Frequently asked questions

Mostly AWS, Microsoft Azure and Google Cloud, with delivery experience on Huawei Cloud and Alibaba Cloud too.

FPT Software is a partner of all five. The method is the same on each: a landing zone as code, a 7R decision per workload, waves, then operations.

Not always. For a handful of servers ready to rehost, a short express path is enough: replicate, test, cut over.

For a portfolio, the assessment pays for itself: dependencies, end-of-support items and applications to retire, ending in a roadmap, a TCO and a first wave.

Both, decided per workload by written rules and signed by an architect.

We modernise where the case is clear and rehost first where a deadline matters more, then modernise once the workload is in the cloud.

The pace comes from parallel streams, not heroics: several five-person teams on one runbook, each moving its own wave.

Every go-live is followed by two weeks of hyper-care before handover to operations.

NGT's assessment accelerator. Our architects run it on the files you share; you receive the reports, the 7R decisions and the wave plan, each signed by an architect.

You never log in and it moves nothing. Its connectors are read-only, every file version is checked by hash, and project data is purged 7 days after the project is deleted.

AI reads and drafts: it reads discovery files and documents, drafts the assessment and cross-checks every statement against its source. Every AI answer is recorded and can be replayed.

Decisions do not come from AI. 7R paths follow written rules, Go/No-Go checks are code, and an architect signs each step.

Yes: monitoring, ITSM, backup and DR, security operations and cost reviews, working in your ITSM tool.

NGT's reference service levels start at 30 minutes response and 4 hours resolution for a P1 incident, agreed per customer.

Guardrails come first: identity, network segmentation, logging and policy as code are in the landing zone before the first workload.

Every workload passes an architecture and security review before go-live, against the customer's frameworks such as ISO 27001, HIPAA/HITRUST, PCI DSS or GDPR.

With Scan: two to three weeks to assess repositories, pipelines, secrets and access, and to score maturity. Evaluate turns the findings into a prioritised roadmap in one to two weeks.

If you already know the gaps, we can pilot the pipeline with one team and assess in parallel.

Not when they are designed for it. Fast checks run first, on the laptop and in the pull request; slower scans run on deployed environments.

Thresholds are agreed per team and tightened over time, so the first gates stop critical issues without blocking every build.

No. We integrate what works and replace a tool only where it blocks a gate or duplicates another. We have delivered on GitHub, GitLab, Bitbucket, Jenkins, Azure DevOps and the AWS developer tools.

These are frameworks we design and evidence controls against on client platforms; the certification or attestation belongs to the client.

NGT's own projects follow FPT Software's information-security risk process, mapped to ISO/IEC 27001:2022 Annex A controls.

AWS, Azure, Google Cloud and Huawei Cloud, hybrid estates with on-premises systems, Kubernetes and serverless. The controls are the same everywhere; the native services differ.

Yes. SRE & observability is one of our service lines: SLOs and error budgets, monitoring, on-call and post-mortems.

Under NGT's service-based model the reference P1 response is 30 minutes, with resolution in 4 hours. Each contract sets its own.

Pilot the standard pipeline in one team or delivery centre, measure adoption, then roll out with governance that tracks each unit. Consultants work with business units while the engineers build.

No. Backstage is a common choice and NGT has delivered Backstage-based portals, but the portal is one of five planes.

We can build on a portal you have, or start with templates and pipelines and add the portal later.

The first deliverable is an MVP with two or three pilot applications: a portal, the first golden-path templates and the pipelines behind them. We grow from there, team by team.

No. Microservices on EKS and monoliths on EC2 can share one golden path: GitOps for one, Jenkins and Ansible with blue-green releases for the other, with the same checks and dashboards.

The rules live in the platform: scans and policy as code in every pipeline, approvals per environment, time-boxed production access and an immutable audit log. Security reviews the path once instead of every project.

Cost is part of the path: estimated before provisioning, tracked per team and component, with budget alerts. Teams see their own spend in the portal.

Your choice. NGT can run it as a product with you, or hand it over. Large programmes include an insourcing stream so your engineers can operate and extend it.

On top of a working platform. AI patterns become templates, models are deployed from the portal, and agents work through the same golden paths and approvals as people. Engineers keep the decisions.

We agree the measures at the start: DORA delivery metrics, developer experience (SPACE), adoption and cost, and report them as the platform grows.

Both, but the production work is agents that act: they log and route requests, run data queries, watch services and guide failure handling.

A knowledge assistant over your documents is often the first step, and the same harness carries over.

Whatever fits your data rules: Azure OpenAI, Amazon Bedrock, Google Vertex AI, open-weight models on GPU Kubernetes, or in-region endpoints in Vietnam and Japan.

One LLM gateway sits in front of them, so routing, budgets and audit work the same way for every model.

Guardrails on input and output, a policy check on every tool call, tools only through an MCP gateway with single sign-on, evaluation before every release and a hand-over to people.

Sensitive actions wait for a person, and every call is logged.

Yes. Two delivery patterns: no customer data offshore, where only reviewed packages cross into your zone; and one agent, two environments, where production runs on a self-hosted open-weight model in your network.

With a PoC on one workflow and a success measure agreed up front, before any wider rollout.

Every later release must pass the same test set without regressions.

No. They are run by FPT Smart Cloud, a sister company in the FPT group; CodeVista is built by FPT Software's AI Center. NGT designs, integrates and operates on them when they fit.

No. It takes repetitive work off them. Engineers review every AI draft, and rewrite or reject what does not meet the standard.

Architects own the design, and every change passes the same review and quality gates as hand-written code.

Data engineering builds the data products: pipelines, models and datasets. DataOps builds and runs the platform under them, and the CI/CD, tests, access and monitoring around them.

With a fixed-scope Data Maturity Assessment across six dimensions. You get a scorecard, a ranked backlog, quick wins and one pilot use case tied to a business pain point.

AWS, Azure and Google Cloud, with Databricks, Snowflake, BigQuery or Synapse. The design is cloud-agnostic; we start from what you run today.

No. Your data engineers keep the data products; NGT builds and runs the platform and automation. NGT engineers can also join your platform team.

ML models, RAG and agents need current, tested, access-controlled data. DataOps serves it from the governed platform, so AI pilots reach production without a separate copy.

Targets agreed at the start, such as infrastructure as code, automated data deployments, pipeline success, availability and time to restore, reported from the pilot onwards.

When data must stay where it is, or the platform must move between clouds or into a data centre. Where both apply, an automated check can block managed AI services.

Otherwise SageMaker, Azure Machine Learning or Vertex AI are often the faster start, and we build on them too.

Yes. A web interface covers datasets, labels, runs and approvals, so domain experts can retrain on new data. Release still needs the gate and a sign-off.

It depends on the model and the hardware. We agree a latency target per decision up front and measure it on your hardware before go-live.

No. Drift can start a candidate run automatically, but that run only trains and tests. Release needs the gate, shadow results and a person's signature.

The reference build runs on Amazon EKS. The same design runs on AKS, GKE, your data centre or FPT AI Factory; we also build on SageMaker, Azure Machine Learning and Vertex AI.

Application and pipeline code, Terraform, dashboards, runbooks and a model card per model, in your repositories.

It depends on scope, data and the target cloud. We size each build after an assessment.

Automation and AI applied to operations data (metrics, logs, traces, tickets and changes) to find problems earlier, find causes faster and fix known problems safely.

At NGT it covers request and service management, change and operations automation, and proactive monitoring and incident support.

Yes. Automation is only as good as its signals. If telemetry is incomplete or alerts are noisy, we start with the observability foundation and alert hygiene.

Only for known failures with an approved runbook that can be verified and reversed. New or risky actions go to an engineer, with the evidence and a proposed fix.

Yes. Agents and automation plug into what you run, such as ServiceNow, Prometheus, Grafana, Datadog, Splunk or CloudWatch. They do not replace them.

With an assessment of monitoring, alert volume, ticket flow and runbooks, then a pilot on a few high-volume, low-risk use cases such as ticket or alert triage.

A routing layer sends each request to a suitable model, and more than one provider is supported. The choice follows your security and data-residency rules.

AIOps uses AI to run IT operations. MLOps runs the AI itself: training, releasing and monitoring models with human sign-off. NGT delivers both.

With an assessment of your bills and usage: rates and trends, account hierarchy and tagging, and how each workload uses what it pays for.

It ends with findings, quick wins and a plan: who owns what, which levers first, and which guardrails to build.

We do not quote a percentage before we have seen the data. Assessment figures are labelled as estimates; a saving counts once it shows on the bill.

The quickest wins usually come from non-production: idle resources, environments running at night, oversized machines.

No. Analysis runs on read-only access and billing data; changes are made by the workload owners or through your pipelines.

Where you prefer, write actions stay disabled centrally and account owners apply every fix themselves.

AWS, Microsoft Azure and Google Cloud, starting with each provider's own cost data: the AWS Cost and Usage Report, Azure Cost Management and the Google Cloud billing export.

Then tools chosen per customer: InfraCost for estimates in pipelines, CloudFix for continuous AWS fixes, Datadog or Grafana for dashboards.

They should not. Estimates run inside the pipeline, development deploys freely, and approval is needed only above a threshold or for higher environments.

Right-sized defaults and cost tags come with the templates, so the cheap way is also the easy way.

A language model can draft saving suggestions from current billing and configuration data and send them to the owners.

Owners and engineers decide. Nothing changes because a model suggested it.

Both. It starts as a project (assess, plan, pilot, launch), then runs as a monthly rhythm, by your own FinOps team or as part of NGT's managed cloud service.

No. NGT delivers on AWS, Microsoft Azure and Google Cloud, and on Huawei Cloud and Alibaba Cloud. The method is the same; the tools are each cloud's own.

Both. A new platform starts from the same landing zone, with containers, managed data stores, pipelines and monitoring in place before the first release.

With an assessment built on discovery data, or with a landing zone for a first workload. A pilot proves the pattern before any wave starts.

AWS's own: Application Discovery Service, Migration Hub and Migration Evaluator to assess; Application Migration Service, DMS and DataSync to move; Control Tower and Terraform for the landing zone.

Yes. The managed service covers monitoring, incidents, changes, backup and DR, security operations and cost reviews, under an agreed SLA with Level 1 to Level 3 support.

Partner programmes with AWS are held by FPT Software at company level. NGT claims no tier of its own; the current status is confirmed for each proposal.

From FPT Software Hanoi's certification register: 30 AWS certifications earned by 22 NGT engineers as of November 2024, plus 2025 additions. Certifications lapse unless renewed, so validity is confirmed for each proposal.

With an assessment of the estate, or with a landing zone for a first workload. Both follow Microsoft's Cloud Adoption Framework, and a pilot proves the pattern before migration waves start.

Microsoft's own: Azure Migrate to discover, assess and move servers; Database Migration Service, Data Migration Assistant and SQL Server Migration Assistant for databases; Azure Monitor and Log Analytics once systems are live.

A four-step loop: set cost goals, find under-used resources, monitor, and enforce controls with Azure Policy and approval gates. Infracost can estimate every Terraform change before anything is created.

Yes: data pipelines with Data Factory and Synapse, models trained and served with Azure Machine Learning, and results in Power BI or applications. A person approves each model version before release.

Microsoft partner designations are held by FPT Software at company level. NGT claims none of its own; the current status is confirmed for each proposal.

From FPT Software Hanoi's certification register: 20 Azure certifications earned by 12 NGT engineers as of November 2024, plus 2025 additions. Microsoft certifications renew every year, so validity is confirmed for each proposal.

With an assessment of the estate, usage and billing data, then a plan and a pilot of one low-risk workload. The launch follows only once the pilot has checked performance, stability and cost.

Google's own: Migrate to Virtual Machines for servers, Database Migration Service for databases, and Cloud Monitoring and Cloud Logging from the first day. The foundation is written in Terraform.

Yes: pipelines on Dataflow, Pub/Sub and Cloud Composer, analytics in BigQuery and Looker, and models on Vertex AI, built by DevOps, data and AI engineers together.

Yes. NGT designs regulated platforms on Google Cloud where every project is created from code and every release passes security and quality gates, against the customer's frameworks such as ISO 27001, PCI DSS or HIPAA.

Google Cloud partnerships are held by FPT Software at company level. NGT claims none of its own; the current status is confirmed for each proposal.

Usually lower infrastructure cost, or a second public cloud so as not to depend on one provider. NGT keeps the same pipelines and the same way of working on every cloud, so a second cloud does not mean a second way of delivering.

Huawei Cloud's own: Server Migration Service for servers, Data Replication Service for databases and Object Storage Migration Service for files and objects. The landing zone is written in Terraform.

Virtual desktops on Huawei Cloud Workspace that the delivery team uses to reach the customer's systems. Policies stop data leaving the desktops, so no customer data sits on the team's own devices.

The landing zone is redesigned first and a pilot proves the runbook. Then parallel teams move applications in waves, each guided by an owner from the customer; each go-live gets a period of hyper-care before the maintenance team takes over.

Huawei Cloud partnerships are held by FPT Software at company level. NGT claims none of its own; the current status is confirmed for each proposal.

Landing zones designed and deployed as code, DevOps pipelines for infrastructure and applications, migration and modernisation, and operations with FinOps, CloudOps and SecOps practices. Mainframe and COBOL modernisation is led by FPT Software's legacy teams.

An API gateway sits in front of the legacy application. Each capability is rebuilt as a service and its route switched over, while data stays in sync. Users keep one address, and the old code retires once its last route has moved.

Alibaba Cloud's own: Server Migration Center for servers, Data Transmission Service for databases and Data Online Migration for files and objects. The landing zone is written in Terraform or Resource Orchestration Service templates.

They were earned in 2024 and are valid for two years, so most have lapsed or lapse by December 2026. Renewal and current validity are confirmed for each proposal.

Alibaba Cloud partnerships are held by FPT Software at company level. NGT claims none of its own; the current status is confirmed for each proposal.

It depends on the capability and the estate. In NGT's DevSecOps framework, Scan takes 2–3 weeks and Evaluate 1–2 weeks.

Cloud assessments scale with servers and applications; the scope is agreed first.

No. Start where you are: an assessment alone, engineers joining a running programme, or operations of a platform you already have. The phases describe how NGT works when it owns the outcome end to end.

A checklist per capability that places each area at Initiate, Challenger or Mastery. The Maturity Model page shows what is checked.

That is what the PoC is for: fail fast and move forward. The approach or the estimate changes before the full plan is made.

Templates and infrastructure code, dashboards and runbooks, playbooks, SLOs with error budgets, documentation and training, after hyper-care has let the system settle.

As an accelerator under engineers' control: FleziLift cross-checks migration files, and AI assistants draft code, tests and documents for review. Decisions and sign-off stay with NGT's architects and with you.

They are NGT's own levels from its service offering: Initiate, Challenger and Mastery.

Capability views build on known models where they fit, such as Puppet's five stages of DevOps evolution.

No. Each capability and area is scored on its own, and the target is agreed area by area.

It depends on scope; the plan is made after the MVP or PoC. As a reference, NGT plans a move to platform teams over 6–12 months, not as a big bang.

NGT architects and consultants, with your leads in the room. The target level is your decision.

For AI in the software lifecycle: three levels, from AI-assisted to AI-orchestrated. At the top, approval is policy-gated with audit, and a person stays accountable.

If the scope is still moving, T&M or the service-based model; if an assessment or PoC has made it clear, fixed price is an option.

Many engagements choose the model for the next phase from what the assessment finds.

P1: 30 minutes and 4 hours. P2: 4 working hours and 1 working day. P3: 1 and 3 business days. P4: 3 and 5. All are adjusted per client.

An NGT engineer inside your team, tools and rituals, taking work to production. A senior architect comes first; the team grows once the approach is proven.

Yes. Where a programme requires it, from a separate, secured working area or development centre. See Secure Delivery.

Tech leads own the quality of what is delivered; PMs manage the pool and effort; every request is a ticket.

No. Prices are quoted per engagement.

NGT holds no certifications of its own. Company certifications belong to FPT Software, with scope confirmed per engagement.

NGT brings the practice: project risk management mapped to ISO 27001 Annex A, and controls designed against your industry's frameworks.

Yes. Engineers can work from a secured area or through virtual desktops, and agents can run on self-hosted open-weight models in your zone.

Only where your policy allows, with enterprise-licensed tools and data sharing off. Customer data is masked, and every output is reviewed like any change.

A delivery pattern: build and test offshore on mock or synthetic data; the release crosses into your zone after review, checks and your approval.

ISO 27001, HIPAA/HITRUST, PCI DSS, GDPR, NIST, SOC 2, CIS, OWASP, GxP, MAS TRM and OSPAR: frameworks NGT works to, not certifications it holds.

In a vault, never in code or pipelines, with pre-commit leak checks and access per role and environment.

No. NGT is a business unit inside FPT Software Hanoi, part of FPT Software. Engagements are contracted with FPT Software.

In 2024, as Next Generation Technology.

Team sizes are given per proposal. As an indication, in November 2024, 59 NGT engineers held 144 hyperscaler certifications.

AWS, Microsoft Azure, Google Cloud, Huawei Cloud and Alibaba Cloud, plus on-premises and hybrid estates.

Europe, America, Japan and South Korea, Asia-Pacific, Australia and the Middle East.

AI tools draft and check; NGT architects and engineers sign off designs, and a person approves every production release.

Cloud and solution architects, DevSecOps and SRE engineers, platform engineers, data and MLOps engineers, AI engineers and forward-deployed engineers.

Six DevOps levels from DEVO01 Junior to DEVO06 Principal, with an intern and on-the-job-training pipeline in front of it.

Certification is part of every annual review; engineers re-skill into AgentOps, LLMOps, DataOps and MLOps; hackathons and technical sharing spread what works.

English is the working language. JLPT and TOPIK certificates count in the annual review, and there is a Japanese club. Language needs are confirmed per proposal.

No. The skill figures describe a sample of 38 engineer profiles. Team sizes are given per proposal.

It is the latest register export that splits certifications by vendor and level for every FHN unit. A refreshed NGT count is pending.

The counts are certifications earned. AWS lasts three years, Microsoft role-based ones are renewed yearly, Alibaba and CKA last two. Validity is checked per proposal.

AWS Professional and Specialty, Microsoft Expert, Google Cloud Professional, Huawei HCCDP, and Alibaba ACP and Specialty: 31 held by NGT engineers in November 2024.

Partner programmes are held by FPT Software at company level. NGT claims no tier of its own; the current status is confirmed with FPT Software's alliance teams per proposal.

In November 2024 NGT held 23% of FHN's exam-based cloud certifications and 30% of its professional-level ones, from about 3% of FHN's people.

Yes. Proposals list each proposed engineer's certifications, checked against the register.

Yes. The toolchain is fitted to your estate; NGT brings the pattern: golden paths, security gates, landing-zone structure and release rules.

Partner programmes are FPT Software's, at company level, not NGT's. The current tier is confirmed with FPT Software's alliance teams per proposal.

The one that fits your estate, skills, regulations and contracts. The assessment compares them; NGT works on all five.

Yes. NGT builds landing zones, migrations and virtual desktops on Huawei Cloud and landing zones as code on Alibaba Cloud. Its engineers hold all of FHN's Huawei HCCDP and Alibaba ACP certifications (Nov 2024).

It depends on the constraint: hosted models routed through one gateway, or self-hosted open-weight models inside your zone when data cannot leave it.

Both appear in delivered work. Kubernetes, Terraform, Argo CD and Backstage are common foundations; commercial tools are used where the customer standardises on them.

Several small teams work in parallel, each moving a few applications at a time through the same runbook and gates.

Pace depends on complexity and on how quickly owners can test, so we plan from your inventory.

No. Every application gets a 7R decision: relocate, rehost, replatform, refactor, repurchase, retire or retain. We modernise where it pays back and retire what nobody uses.

No. NGT engineers run it on the files you share. You receive the inventory, 7R decisions and wave plan, each signed by an architect.

Yes. Most engagements start from an existing estate. We assess it against the same design areas, fix what blocks the next workloads first, and bring the rest under code over time.

The cloud's own building blocks, such as AWS Organizations and Control Tower, Azure management groups and Policy, or Google Cloud projects, defined in Terraform, CDK or Bicep.

It should do the opposite: approved patterns become self-service, and approval gates sit where the risk is, such as production.

Often, yes: servers rehost and containers redeploy with little change. Where a service has no direct equivalent, such as a managed database engine, we plan the change and test it in a pilot.

They are re-targeted first. Teams keep one reference pipeline with the same gates, pointing at the source or the target as each group moves.

Yes: Huawei Cloud and Alibaba Cloud too. When data must stay in Vietnam or Japan, FPT Smart Cloud's platforms are another option we build on.

No. Some fit serverless containers such as ECS on Fargate, and some monoliths stay on VMs for now. Both get a supported delivery path.

Mostly the managed services: Amazon EKS, Azure AKS and Google GKE. Self-managed clusters where Kubernetes must run in your own data centre.

Your platform team, ours, or both. We hand over runbooks, upgrade procedures and dashboards, and can run the clusters under SLA.

Not necessarily. We standardise on the one that fits best (GitLab, GitHub, Bitbucket or Azure DevOps) and consolidate the rest, with history and access migrated.

Gates run automatically on every change, so most findings are fixed before review. Only critical findings block a release, with thresholds agreed with your security team.

The first teams move during Collaborate, typically four to eight weeks; the rest follow in waves, each with templates, guidelines and onboarding docs ready before it starts.

Yes, with the right boundary: separate, secured working areas, and engineers building on synthetic data while production data stays in your environment.

Most often ISO 27001, NIST, SOC 2, GDPR, HIPAA, PCI DSS, CIS and OWASP. Public-sector programmes may add their own security model, such as zero trust.

It can: every deployment and infrastructure change goes through reviewed CI/CD. Emergency access, where needed, is time-boxed and logged.

No. It is a common choice and the one we have delivered most, but the value is in the templates, automation and guardrails behind the portal.

We agree measures up front: lead time, deployment frequency, onboarding time, template adoption and cost per team. The pilot must move them before the platform scales.

Yes, and we recommend it: co-developed with your engineers, so your platform team owns it after handover.

No. AI drafts; engineers design, review and approve. Every AI-written change passes the same reviews, tests and gates.

A baseline before the pilot, then five groups of measures: code quality, deployment velocity, operational efficiency, team satisfaction and business impact.

Only enterprise-licensed tools with data sharing off, customer data masked in prompts, and self-hosted models where your policy requires them.

ServiceNow and similar ITSM platforms, with an event queue and a database for state. Agents reach other systems through MCP tools, so a new integration is a new tool.

Not by default. Agents prepare, test and document a change; a person approves it. Automatic actions are limited to agreed, low-risk runbooks, all logged.

The ones your policy allows. A routing layer sends each task to a suitable model: a strong one for planning and review, a faster or self-hosted one for routine steps.

It answers only from retrieved passages, shows them, and declines when nothing relevant is found. Evaluation sets catch regressions before each release.

Yes. Language detection runs at ingestion and multilingual models handle mixed content. We test with questions in each language you use.

Yes, when given tools. The same retrieval layer feeds the agents we build for IT operations, which run queries and follow SOPs under guardrails.

For extraction, summaries, classification and routine drafting, often yes, and they keep data in place. Hard reasoning goes to a stronger model where policy allows. We test both on your tasks first.

Not necessarily. Hyperscaler GPU nodes, an in-country GPU cloud or your own servers all work; data rules, load and cost decide. We size it from a measured pilot.

Every call goes through the gateway, which records team, project and model, enforces quotas and feeds a cost dashboard: the FinOps discipline we apply to cloud spend.

Yes. They label images, start candidate runs and compare results in the web app; a release still needs an approver.

Answer time is a design target set from your line speed. We size serving capacity to it and benchmark on production hardware before go-live.

No. The loop and rules apply to any visual inspection, such as circuit boards, components, packaging or surfaces. Models and thresholds are tuned per product.

No. We build and run the platform, automation and controls they work on, and can embed DataOps engineers in your team.

Databricks, Snowflake, BigQuery and Synapse on AWS, Azure or Google Cloud, with Spark, Kafka and Airflow for pipelines and Terraform for the platform.

A maturity scorecard across six dimensions, gaps and risks, quick wins, and a prioritised roadmap with a pilot use case.

Usually not. AIOps works on the telemetry you already collect (Prometheus, Datadog, Splunk, New Relic or the cloud's own) once it is unified and tagged consistently.

Automated actions are limited to known, reversible patterns and are logged; anything else becomes a suggestion for an engineer. Every action has a rollback.

They work together: AIOps detects and explains; operations agents open the ticket, follow the SOP and prepare the change.

Yes. Most often we join your rotation, tools and rituals; the split of on-call and change ownership is agreed up front.

Open standards first (OpenTelemetry, Prometheus, Grafana, Loki, Tempo) and the commercial platforms clients run, including Datadog, Splunk and New Relic.

Yes: controlled experiments against agreed SLOs, with a report of what failed and what changed.

Not to start. Cloud-native cost tools, tagging and an estimate step in the pipeline cover most needs; commercial tools are added for large estates.

Each saving is tracked from potential to completed to realised, and counted as realised only once the billing data shows it.

The teams that own the resources. A central FinOps function sets policy, reports and coaches.

Not always. Many systems meet their objectives with multi-zone design and verified backups; cross-region recovery is added where RTO and RPO require it, at an agreed cost.

Drills are tiered. A tabletop and an isolated restore touch nothing in production; a zone drain runs only with agreed controls and rollback.

Yes. We plan and execute drills under your authorisation, and report what worked, what failed and what changed.