemented at every layer of the workload.

All communication channels are encrypted to safeguard authentication tokens.

All keys, passwords, and certificates are properly stored and protected. Proper storage and protection of keys, passwords, and certificates are imperative to maintain the integrity of the security measures in place.

Tools that support secure development (such as GitHub Advanced Security and GitHub Copilot) are used throughout the inner and outer development loops.

None of the above

How frequently does your team conduct security assessments on the code?

Security holds utmost importance in all applications; thus, it is essential to incorporate frequent security assessment activities into your development lifecycle.*

Security reviews on code changes occur sporadically.

Certain code undergoes security scrutiny, and we document the review history through a pull request workflow or a comparable method.

We ensure that all modifications to the code undergo security peer-review before being commited to the master or trunk, utilizing a pull request workflow, branch policies, or equivalent mechanisms.

None of the above

How does your team handle the management of passwords and other credentials?

It is essential to perform scans for credentials and other sensitive information in source files before commiting, as this practice minimizes the risk of unintentionally including such confidential data in your team's CI/CD process.*

Uncover and categorize all forms of passwords, keys, and other confidential information throughout your entire IT infrastructure, centralizing their management. Continuously identify and integrate new secrets into the centralized system as they are generated.

Remove hardcoded or embedded secrets from configurations in DevOps tools, build scripts, code files, test builds, production builds, and applications.

Enforce best practices for password security, covering aspects like password length, complexity, uniqueness, expiration, rotation, and more, across all categories of passwords.

Implement privileged session monitoring to record, audit, and supervise all privileged sessions, including accounts, users, scripts, and automation tools, enhancing oversight and accountability.

Expand secrets management to include third-party entities, ensuring that partners and vendors adhere to best practices when using and handling secrets.

Utilize threat analytics to continually assess the usage of secrets, detecting anomalies and potential threats.

None of the above

Explain the approach your team takes in conducting threat analysis.

Threat modeling, as an engineering approach, aids in recognizing potential threats, atacks, vulnerabilities, and corresponding countermeasures that might impact an application. The steps involved in threat analysis encompass defining security requirements, recognizing threats, implementing measures to mitigate threats, and validating the effectiveness of threat mitigation. These elements collectively contribute to ensuring comprehensive security for a workload, covering both proactive prevention and reactive responses.*

The organization follows threat modeling processes wherein identified threats are prioritized according to their impact on the organization. These threats are then associated with corresponding mitigations and communicated to relevant stakeholders.Threat modeling, as an engineering technique, serves to identify potential threats, atacks, vulnerabilities, and countermeasures that might impact an application. The process involves defining security requirements, recognizing threats, implementing threat mitigations, and validating the effectiveness of these measures. Microsoft employs the STRIDE model for threat modeling, and tools like the Microsoft Threat Modeling Tool can be valuable in this context.

There is a systematic procedure for monitoring, prioritizing, and resolving security threats throughout the application development lifecycle.A threat modeling tool generates a comprehensive report listing all identified threats. Typically, this report is uploaded into a tracking tool or work items, which developers then validate and address. Cybersecurity teams leverage the report to identify atack vectors during penetration tests. As the solution evolves with new features, the threat model should be regularly updated and seamlessly integrated into the code management process. In the event of discovering a security issue, a structured process is in place to triage the problem either into the next release cycle or a expedited release, depending on its severity

Establishing timelines and procedures is essential for deploying security fixes to address identified threats.Promptly addressing identified vulnerabilities is crucial for maintaining security and preventing the emergence of additional attack vectors.

Clear security requirements are outlined for all applications.Applications failing to meet the specified security requirements during service enablement should be restricted.

Comprehensive threat protection measures have been implemented for all applications.Enterprise applications face numerous threats that can compromise confidentiality, availability, or integrity, necessitating the use of advanced security solutions for protection.

Business-critical workloads are identified and categorized appropriately. This is essential as their compromise or unavailability could significantly impact operations.Enterprise organizations commonly possess an extensive application portfolio. Have key business applications been recognized and categorized? This encompasses applications with substantial business implications if disrupted, such as those involving critical data, regulated information, or essential availability. Additionally, these applications may encompass those particularly vulnerable to atacks, such as pivotal public-facing websites crucial to the organization's success.

None of the above

What factors related to compliance and governance are taken into account when building apps?

Organizations face limitations in terms of resources, including finances, personnel, and time. To ensure a meaningful return on investment (ROI), organizations must prioritize their investments wisely. This constraint also applies to the implementation of security measures throughout the organization. To atain a suitable ROI on security, it is crucial for the organization to comprehend and clearly define its security priorities.*

Regulatory and governance requirements are well understood and implemented.Operational data, such as application logs and metrics, may be required by regulatory mandates to remain within specific geopolitical regions. This imposes clear implications on the operationalization approach for the application.

The Landing Zone concept is applied to workloads.This concept entails predefined components, like a network topology with the Hub/Spoke model, already in place before workload deployment. The purpose of the Landing Zone is to ensure that necessary infrastructure is established upon the workload's arrival in Azure, enhancing agility and compliance with enterprise security and governance standards. It is essential to hand over a Landing Zone to workload owners with deployed security guardrails

Security and organizational standards are enforced and controlled through policies.

A Root Management Group is utilized, and any modifications applied using this group undergo careful consideration.

Systematic monitoring and maintenance of compliance for applications are conducted, with regular compliance atestations.

Periodic external or internal audits of this workload are conducted.

A security plan for this workload was formulated and is actively maintained.

Proactive review and application of best practices and guidelines, based on industry recommendations, are undertaken.

When implementing defenses, considerations are given to the costs associated for atackers and defenders. Preventing accessible and inexpensive attack methods is always prioritized.

None of the above

Describe how your team monitors applications?

In order to successfully maintain applications, it's important to 'turn the lights on' and have clear visibility of important metrics both in real-time and historically.*

An Application Performance Management (APM) tool like Azure Application Insights is used to collect application level logsIs an Application Performance Management (APM) tool used to collect application-level logs?

Application logs are collected from different application environments. Are application logs collected from different application environments?

Log messages are captured in a structured format and can be indexed and searched Are log messages captured in a structured format?

Application events are correlated across all application components Events coming from different application components or different component tiers of the application should be correlated to build end-to-end transaction flows. For instance, this is often achieved by using consistent correlation IDs transferred between components within a transaction.

It is possible to evaluate critical application performance targets and non-functional requirements based on application logs and metrics Is it possible to evaluate critical application performance targets and non-functional requirements (NFRs)?

End-to-end performance of critical system flows is monitored. Is the end-to-end performance of critical system flows monitored?

Black-box monitoring is used to measure platform services and the resulting customer experience. Blackbox monitoring tests externally visible application behavior without the knowledge of the internals of the system. This is a common approach to measuring customer-centric SLIs/SLOs/SLAs.

None of the above

Describe how your team visualizes application data and then alert relevant teams when issues occur?

Dashboarding tools should be used to visualize metrics and events collected at the application and resource levels to illustrate the health model and the current operational state of the workload.*

Application and resource level logs are either aggregated in a single data sink, or it is possible to crossquery events at both levels Are application and resource level logs aggregated in a single data sink, or is it possible to cross-query events at both levels?

Application level events are automatically correlated with resource-level metrics to quantify the current application stateAre application-level events automatically correlated with resource-level metrics to quantify the current application state?

A health model is used to qualify what 'healthy' and 'unhealthy' states represent for the workloadIs a health model used to qualify what 'healthy' and 'unhealthy' states represent for the application?

Critical system flows are used to inform the health modelAre critical system flows used to inform the health model?

The health model can distinguish between transient and non-transient faults Can the health model distinguish between transient and non-transient faults?

Long-term trends are analyzed to predict operational issues before they occur Are long-term trends analyzed to predict operational issues before they occur?

Retention times for logs and metrics have been defined and with housekeeping mechanisms configured Have retention times for logs and metrics been defined and with housekeeping mechanisms configured?

None of the above

Describe how does your team get insights into metrics of production systems?

We don’t, Ops will contact us when something is wrong*

We receive a monthly report detailing availability and average response times and trends

We receive a daily report detailing workload with availability, response times, numbers of requests and load on the systems

Ops has published a live metrics dashboard for us and sends us a roll up report with day-to-day comparison

We have full self service access to live and aggregated data through a portal

None of the above

Describe the instrumentation your team uses to monitor applications running in production?

Availability monitoring via pinging or synthetic transactions*

Performance monitoring of the servers and infrastructure

Real user monitoring

Multi-tier views of end-to-end transactions including processing and network combined

None of the above

Describe how your team interprets the collected data to inform relevant teams about application health?

Log aggregation technologies should be used to collate logs and metrics across all application components for later evaluation. Resources that logs are captured for may include Azure IaaS and PaaS services as well as 3rd-party appliances such as firewalls or anti-malware solutions used in the application.*

A log aggregation technology, such as Azure Log Analytics or Splunk, is used to collect logs and metrics from Azure resourcesWhich log aggregation technology is used to collect logs and metrics from Azure resources?

Azure Activity Logs are collected within the log aggregation tool Are you collecting Azure Activity Logs within the log aggregation tool?

Resource-level monitoring is enforced throughout the application Is resource-level monitoring enforced throughout the application?

Logs and metrics are available for critical internal dependencies Are logs and metrics available for critical internal dependencies?

Log levels are used to capture different types of application events.Different log levels, such as INFO, WARNING, ERROR, and DEBUG should be pre-configured and applied within relevant environments. The approach to change log levels should be simple configuration change to support operational scenarios where it is necessary to elevate the log level within an environment.

Critical external dependencies are monitored It's common for applications to depend on other services or libraries. Despite these are external, it is sell possible to monitor their health and availability using probes

There are no known gaps in application observability that led to missed incidents and/or false positives. What you cannot see, you cannot measure. What you cannot measure, you cannot improve.

The application is instrumented to measure customer experience. Effective instrumentation is vital to detecting and resolving performance anomalies that can impact customer experience and application availability.

None of the above

Describe how your team uses tools to be notified and alerted about application health?

Alerts can proactively notify or respond to operational states that deviate from the norm. Alerts can also enable cost-awareness by watching budgets and limits and helping workload teams to scale appropriately*

A tool such as Azure Monitor or Grafana is used to visualize the application health model and encompassed logs and metricsWhat technology in used to visualize the application health model and encompassed logs and metrics?

Dashboards are tailored to a specific audience such as developers, security or networking teams

A tool such as Azure Monitor or Splunk is used for alerting

Specific owners and processes are defined for each alert type

Operational events are prioritized based on business impact

Alerting is integrated with an IT Service Management (ITSM) system such as Service Now

Push notifications are used to inform responsible parties of alerts in real time

None of the above

Describe how your team's applications are engineered towards providing information for operations? (logging, instrumentation)

Effective application instrumentation is an important practice to help identify and understand possible issues. Efficient instrumentation of your environment and applications enable engineering and operations teams to identify and resolve potential issues more efficiently.*

We implement custom counters in our production code that stream service health, up-time, and code invocation and execution to a central repository

We poll our production system at regular intervals with a monitoring solution such as IpSwitch, SolarWinds, Quest, etc... and log the data to a central repository

We use AGENTLESS technology to conduct PING tests and verification of services. We log this data to a central repository that allows us to build and visualize trends over time

We use AGENT technology to conduct PING tests and verification of services. We log this data to a central repository that allows us to build and visualize trends over time

None of the above

Which of these DevOps practices are commonplace in your organization or team?

The merging of "Dev" and "Ops" entails the integration of previously isolated Development and Operations functions, resulting in the formation of cross-functional teams that collaborate using common and effective practices and tools. While a genuine DevOps approach assigns operational responsibilities to developers, some organizations choose not to fully adopt DevOps, opting instead to maintain a certain level of team segregation between operations and development. This separation may serve to uphold a clear division of duties in regulated environments or to treat operations as a distinct business function.*

Our change management process involves stakeholders from all aspects of the software development lifecycle.

Stakeholders in different roles working on the same product communicate frequently and efficiently.

The organization operates platforms and services for cross functional teams to consume.

When we build a workload or application we understand that any new product we create will be a service that needs long-term maintenance and investment.

We seek a diversity of views when it comes to IT delivery

Our mission statement is aligned across all teams that participate in the software development lifecycle. This also includes traditional "business"-functions.

None of the above

Describe how frequently does your team tries new ideas?

New Ideas breed innovation and trust among teams. Look to drive experimentation into your team's culture to improve on new ideas.*

All the time

Frequently

Occasionally

Periodically

Not very much. / Not at all.

Explain how your team establishes and maintains a unified and clear vision and direction

For DevOps to thrive, it's essential for both technical and non-technical teams to synchronize. Nontechnical stakeholders must actively engage, working alongside engineering teams to define realistic KPIs and SLAs. Meanwhile, technical teams should develop systems and processes that enhance software delivery efficiency and offer effective tools for conveying the value that DevOps brings to the organization. Choose the option that most closely applies to your organization.*

The overall direction is somewhat apparent but could benefit from further clarification or a clearer vision statement.

There may be a vision statement, but it may not be very broadly publicized. Not all team members are always aware of how their work contributes to a greater goal.

While there is a single vision statement, we have some more alignment work to do.

While a vision statement exists, it's not always clear how all work aligns to it.

Our organization strongly supports and aligns with a single clear vision.

Individuals can express what the mission is and how their work contributes to the vision.

There is little or no overall direction/vision.

How does your organization perceive culture change, considering it as either an ongoing, continuous effort or as a series of event-based initiatives?*

Consistently and openly monitoring your DevOps process enables teams to pinpoint potential areas for improvement. Choose the option that most closely aligns to your team's or organization's situation.

Our organization embraces DevOps throughout and is seeing benefits from having adopted a DevOps model.

While we have implemented many DevOps culture changes, we still have more work to do.

We embraced some DevOps culture changes but we have a long way to go and further changes to make.

Our organization has not embraced DevOps culture changes and our culture needs to change.

Explain how your team communicates and shares risks with other departments within the organization

DevOps involves not only experimentation but also fostering a culture of transparency, sharing, and collaboration. Inherent to experimentation are risks, and sharing these risks ensures that everyone is actively involved. This shared risk-taking fosters a deeper understanding between the business and IT, aligning their goals and facilitating collaboration.*

Our team jointly bears risks with various business teams.

Our team bears certain risks alongside different business teams.

Our team refrains from sharing risks with different business teams.

Does your team allocate time for innovation and learning activities?

Learning and innovation are interconnected. Without both happening, the organization becomes stagnant and vulnerable to competition and employee turnover.*

We promote a mindset of continuous growth.

We embrace failure as an opportunity for learning and integrate insights into our processes.

Employees have time to develop experimental projects to foster innovation.

Team members take a data-driven development approach.

None of the above

How seamless is the transition for your team to embrace the next innovation after facing a setback with a previous one?

The desire to learn can serve as a powerful motivator for many individuals. One of the key factors driving the team to embrace a DevOps mindset is their curiosity to consistently learn, adapt, and enhance their skills and knowledge through experiences, including failures. Review the below scenarios and pick the one that is most common in your team or organization.*

Consequences ensued, prompting us to return to the program.An example of this might be layoffs that are directly connected to a momentary setback.

We encounter significant resistance and are reminded of previous mishaps.

We face some resistance and are advised to improve in future attempts.

Presenting lessons learned allows us to receive the benefit of the doubt.

We are motivated to explore the impact through non-fatal experiments.

"*" indicates required fields

Step 1 of 22

4%

Cloud Adoption Assessment Questionnaire

Digital transformation often requires skills across multiple roles and departments. This Cloud adoption assessment questionnaire will walk you through a series of questions to evaluate your company’s readiness for cloud adoption in various areas.

Please take a moment to complete the questionnaire

Are you responding to any critical business events, such as, datacenter exit, mergers and acquisition, end of support for mission-critical technologies, or response to regulatory compliance change?*

What are the critical business events driving your cloud transformation?*

Datacenter exit

Merger, acquisition, or divestiture

Reduction in capital expenses

End of support for mission-critical technologies

Response to regulatory compliance changes

New data sovereignty requirements

Reduction of disruptions and improvement of IT stability

Report and manage the environmental impact of your business

Expanding capacity without migrating because you're not able to move to OpEx or can't deprecate due to business needs

None of the above

Are there any other motivations that are driving your cloud transformation, other than those driven by critical business events?*

Cost savings

Reduction in vendor or technical complexity

Optimization of internal operations

Increase in business agility

Scaling to meet market and/or geographic demands

Integration of a complex IT portfolio

Improved customer experiences and engagements

Transformation of products or services

Market disruption with new products or services

Preparation for, or building new, technical capabilities

Democratization and/or self-service environments

None of the above

Has your cloud strategy been communicated broadly across the organization?*

Do you conduct regular cloud strategy reviews with the broader organization?*

Have you documented a cloud strategy with multi-year horizon and C-level participation and/or sponsorship?*

What are the business outcomes driving your cloud transformation?*

Increase profitability while driving compliance

Accelerate sales, improve customer lifetime value

Acquire and retain customers, build a reputation

Retain, recruit, and empower employees

Meet market growth requirements and environmental sustainability metrics

Global reach

Performance and reliability

None of the above

Do these outcomes have associated business drivers, KPIs, and necessary technical capabilities?*

Yes.

No.

Don't know

Have you developed a financial model or performed an economic assessment that provides business justification for moving to the cloud?*

Yes.

No.

Don't know

It's important to understand how to account for cloud costs before you begin a cloud transformation journey. Select your company's model from the following common cloud accounting models.*

Cost-center model

Profit-center model

Charge-back model

Show back or awareness-back model

Don't know

None of the above

When you're making the shift to the cloud, there are technical considerations around how it can help you beter manage and maintain your cloud and workloads. Discover the technical flexibility, efficiencies, and capabilities that help you build a business case to adopt the cloud.

Do you understand how your resources need to scale depending on usage, utilization, and demand in a cloud context?*

Yes.

No.

Have you identified the workloads that need to be built with highly available infrastructure?*

Yes.

No.

Have you identified the workloads that have specific security and compliance requirements?*

Yes.

No.

Have you identified resources to rightsized and optimize capacity?*

Yes.

No.

Have you selected an initial cloud workload?*

Yes.

No.

Are you familiar with the Hybrid cloud Benefit and how to use it to optimize licensing costs?*

Yes.

No.

Are you familiar with pay-as-you-go pricing models?*

Yes.

No.

Are you familiar with Virtual Machines and its cost savings?*

Yes.

No.

Do you have a strong understanding of the baseline financial data in your on-premises datacenter today?*

Yes.

No.

Depending on the motivations and business outcomes associated with cloud adoption, leaders might need to establish new organizational structures or virtual teams to handle various functions. Organizational and environmental (technical) readiness often require new skills for technical and nontechnical contributors.*

Yes.

No.

Don't know

Do your developers understand cloud computing concepts, general cloud computing models, and services, such as public, private, and hybrid cloud services, like IaaS, PaaS, and SaaS?*

Yes.

No.

Don't know

"*" indicates required fields

Step 1 of 44

2%

Azure VDI Assessment Questionnaire

Azure Virtual Desktop is a comprehensive desktop and app virtualization service running in the cloud. It offers flexibility and scalability for businesses and individuals with exceptional security and compliance features. This assessment questionnaire will walk you through a series of questions to evaluate your company’s readiness for Azure VDI.

Please take a moment to complete the questionnaire

Have you evaluated your workload holistically by using the design principles of the Azure Well Architected Framework pillars?*

We've evaluated our workload's reliability and resiliency and its ability to recover from failures.

For maximum security, we apply the principle of Zero Trust.

We estimate, rationalize, and monitor the overall cost of our workload.

We've set up monitoring, we've automated build and release processes, and we've established clear roles for our Azure Virtual Desktop team to take on for governing and managing our workload.

We've enabled horizontal scaling, and we've run tests to evaluate load.

None of the above

Have you considered how different types of host pools affect the cost and reliability of Azure Virtual Desktop?*

We use a personal pool to give our users power to personalize their environment and work freely within a virtual machine (VM)

We use a pooled host pool to streamline our reliability solution and minimize costs.

None of the above

If you use a pooled host pool, have you considered how the load-balancing algorithm affects your cost efficiency and performance?*

We use breadth-first load balancing to quickly improve our user experience.

We use depth-first load balancing to reduce costs.

For scale-down scenarios, we use depth-first load balancing.

None of the above

Do you use Azure Virtual Desktop scaling plans for session hosts?*

We use scaling plans to help maximize cost efficiency by automatically turning hosts off and on.

We adjust the setings of our scaling plans to improve cost efficiency.

None of the above

Do you place your session hosts in availability zones or availability sets?*

To minimize latency, we deploy session hosts close to our users.

We deploy session hosts in an availability zone or an availability set to help protect our environment from outages.

None of the above

We look at the various compute sizes, families, and features that Azure offers, and we choose the option that optimizes the performance and cost efficiency of our workload.*

We hold daily stand-up meetings and collaborate using work items, ChatOps, and other mechanisms.

For our high-security workloads, we use virtual machines (VMs) in the DCasv5 or ECasv5 series.

We use graphics-intensive applications, so we use NV-series VMs.

None of the above

Have you considered how your storage solution affects the performance of your virtual desktop?*

When we design our storage solution, we consider the maximum size, throughput, and I/O operations per second (IOPS) of the various types of Azure managed disks.

We choose a type of managed disk that optimizes the performance and cost efficiency of our workload.

None of the above

How do you achieve high availability and disaster recovery for your workload?*

We spread session hosts across different availability zones to improve availability

We spread out session hosts within availability zones.

We don't need to back up session host data or applications, so we use golden images that we save in a redundant fashion for disaster recovery.

We update session host data frequently, so we use backups for disaster recovery.

We've performed a failure mode analysis on our environment to prepare for outages and help prevent them.

None of the above

How have you designed your overall network infrastructure for Azure Virtual Desktop to help ensure reliable and high-speed internet connectivity for geographically distributed clients while maintaining an acceptable latency threshold and prioritizing Azure Virtual Desktop traffic over other network traffic?*

We use the Azure Virtual Desktop Experience Estimator tool to gather estimated latency values.

We test latencies from our Azure virtual networks to our on-premises systems.

None of the above

Do any of your clients use a virtual private network (VPN) to connect to your virtual network?*

We have clients who use a point-to-site (P2S) VPN connection, and we use a split tunnel that's based on User Datagram Protocol (UDP).

We use Remote Desktop Protocol (RDP) Shortpath with a managed network for on-site clients who use a VPN or Azure ExpressRoute.

None of the above

If you use hybrid networking, are you aware of the connectivity options that are available and their impact on performance?*

We've reviewed best practices for connecting Azure virtual networks to on-premises systems.

We've tested latencies from our Azure virtual networks to our on-premises systems.

We've ensured that no overlapping IP addresses are used in our Azure Virtual Desktop landing zone.

We've given every Azure Virtual Desktop landing zone its own virtual network and subnet configuration.

We considered potential growth when we sized our Azure Virtual Desktop subnets.

None of the above

When you use Azure Virtual Desktop in multiple regions, are you aware of networking factors that impact the architecture?*

We replicate platform and shared services to each region whenever our internal policies allow it.

When possible, we use virtual machine (VM) SKUs that offer the accelerated networking feature.

We include end-user latency estimations in our region selection process.

When we estimate bandwidth requirements, we take workload types into account, and we monitor real user connections.

None of the above

What measures have you implemented to improve network security?*

We understand the configurations that are needed to use Azure Firewall in our deployment.

To isolate our subnets and help control their traffic flows, we've created network security groups and application security groups to segment our Azure Virtual Desktop traffic.

To avoid frequently updating network security rules, we use service tags instead of specific IP addresses for Azure services

We're familiar with the required URLs for Azure Virtual Desktop.

We use forced tunneling to route traffic to a firewall or network virtual appliance (NVA), and we use a route table to allow Azure Virtual Desktop traffic to bypass the forced tunneling rule.

We use private endpoints to help protect platform as a service (PaaS) solutions like Azure Files and Azure Key Vault, and we're aware of the cost of using private endpoints.

To avoid using public IP addresses, we've adjusted the configuration options for Azure Private Link by disabling public endpoints for Azure Virtual Desktop control plane components and using private endpoints.

We use Active Directory Domain Services (AD DS), and we've implemented strict firewall policies that are based on the traffic that's required across our domain.

To help protect our end users' access to the internet from Azure Virtual Desktop session hosts, we use Azure Firewall or network virtual appliance (NVA) web filtering.

None of the above

Are you familiar with Azure Virtual Desktop name resolution requirements?*

We understand how Azure Private Link works with Azure Virtual Desktop.

We understand the Domain Name System (DNS) configurations that are needed for Azure private endpoints.

None of the above

Do you use Remote Desktop Protocol (RDP) Shortpath to establish a User Datagram Protocol (UDP)- based connection between your clients and session hosts?*

To help improve latency and our end-user experience, we use RDP Short path.

We're aware of the availability of RDP Short path connection models.

We're aware of RDP Short path charges.

None of the above

Do you use Azure Service Health and Azure Resource Health to stay informed about the services, regions, and resources that your Azure Virtual Desktop workload uses?*

We use Service Health to stay informed about the health of the Azure services and regions that we use.

We set up Service Health alerts so that we stay aware of service issues, planned maintenance, and other changes that might affect our Azure Virtual Desktop resources.

We use Resource Health to monitor our virtual machines (VMs) and storage solutions.

We set up Resource Health alerts.

None of the above

How do you monitor the performance of your workload, its session hosts, and its storage solution?*

We configure diagnostics data to be sent to Log Analytics.

We select from various options for configuring diagnostics setings, such as an Azure Virtual Desktop Insights configuration workbook, Azure Policy, the Azure portal, and a template.

We configure performance counters so that we have a record of how our system resources are used.

We use diagnostics tables in Log Analytics to query and analyze network information for Azure Virtual Desktop connections

We monitor event logs for connection problems with the Azure Virtual Desktop agent.

We monitor the Azure storage solution that we use for hosting FSLogix profiles and App Attach shares.

We monitor service usage to make sure our workload doesn't exceed limits.

None of the above

What measures do you take to strengthen the security posture of your environment?*

We use Microsoft Defender for Cloud to manage vulnerabilities and to assess compliance with common frameworks

We use Defender for Cloud to strengthen the overall security posture of our environment.

We collect Microsoft Entra ID authentication and audit logs.

We store security event logs from our Azure Virtual Desktop session hosts in a repository.

We update our Azure Virtual Desktop environment regularly.

We conduct monthly compliance reporting.

None of the above

What reporting tools do you use for your workload?*

We use Azure Virtual Desktop Insights for reporting.

We make custom dashboards, and we use Log Analytics tables and Resource Graph query results as data sources.

None of the above

Do you use alerts to stay informed about Azure Virtual Desktop performance and security?*

We use alerts to stay informed about Azure Virtual Desktop performance and security.

We configure alerts for various Azure Virtual Desktop events, diagnostics, and resources.

None of the above

Do you use role-based access control (RBAC) and security groups to separate duties and limit access to Azure Virtual Desktop resources?*

We define roles for the teams and individuals who manage Azure Virtual Desktop deployments.

We define Azure built-in roles to separate management responsibilities for host pools, application groups, and workspaces.

We create a security group for each role.

None of the above

What measures do you take to improve the security of your session hosts?*

We restrict Windows Explorer access by hiding local and remote drive mappings to help prevent users from discovering sensitive information.

We use AppLocker to prevent unwanted software from running on session hosts.

We use screen capture protection and watermarking to help prevent sensitive information from being captured on client endpoints.

We use Microsoft Defender Antivirus to help protect our virtual machines (VMs).

We use Windows Defender Application Control, and we define policies for all our drivers and applications.

We sign out users when they're inactive to preserve resources and prevent unauthorized access.

We use Microsoft Defender for Cloud for cloud security posture management (CSPM).

None of the above

What's your identity and access management (IAM) strategy for Azure Virtual Desktop?*

We create a dedicated user account with least privileges. When we deploy session hosts, we use this account to join the session hosts to a Microsoft Entra Domain Services or Active Directory Domain Services (AD DS) domain.

We require multifactor authentication for all users and admins in Azure Virtual Desktop.

We use Microsoft Entra ID Conditional Access to manage risks before we grant users access to our Azure Virtual Desktop environment.

None of the above

How do you implement network security in Azure Virtual Desktop?*

We use a hub-spoke architecture to keep workload-specific resources in their own virtual network that's separate from hub shared services like management and Domain Name System (DNS) services.

We use network security groups to filter network traffic to and from our Azure Virtual Desktop workload.

We isolate our host pools by placing each host pool in a separate virtual network. We use network security groups with the URLs that Azure Virtual Desktop requires for each subnet.

We rigorously enforce network and application security.

We disable or block the Remote Desktop Protocol (RDP) port to avoid direct RDP access to session hosts. If we need direct RDP access for administrative purposes or troubleshooting, we use Azure Bastion to connect to session hosts.

We use Azure Private Link with Azure Virtual Desktop to keep traffic within the Microsoft network and avoid exposing our service to the public internet, or we use a virtual private network (VPN) or Azure ExpressRoute so that users with a Remote Desktop client can connect to our virtual network.

We use Azure Firewall to help protect Azure Virtual Desktop.

None of the above

How do you encrypt data in transit in Azure Virtual Desktop?*

We understand how Azure Virtual Desktop encrypts data in transit and how reverse connect transport works.

We've made sure that client computers and our session hosts can use the TLS 1.2 ciphers that Azure Front Door uses.

None of the above

How do you encrypt data in use in Azure Virtual Desktop?*

We use confidential computing to protect data in use.

We use the Azure DCasv5 and ECasv5 confidential VM series to build a hardware-based trusted execution environment (TEE).

None of the above

In Azure Virtual Desktop, do you know which components Microsoft manages and which components you're responsible for managing?*

We're aware of our responsibilities under the shared-responsibility model.

We ensure that our organization actively manages components that fall under the customer's responsibility, such as our network topology, our session hosts, and our workspace.

None of the above

Continuous Integration and Continuous Delivery (CI/CD)

What areas do you focus on when you manage your Azure Virtual Desktop environment?*

We deploy our session hosts in an availability zone.

We establish an operations baseline.

We use monitoring tools, dashboards, and alerts.

None of the above

How do you stay informed about Azure Virtual Desktop developments?*

We're aware of the latest Azure Virtual Desktop updates, features, feature improvements, and bug fixes.

We check resources like what's-new articles about Azure Virtual Desktop on a monthly basis.

None of the above

What measures do you take to prevent components from exceeding platform limits?*

We monitor the resource usage of our components.

We're aware of system limits on services, Azure objects, and the number of vCPUs that we can create.

We understand how many I/O operations per second (IOPS) an FSLogix profile requires to support each user.

We use automation to prevent VM tokens from expiring.

None of the above

How do you update your host pool virtual machines (VMs)?*

We prefer to have our initial host pool available for a rollback, so we deploy a second host pool when we update our VMs.

We can double our number of VMs per host pool, so we update our VMs by deploying new VMs from a new golden image into our host pools.

None of the above

How do you manage golden images?*

We use Azure VM Image Builder to automate the process of updating golden images.

We retrieve the latest versions of images from Azure Marketplace.

We use PowerShell scripts to install applications.

We use a version control system to manage deployment scripts.

We use Azure Key Vault to store secrets that our automated deployment processes use.

None of the above

How do you ensure that the versions that you use are supported?*

We regularly review release notes and other articles about developments in Azure Virtual Desktop components.

We install updates when they become available.

None of the above

In Azure Virtual Desktop, do you know which areas Microsoft manages and which areas you're responsible for managing?*

We're aware of our responsibilities under the shared-responsibility model.

We ensure that our organization actively manages areas that fall under the customer's responsibility, such as the virtual machines (VMs) that Azure Virtual Desktop uses, the user profile data, and settings that are unique to our environment.

None of the above

How do you implement business continuity and disaster recovery for your host pools?*

We use multiple host pools, because we have distinct sets of users who have different business continuity disaster recovery requirements.

We have evaluated the FSLogix cloud cache feature for syncing profiles across regions.

We understand the actove-active and active-passive models.

We use a personal host pool, and we use Azure Site Recovery to replicate session hosts from the primary region to the secondary region.

None of the above

How do you address platform service limitations in Azure Virtual Desktop?*

We closely monitor our Azure Virtual Desktop deployments, and we keep track of resource usage within our subscription

We scale across multiple subscriptions, and we work with Azure support to adjust limits based on our business requirements

We scale horizontally for high demand by creating multiple host pools.

None of the above

How do you protect FSLogix profiles against data corruption, datacenter failures, and regional outages?*

We use a no-profile recovery strategy to minimize the need for protecting profiles.

We use Azure Backup to back up FSLogix profiles that we store in Azure Files or Azure NetApp Files.

We use zone-redundant storage to replicate data synchronously across Azure availability zones.

We use the FSLogix cloud cache feature to replicate profiles across regions.

None of the above

How do you protect your virtual network against datacenter and Azure region failures?*

We set up a virtual network in our secondary region for failover.

We use Azure Site Recovery to set up a virtual network in our failover region.

None of the above

How do you protect your golden images against data corruption, datacenter failures, and regional outages?*

We use Azure Compute Gallery to store images.

We use zone-redundant storage to spread copies of images across availability zones.

We create a secondary compute gallery within a secondary region.

None of the above

What factors do you consider when you select your deployment regions for Azure Virtual Desktop?*

We check that the virtual machine (VM) SKUs and Azure services that we need are available in our selected region.

Before we select a region, we familiarize ourselves with its compliance and data residency requirements.

To minimize latency and reduce data transfer costs, we place our resources in the same Azure region as our host pool.

We familiarize ourselves with the regions that Azure Virtual Desktop management plane resources are available in.

None of the above

What factors do you consider when you select a virtual machine (VM) SKU and a disk type?*

Before we select a VM SKU, we examine the CPU, GPU, memory, and storage usage of the workloads that our users run.

For single-session hosts, we use VMs with at least two physical CPU cores.

For multiple-session hosts, we use VMs with at least four cores.

We use a larger number of smaller VMs instead of a few large VMs.

We use scaling plans to adjust our number of VMs based on user demand and schedule.

When we select a disk type, we take into account the I/O operations per second (IOPS) and throughput performance limits of our VMs.

For high-performance workloads, we use solid-state drives (SSDs).

For production workloads that require high performance, low latency, and a service-level agreement (SLA), we use premium SSDs.

For Windows 10 or Windows 11 Enterprise Mul�-Session, we use premium SSDs.

For personal desktops, we use standard or premium SSDs.

None of the above

If you use FSLogix as a user profile solution, which performance, capacity, and infrastructure requirements do you consider before you select an FSLogix storage solution?*

We deploy our storage solution for FSLogix profile containers in the same region as our session hosts.

Before we select a storage solution, we check that it supports the protocols that we use.

In most scenarios, we use Azure Files as our storage solution for FSLogix.

For I/O-intensive workloads that require high performance and low latency, we use Azure Files premium file shares.

For I/O workloads that are less sensitive to performance variability, we use Azure Files standard file shares.

For a pay-as-you-go billing model, we use Azure Files standard file shares.

For large-scale Azure Virtual Desktop deployments, we use Azure NetApp Files as a storage solution for FSLogix.

We check that Azure NetApp Files is available in our region.

We consider performance requirements and costs when we select a tier and provision capacity for Azure NetApp Files.

We're aware that the capacity that we provision for Azure NetApp Files can affect our choice of tier.

None of the above

Do you use App Atach to deliver applications to Azure Virtual Desktop virtual machines (VMs)?*

We use App Atach, and we separate its storage fabric from FSLogix profile containers.

We use App Atach, and to avoid performance botlenecks, we exclude certain files and locations from antivirus scans.

We use App Attach with a multiple-session host, and we ran a test to see whether two or more users on the same session host can successfully run the app at the same time.

In our disaster recovery plans for Azure Virtual Desktop, we include steps for replicating our App Atach file share in our secondary failover location, and we ensure that the file share path is accessible in the secondary location.

We use Azure Files, and we checked that the App Atach file share contains the Storage File Data SMB Share Reader and Storage File Data SMB Share Elevated Contributor permissions.

None of the above

"*" indicates required fields

Step 1 of 25

4%

App and Data Modernization Assessment Questionnaire

Digital transformation often requires skills across multiple roles and departments. This Data and App Modernization assessment questionnaire will walk you through a series of questions to evaluate your company’s readiness for Modernizing your company apps and data and adopt a cloud based subscription model that suits your company

Please take a moment to complete the questionnaire

What percentage of your internal and external apps are currently on-premises?*

What is your timeline to migrate or modernize your applications to the cloud?*

1 year

2 years

3 years or more

How would you describe the business process complexity associated with your applications?*

Very complex

Somewhat complex

Not complex at all

Where do you currently host your applications?*

On-premises

Managed Service Provider

Public Cloud

Multi-cloud

What are the key factors and requirements for your current infrastructure? Select all that apply.*

Backup

Performance

Hardware

Disaster Recovery

Uptime

Low Latency

Data Residency

What is the primary objective of migrating your applications to the cloud?*

Increase agility

Developer productivity

Cost

Security

Increase speed of innovation

What percentage of your applications are business critical?*

What percentage of your applications leverage a microservices architecture?*

If you were to assess, what is the level of changes you need to make to move your applications to the cloud?*

Low [Rehost]

Medium [Refactor]

High [Rearchitect]

Very High [Rebuild]

Are there specific compliance or country/region-specific data requirements that can impact your migration and architectural strategies?*

Yes.

No.

Do your applications handle any sensitive personally identifiable information?*

Yes.

No.

Do you follow agile principles for software development lifecycle?*

Yes.

No.

Which DevOps tool set are you using? Check all that apply.*

Secure Source Management

Automated Testing

CI/CD

Security Scanning in CI/CD

What application servers or frameworks do your Java applications use? Select all that apply.*

Tomcat

WebSphere

WebLogic

JBoss EAP

Wildly

Spring Boot/Cloud

Java SE

Other

Which architecture patterns do your Java applications use?*

Monoliths

Web Apps

Microservices

Enterprise/Java EE

Batch

What causes your application backlog?*

Shortage of developers

3rd party legacy systems

Misalignment with business needs

Lack of funding for non-critical business applications

Lacking APIs and services

Lack of Line of Business apps for business users

What percentage of Line of Business applications do you delay development due to inefficient build processes or cost?*

What percentage of your development projects are built by fusion teams? (Fusion team development is the practice of code first/ traditional developers and citizen developers/ business developers collaborating to build applications)*

How many of your Line of Business applications currently integrate microservices or service architecture?*

How many applications do you have running containers in production?*

What is keeping you from adopting containers today?*

Operational Complexity

Application Compatibility

Knowledge and training

Security

Other

Do you currently deploy, or intend to deploy applications using containers on multi-cloud/hybrid environments?*

Yes.

No.

What version(s) of .NET are your web applications running?*

.NET 5.0 or higher

.NET Core 3.1

.NET Framework 4.8

.NET Framework 4.7.2 or earlier

Are you planning to migrate to .NET 5 or higher?*

No

Yes, in more than a year

Yes, in 6 months to 1 year

Yes, in less than 6 months

"*" indicates required fields

Step 1 of 17

5%

Cloud Migration Assessment Questionnaire

Digital transformation often requires skills across multiple roles and departments. This Migration assessment questionnaire will walk you through a series of questions to evaluate your company’s readiness for cloud migration in various areas.

Please take a moment to complete the questionnaire

Has your company identified a compelling business reason for moving to the cloud?*

Yes.

No.

Do you have executive and stakeholder sign-off for your migration project, including committed funding?

Choose one that applies to you*

We have limited or no executive commitment to migrate

We've secured executive commitment, and a funding commitment is in progress.

We have both executive commitment and funding.

Have you created a business case in your org that's based on your on premises inventory and the scope of your migration project?

Choose one that applies to you*

We have no business case, or we're still working from high-level estimates.

We're in the process of refining a business case

We have a detailed business case that's been presented to the executive sponsor.

Have you identified the applications or workloads that you're migrating as part of this initiative?*

Yes.

No.

Do you have a data and workload classification strategy in place to identify sovereign data and workloads that use this data?*

Yes.

No.

Do you have a cloud data sovereignty and governance plan for performing tasks like encrypting data in transit and data at rest?*

Yes.

No.

Have you established a process to determine when to migrate versus when to modernize a workload?*

Yes.

No.

Have you determined if there are any specific workloads, that you need to migrate or that will remain on-premises, that might affect a financial service-level agreement (SLA)?*

Yes.

No.

Have you evaluated and documented business-critical dates that you need to consider for migration activities, such as license renewals or lease expirations?*

Yes.

No.

Which aspects related to securing your workloads do you plan to design? OR did you already design?*

Yes.

No.

Do you have a landing zone ready for migration, in accordance with the Cloud Adoption Framework migration guidance?*

Do you have people assigned to work on the migration who will be coordinating with our team, including a project manager, a cloud migration team, and application owners?*

Yes.

No.

Select the ones you have already designed

Do you have a plan for using cloud service provider Policy to ensure that resources are deployed in a consistent and repeatable way?*

Yes.

No.

Have you determined whether any regulatory or compliance requirements might affect your migration plans?*

Yes.

No.

For all workloads, have you determined the need for baseline objectives to ensure workload recovery and the backup of critical data if there's a disaster?*

Yes.

No.