The architecture is settled before anyone picks an instance type
Every regulated cloud migration starts in the customer's head as a sizing exercise: cores, storage, which managed database, what the monthly bill looks like. Those are real questions and they are the easiest part of the job. In a regulated environment the shape of the architecture is fixed long before compute enters the conversation, by four constraints that have nothing to do with performance: how the data is classified, who may authenticate against it, who holds the encryption keys, and which paths data may take on the way out. Get those four right and the compute layer is close to interchangeable. Get them wrong and no amount of re-platforming rescues the schedule.
This is why two migrations with identical workloads finish six months apart. The team that spends the first month on a data inventory and an identity design ships in waves. The team that spends it standing up virtual machines spends the next nine months retrofitting boundary controls onto an environment never drawn with a boundary in it, and that retrofit has to be documented, assessed, and defended to someone paid to find the gap.
What Decides the Architecture: Relative Weight in a Regulated Migration
Editorial weighting from public guidance and delivery experience; illustrative, not a measured statistic.
Classify first, place second
Placement follows classification, and classification is a document rather than an opinion. Federal categorization runs through FIPS 199 and the information-type catalog in NIST SP 800-60, producing a Low, Moderate, or High rating across confidentiality, integrity, and availability. The high-water mark drives the baseline, and the gap is not cosmetic: FedRAMP Moderate runs to roughly 320 controls and High to roughly 410, with the increase concentrated in boundary protection, cryptography, and personnel screening.
The common error is classifying at the system level when the obligation attaches at the data level. A case-management platform can be Moderate overall and still hold a table of federal tax information carrying IRS Publication 1075 obligations, or records that trigger CJIS screening for everyone with logical access. One field pulls a whole subsystem into a stricter regime. Our first deliverable is a data inventory at table and object granularity, mapped to the authority regulating each element, because the placement decision is only defensible against that inventory.
| Data class | Where it can sit | What the reviewer asks for |
|---|---|---|
| Public / open data | Commercial regions, standard accounts | Integrity and availability controls; provenance for anything published |
| CUI on a federal contract | FedRAMP Moderate or equivalent; DoD Impact Level 4 or 5 for defense work | NIST SP 800-171 implementation, a system security plan, and under DFARS 252.204-7012 a cloud service at FedRAMP Moderate or documented equivalency |
| Federal tax information | FedRAMP-authorized environment, US-only | IRS Publication 1075 controls, and notice to the IRS at least 45 days before FTI enters the environment |
| Protected health information | Commercial or government regions under a business associate agreement | HIPAA Security Rule safeguards at 45 CFR Part 164 Subpart C, with the encryption specification addressed |
| Criminal justice information | Environments meeting the CJIS Security Policy | Personnel screening for all logical access, FIPS-validated encryption, a signed CJIS agreement |
| Classified | Accredited government regions only, Impact Level 6 and above | Facility accreditation, cleared personnel, a separate authorization chain |
What an authorization boundary actually is
FedRAMP was codified by the FedRAMP Authorization Act in the FY2023 National Defense Authorization Act (Public Law 117-263), at 44 U.S.C. § 3607 and following, which directs agencies to presume a FedRAMP authorization adequate instead of reassessing it. That presumption makes the program worth its cost, and it makes the boundary the load-bearing artifact of the package.
FedRAMP's boundary guidance states the test plainly: everything that stores, processes, or transmits federal data or federal metadata sits inside the boundary. Metadata is where the argument happens. The log-aggregation vendor receiving request paths that contain case identifiers is inside. The support-ticket system where an operator pastes an error payload is inside. The monitoring agent shipping hostnames to a commercial endpoint is inside. Each has to be authorized on its own, brought in-boundary, or engineered out, and finding the third one in month eight is how schedules die.
State and local buyers ask the same question with a smaller assessment budget. StateRAMP, which has operated under the GovRAMP name since February 2025 to reflect its local, tribal, and education members, applies the same NIST SP 800-53 baselines through a Ready, Provisional, and Authorized ladder. Several states layer a gate of their own on top; Texas requires TX-RAMP certification for cloud services holding state data.
The landing zone is the deliverable before the migration
A landing zone is the pre-built account structure, network topology, identity plumbing, logging spine, and policy guardrails that every migrated workload lands into. Building it first feels like a delay. It is the highest-return decision on the project, because it converts compliance from a per-application argument into an inherited property. Accounts separate by data classification and by environment, never merged for convenience, since an account is the strongest blast-radius boundary either major provider offers.
A dedicated security account owns the log destination, and log storage is write-once with workload accounts holding no delete permission. Organization-level policy denies whole classes of action outright: no region outside the approved set, no disabling of the audit trail, no internet gateways in data subnets, no public object access. Azure expresses the same intent through management-group hierarchy and policy assignments with deny effects. These are refusals at the control plane rather than requests to developers, which is why they survive staff turnover.
The guardrails that pay for themselves are identity and resource conditions rather than network rules. Both major clouds support a data perimeter: only principals from our organization may touch our resources, only over our own network paths. Written once at the organization level, that closes the public-bucket and stolen-credential failure classes permanently.
Identity is the architecture
If we could fix one thing on a stalled regulated migration, it would be identity. OMB Memorandum M-22-09 set the federal zero-trust direction in January 2022 with explicit requirements: enterprise identity systems, phishing-resistant multi-factor authentication for agency staff, and authorization decisions that account for device and context rather than network location. Everything downstream assumes that layer exists and works.
The work itself is federation and privilege. People authenticate to one enterprise identity provider, PIV or CAC for federal staff and a phishing-resistant provider for contractors, and cloud roles are assumed through short-lived federated sessions with no long-lived access keys in the environment. Machine identities use workload identity federation, never a static secret in a pipeline. Privileged access runs a separate path with session recording and time-boxed elevation. Assurance levels from NIST SP 800-63 give reviewers the vocabulary for proofing and authentication strength; expect to state both. Identity outranks compute because it is the only control that travels with the data, through every service boundary and every audit entry.
Network isolation: remove the public path rather than filter it
The posture we design toward is that no regulated workload holds a route to the public internet in either direction, and that every managed-service call travels a private path inside the provider's network. Private endpoints place a provider service on a private address inside your own segment, and the storage or database front door is then configured to refuse any request that did not arrive over one. That is a stronger claim than a firewall rule, because the public path is gone rather than filtered.
Connectivity back to on-premises runs over a dedicated circuit with encrypted tunnels on top and routing that forbids transit between classification tiers. Where a workload must reach outside, a license server or a package repository, it goes through one inspected egress path with an explicit allow-list and DNS filtering, and assessors ask to see that path by name. CISA's Trusted Internet Connections 3.0 cloud use case describes the pattern for federal environments. Price it while the design is on paper: private endpoints bill roughly a penny per hour per availability zone plus per-gigabyte processing, and a managed NAT gateway bills both an hourly rate and per-gigabyte processing.
Key custody, not encryption, is where findings land
Encryption in transit and at rest is table stakes and rarely produces the finding. Custody does. Provider-managed keys are acceptable for a large share of workloads. Customer-managed keys in a provider key service, with a key policy naming the exact roles permitted to use them and an audit trail on every operation, is the posture most regulated systems should hold. An external key store, where key material stays in the customer's own HSM and the cloud service calls out for each operation, answers the requirement that the provider itself cannot decrypt. It carries real availability consequences and should be chosen deliberately.
Module validation is the detail that trips otherwise-clean designs. Federal requirements point at cryptographic modules validated under the FIPS 140 program, and the Cryptographic Module Validation Program has scheduled all remaining FIPS 140-2 certificates to move to the historical list in September 2026. Any component resting on a 140-2 certificate needs a checked path to a 140-3 validated version, and that reaches load balancers, database drivers, container base images, and anything terminating TLS. For defense-adjacent customers, the carve-out at 22 CFR 120.54(a)(5) and its export-administration analog at 15 CFR 734.18(a)(5) make end-to-end FIPS 140 compliant encryption the reason a cloud environment can hold controlled technical data at all.
The shared-responsibility split people get wrong
Every provider publishes a shared-responsibility diagram and every customer nods at it. The diagram is not the problem. The problem is the third category it flattens.
Provider-implemented. Physical security, hypervisor isolation, control-plane infrastructure. You inherit these and cite the provider's package as evidence.
Customer-implemented. Your code, your data, your access policies, your configuration. Nobody disputes ownership and every team plans for them.
Shared or hybrid. This is where the schedule goes. The provider supplies a capability; you must turn it on correctly, keep it on, and prove both. Encryption at rest is available and off by default in more services than teams expect. Audit logging exists and captures a subset of events until you configure the rest. Vulnerability scanning covers the provider's layer and stops at your container image. Every authorized offering ships a customer responsibility matrix enumerating these line by line, and reading it in week two rather than week thirty is the difference between an engineering plan and a surprise.
The companion error is inheritance by assumption. A service available in a government region does not necessarily sit inside that region's authorization scope, and scope varies by service and by impact level within one provider. Our engineers keep authorization status as a live column in the design document, because one unauthorized managed service can force a re-architecture two months from cutover.
Egress rules reshape the design
Ingress is a solved problem. Egress is where regulated architectures diverge from commercial ones, and it operates on three levels at once.
Legal egress. Which jurisdictions may hold the data, which personnel may have logical access, and what must happen before a byte crosses either line. Government regions carry contractual commitments about US-based storage and US-person operational staff, which is the real reason to pay their premium. Support workflows are the leak: a clean environment with an offshore support tier that can view a payload has an egress problem no network diagram will show.
Technical egress. Which paths exist for data to leave, and what inspects them. Signed URLs, replication rules, read replicas, backup targets, and third-party integrations are all egress. So is a developer laptop holding a database client and a production credential. This is where identity conditions do more work than firewalls.
Economic egress. What it costs to move data out, and therefore what the architecture will quietly avoid doing. Standard internet egress in commercial regions prices around nine cents per gigabyte at the first tier and government rates run higher, which pushes analytics next to the data, turns cross-region replication into a budget decision, and sends bulk migration traffic over a dedicated circuit. Through 2024 the major providers waived egress charges for customers moving entirely off their platform, following the EU Data Act; that lowers the cost of leaving and nothing else.
A migration sequence that holds up
The sequence below is the one our team runs. Durations assume a mid-size portfolio of forty to eighty applications with one regulated data class dominating. Scale accordingly, and expect the authorization track to run in parallel from week one instead of waiting at the end.
Regulated Migration: Working Sequence
Step five is the one most often skipped under schedule pressure, and skipping it is the expensive choice: moving one regulated workload completely surfaces every wrong assumption in the landing zone while the cost of being wrong is one application instead of eighty. Step six ends in decommissioning, a records action as much as an infrastructure one. Federal electronic records carry retention and disposition obligations under 36 CFR Part 1236, and leaving the old database running just in case is a finding rather than a rollback plan.
Where these projects stall
Across regulated migrations the failure points cluster, and none of them are compute.
- Boundary disputes. A monitoring, logging, or support tool that touches federal metadata and holds no authorization of its own. Found late, it forces re-engineering under deadline.
- Legacy authentication. Applications wired to on-premises directory protocols that assume a flat network. Federating them is application work, rarely budgeted as such.
- Data-owner sign-off. System owner, privacy office, and records officer each hold a veto and review sequentially. Starting in month one costs nothing; starting in month eight costs a quarter.
- Interconnection agreements. Every connection to an outside system needs a documented agreement. NIST SP 800-47 Revision 1 covers the form; the delay is signature routing.
- Unscoped managed services. A service in the design that is not in the authorization scope at the required impact level. Verify per service, per level, before approval.
- Evidence debt. Controls implemented correctly and never documented. An assessor cannot credit what is not written down, and reconstruction is slower than recording.
Defense customers carry one more item that has moved from theoretical to contractual. The CMMC program rule took effect at 32 CFR Part 170 in December 2024, and the acquisition rule putting the clause into contracts followed in late 2025. Contractors holding CUI now face an assessment requirement on a defined phase-in, and the cloud environment holding that CUI is squarely in scope.
Bottom line
A regulated cloud migration is a data-governance project with an infrastructure component. Compute is the commodity. Classification, boundary, identity, key custody, and egress are the design. Teams that sequence it that way move in waves and pass their assessments on evidence that already exists. Teams that start with servers spend the back half of the project proving things about an environment that was never drawn to be provable.
Common questions on scope and sequencing
Can we start migrating before the authorization work is done?
Yes for unregulated workloads, and doing so is a good way to prove the landing zone. What cannot happen is regulated data landing in an environment whose boundary is undefined. Run the authorization track in parallel from week one and gate only the regulated waves on it.
Do we need a government region, or will a commercial region do?
It depends on the data class and the contract. Much CUI and most protected health information can live in commercial regions under the right authorization and agreements. Federal tax information, criminal justice information, higher-impact-level defense workloads, and anything with a US-person access restriction drive you to a government region. The deciding factor is usually personnel access commitments rather than technology.
Is lift-and-shift ever the right call for regulated systems?
Sometimes, usually when there is a hard datacenter exit date. Lift-and-shift into a properly built landing zone is defensible, because guardrails, logging, and identity controls are inherited from the environment. Lift-and-shift into an unstructured account is how organizations end up re-migrating within three years.
Frequently asked questions
The documented set of components that store, process, or transmit the regulated data, metadata included. Everything inside must be covered by the authorization, and everything outside must be shown not to touch the data. Logging, monitoring, and support tooling are the components most often left out by mistake.
Both apply NIST SP 800-53 baselines to cloud service providers. FedRAMP is the federal program, codified by the FedRAMP Authorization Act in the FY2023 NDAA, and its authorizations carry a presumption of adequacy across agencies. StateRAMP, operating as GovRAMP since February 2025, serves state, local, tribal, and education buyers through Ready, Provisional, and Authorized statuses. Some states add their own gate, such as TX-RAMP in Texas.
Customer-managed keys in the provider's key service, with a key policy naming the exact roles permitted to use them and an audit trail on every operation, is the right default. Dedicated hardware modules or an external key store are warranted when the requirement is that the provider itself cannot decrypt. Confirm that whatever module you rely on holds a current FIPS 140-3 validation.
Because the evidence is part of the deliverable. Every control must be implemented, documented, assessed, and monitored continuously, and approvals from system owner, privacy, records, and security run sequentially. The engineering matches a commercial migration; the governance track extends the calendar, and it shortens only by starting first.
They push processing toward the data instead of data toward processing. Internet egress in commercial regions prices around nine cents per gigabyte at the first tier and government rates run higher, so cross-region replication and cross-cloud designs become budget decisions. Bulk migration traffic normally moves over a dedicated circuit or a transfer appliance.