Capspedia took the engagement in two phases: a migration and modernization programme, followed by ongoing managed operations under the same team — so the people who designed the environment remain accountable for how it runs.

3.1 Migration and modernization

1. Discovery and dependency mapping across the existing estate, with a wave plan sequenced by risk and business criticality.
2. Landing zone build on AWS with multi-account separation for production, non-production and shared services, guardrails and centralised logging in place before workloads landed.
3. Full rebuild of infrastructure as code in Terraform — every environment now reproducible from a repository, with drift detection running continuously.
4. Modernization where it paid for itself: containerised workloads, managed databases in place of self-managed instances, and managed services for queuing and caching.
5. Wave-by-wave cutover with documented rollback criteria and hypercare following each wave.

3.2 DevOps and platform engineering

1. CI/CD pipelines rebuilt with automated testing gates, artefact promotion and controlled production release.
2. Golden image and container base pipelines, so security patching flows automatically into every new deployment.
3. Policy-as-code guardrails preventing non-compliant infrastructure from reaching production.
4. Ongoing platform operations: cluster upgrades, capacity management and developer self-service tooling.

3.3 Security and compliance

1. Continuous cloud security posture management with automated detection and remediation of misconfiguration and drift.
2. Identity governance: least-privilege IAM design, privileged access controls and periodic entitlement recertification.
3. Encryption and key lifecycle management, secrets management, and centralised audit trail retention.
4. Vulnerability management across workloads and container images, with remediation SLAs by severity.
5. Standing evidence packs maintained for partner and regulator security reviews — assembled continuously rather than on demand.

3.4 Backup and data protection

1. Policy-driven backup with centralised policy management across all accounts and regions.
2. Retention schedules mapped per workload class to the company's regulatory record-keeping obligations.
3. Immutable, logically isolated backup copies to defend against ransomware and accidental deletion.
4. Scheduled sample restore testing, with results published in the monthly service report.

3.5 Disaster recovery and business continuity

1. Business impact analysis to set recovery objectives per workload tier, agreed with the business rather than assumed by IT.
2. Warm standby architecture for the customer-facing trading path; backup-and-restore for lower tiers.
3. Documented recovery runbooks, maintained as the environment changes.
4. Scheduled DR drills with measured results against stated RTO and RPO, and corrective actions tracked for any gap.

3.6 Data platform operations

1. Managed operation of the data pipelines feeding portfolio analytics and the AI recommendations engine.
2. Pipeline monitoring with SLA management on scheduled and streaming jobs, and alerting on freshness and volume anomalies.
3. Warehouse performance and cost tuning, and access governance across the data estate.

3.7 Cost optimization (FinOps)

1. Tagging taxonomy and account structure enabling cost attribution by product line and environment.
2. Rightsizing of compute, storage and database resources against observed utilisation.
3. Commitment portfolio management across Savings Plans and Reserved Instances, with coverage and utilisation targets.
4. Storage lifecycle policies and elimination of idle and orphaned resources.
5. Cost anomaly detection with alerting, and monthly reporting against the agreed baseline.