Every UAE enterprise cloud migration we're brought into midway looks the same. The first three workloads landed quickly — that was the demo. The fourth workload surfaced an identity pattern nobody had thought about. The fifth exposed a logging gap the auditor asked about. The seventh triggered a bill that nobody had a tag structure to explain. By workload ten, the cloud programme is negotiating with itself about which security debt to remediate first, and the CFO is asking why the monthly bill is triple what the pilot suggested.
The instinct is to keep landing workloads and clean up the foundation later. The instinct is expensive, exhausting, and rarely results in a foundation that actually gets cleaned up. What works is doing the foundation first — identity, logging, DR, FinOps — sized for the workload trajectory ahead, audited before workload one arrives, and instrumented so every subsequent deployment inherits the discipline rather than negotiating with it. B5 does that foundation on a fixed scope in 4–8 weeks.
Six streams,
ending in foundation audited.
Architecture design and identity patterns front-load weeks 1–3. Logging, DR, and cost guardrails overlap through weeks 3–7. Validation and DR rehearsal close weeks 7–8.
Architecture design
Landing zone architecture designed to your regulatory scope, workload trajectory, and existing identity estate. Signed by CISO and infrastructure lead before Phase 2.
Identity patterns
Sovereign-region identity patterns wired to your existing IdP. Access patterns for workload teams designed as inherited defaults, not as per-workload negotiations.
Centralised logging
Centralised logging estate that satisfies PDPL, ADHICS v2, and CBUAE audit expectations. Retention aligned to regulatory scope, not defaulted to cheapest tier.
DR runbooks
Disaster recovery runbooks per critical service pattern, tested by walkthrough with the operator team. Never shipped un-rehearsed.
FinOps guardrails
Mandatory tagging enforced at deployment, budget guardrails per environment, weekly cost anomaly report wired to a named owner.
Validation & DR rehearsal
Baseline security checks run against the landing zone. DR runbook rehearsed end-to-end with the operator team. 30/60/90-day check-ins scheduled.
Eight weeks maximum.
Four minimum. Four phases.
Phase count is fixed. Duration flexes with regulatory scope, existing identity estate complexity, and the number of workload teams needing inheritance patterns. Milestones are signed gates — not aspirations.
Providers scored,
not on regional pricing.
Every engagement runs a six-criteria scorecard in weeks 1–2. Each candidate provider and configuration scored 1–5 against your regulatory scope, existing estate, and workload trajectory. Signed by CISO and infrastructure lead before Phase 2 begins.
From workloads on sand
to workloads on foundation.
A typical pre-engagement state has cloud workloads deployed against inconsistent identity, incomplete logging, no DR rehearsal, and no cost governance. The engagement stands up the foundation that subsequent workloads inherit from.
Reference pattern. Some engagements retain an existing landing-zone framework (Azure Landing Zones, AWS Control Tower) and layer B5 sovereign patterns on top. What always changes is that DR runbooks stop being documents and start being rehearsed operational capabilities.
A UAE government entity,
foundation audited.
Representative pattern for a UAE government entity of this scale — first-time sovereign cloud adoption, no landing zone in place, first production workload scheduled to land within the quarter. Ranges reflect target outcomes NexITC underwrites in scope for this class of engagement. N=1 — illustrative composite, not a specific client.
Five artifacts,
each with signed acceptance.
Every deliverable has documented acceptance criteria signed at engagement kickoff. Nothing more, nothing less.
Landing Zone Architecture
Sovereign-region architecture designed to regulatory scope and workload trajectory. Delivered as IaC, not as diagrams.
Identity Patterns
Sovereign-region identity patterns integrated with existing IdP. Access patterns delivered as inherited defaults for workload teams.
Centralised Logging
Logging estate satisfying PDPL, ADHICS v2, and CBUAE audit expectations. Retention aligned to regulatory scope.
FinOps Guardrails
Mandatory tagging at deployment, budget guardrails per environment, weekly cost anomaly report to a named owner.
DR Runbooks & Rehearsal
Disaster recovery runbooks per critical service pattern, walked through end-to-end with the operator team before handover — with the specific failure scenario simulated. The document that survives contact with the actual outage, not the one filed to satisfy the audit clause and never opened.
Six outcome metrics,
measured pre and post.
Success is not "the landing zone is deployed." It is measured against six specific outcomes captured in a baseline report at engagement start and re-measured at post-handover steady state.
Honest scoping.
B5 is a fit when specific conditions are met. It is not a fit when other conditions are. We say so before the scope conversation, not after the commercial commitment.
Either the provider is already committed contractually, or the scorecard runs in Phase 1. B5 does not include provider procurement negotiation.
Signs off architecture, identity patterns, and validation. Typically 30% time commitment through the engagement.
The identity source the landing zone integrates with must be identified — usually the enterprise IdP already in place.
Which frameworks apply to the workloads landing here (PDPL, ADHICS v2, CBUAE, sector-specific). Retention and logging depth follow from this.
The team that will operate the landing zone must be available for the rehearsal window in Phase 4. Rehearsal is the deliverable, not the documentation.
Workload migration is per-workload scope after B5. Sequence B5 first, then migrate; migrating first produces the retrofit problem B5 exists to avoid.
That's B18 Sovereign AI Infrastructure Build™ — GPU clusters inside a named boundary, on-prem or private cloud.
That's C1 OpsCommand™ — sensible as the next engagement after B5, or immediately if a landing zone is already in place.
Without a rehearsal window, DR ships as documentation only. We do not sign to "documented" as though that were the same as "working."
Fixed fee.
Milestone-based.
Total engagement fee agreed in the scope statement. Not time-and-materials. Not day rate. Every engagement is preceded by a scope conversation to ensure fit before commitment.
Five, most asked.
Q_01What does "sovereign" mean in this context, and does it require an on-prem deployment?
No — sovereign in this context means the cloud foundation satisfies UAE data residency and audit obligations that apply to your workloads.
Most B5 engagements deploy into a UAE region of a hyperscaler (AWS, Azure, or GCP) with contractual data-residency guarantees and in-country support.
On-prem or private-cloud sovereign infrastructure is a separate scope covered by B18 Sovereign AI Infrastructure Build™ when AI compute residency is the driver.
Q_02Which cloud provider do you recommend?
Q_03Are DR runbooks actually rehearsed as part of the engagement?
Q_04How do the FinOps guardrails actually work?
Q_05What comes after the landing zone is live?
One name
on the engagement letter.
A named Practice Lead is accountable for delivery, commercial outcomes, and the client relationship throughout the engagement. Not a project manager who disappears after kickoff. Not a partner who nods at the SOW and vanishes.
Practice Lead — Cloud/Edge
Present at every phase gate, every scope decision, every difficult conversation. Available for 30/60/90-day post-handover check-ins as part of the engagement.
Including scope amendments.
Signs off all 5 deliverables.
With executive sponsor.
Authorised to negotiate.
CEO within 24 hours.
30/60/90-day check-ins.
Prior. Peer. Next.
Security Posture Scorecard™
3-week security posture assessment that includes cloud readiness. Useful if the landing zone will host regulated workloads and the current security baseline is unclear.
Sovereign AI Infrastructure Build™
Peer sovereign build when the driver is AI compute residency specifically — GPU clusters inside a named boundary. B5 delivers the general-purpose cloud foundation; B18 addresses the AI-specific case.
OpsCommand™
Managed cloud operations. Runs the landing zone continuously — patching, monitoring, DR rehearsal cadence, cost governance — for organisations that prefer external operators over internal ops teams.
Thirty minutes.
No slide deck.
A structured 30-minute scope conversation with the Practice Lead. You describe the current cloud estate, the first workload, and the regulatory pressure. We describe whether B5 is the right engagement — and if not, what is.