Cloud infrastructure assessment evaluates how target companies leverage cloud services, their operational maturity, and cost efficiency. Cloud spend is often the second-largest technology cost after personnel—and frequently has 20-40% optimization potential that directly impacts EBITDA.
Why Cloud Assessment Matters in M&A
| Assessment Area | M&A Impact | Typical Finding |
|---|
| Cloud Costs | Direct EBITDA impact | 20-40% optimization opportunity |
| Architecture Maturity | Scalability ceiling | Single-region = growth risk |
| Operational Maturity | Team efficiency, incident risk | Manual processes = higher OpEx |
| Vendor Lock-in | Migration costs, flexibility | Proprietary services = switching costs |
| Security Posture | Breach risk, compliance | Misconfiguration common |
Cloud Cost Analysis (FinOps)
Cost Breakdown Structure
Request the last 12 months of cloud bills and analyze:
| Category | Typical % | Optimization Potential |
|---|
| Compute (EC2, VMs) | 40-60% | High - rightsizing, reserved instances |
| Storage (S3, EBS) | 10-20% | Medium - lifecycle policies, tiering |
| Database (RDS, managed DB) | 15-25% | Medium - rightsizing, reserved |
| Data Transfer | 5-15% | High - architecture optimization |
| Other Services | 10-20% | Variable |
Key Cost Metrics
- Cost per Customer: Cloud spend / active customers (track trend)
- Cost as % of Revenue: Healthy SaaS: 10-25% of revenue
- Reserved Instance Coverage: Target: 60-80% of steady-state compute
- Utilization Rates: Average CPU <20% indicates oversizing
- Cost Growth vs Revenue Growth: Should scale sub-linearly
Common Cost Optimization Opportunities
| Opportunity | Typical Savings | Implementation Effort |
|---|
| Reserved Instances / Savings Plans | 30-40% | Low - commitment decisions |
| Rightsizing Instances | 20-30% | Medium - analysis and changes |
| Spot Instances (where applicable) | 60-90% | Medium - architecture changes |
| Storage Tiering | 30-50% | Low - lifecycle policies |
| Idle Resource Cleanup | 5-15% | Low - identification and cleanup |
| Data Transfer Optimization | 10-30% | High - architecture changes |
Cloud Architecture Assessment
Architecture Maturity Levels
| Level | Characteristics | M&A Implication |
|---|
| Level 1: Lift & Shift | VMs in cloud, on-prem patterns | Limited cloud benefits, migration opportunity |
| Level 2: Cloud Optimized | Managed services, auto-scaling | Good foundation, some optimization needed |
| Level 3: Cloud Native | Containers, serverless, event-driven | High operational efficiency |
| Level 4: Platform | Internal platform, self-service | Scale-ready, high team efficiency |
Resilience and Availability
- Multi-AZ Deployment: Are databases and compute spread across availability zones?
- Multi-Region Capability: Is there disaster recovery in a separate region?
- Auto-Scaling: Can the system handle traffic spikes automatically?
- Load Balancing: Proper health checks and failover?
- Backup Strategy: Automated backups with tested restoration?
Vendor Lock-in Assessment
| Service Type | Lock-in Risk | Examples |
|---|
| Compute (VMs) | Low | EC2, Azure VMs, GCE |
| Containers (Kubernetes) | Low-Medium | EKS, AKS, GKE |
| Managed Databases | Medium | RDS, Cloud SQL, Azure SQL |
| Serverless | High | Lambda, Azure Functions |
| Proprietary Services | Very High | DynamoDB, Cosmos DB, Spanner |
| AI/ML Platforms | Very High | SageMaker, Vertex AI |
Operational Maturity Assessment
Infrastructure as Code (IaC)
| Maturity | Characteristics | Risk Level |
|---|
| None | All manual provisioning | High - no repeatability, drift |
| Partial | Some Terraform/CloudFormation | Medium - inconsistent |
| Comprehensive | All infrastructure in code, versioned | Low - auditable, repeatable |
| GitOps | Git as source of truth, auto-reconciliation | Very Low - self-healing |
CI/CD Pipeline Maturity
- Deployment Frequency: Daily is good, weekly is okay, monthly is concerning
- Lead Time: Code commit to production—hours is good, days is okay, weeks is bad
- Change Failure Rate: <15% is good, >25% needs improvement
- Mean Time to Recovery: <1 hour is good, >4 hours is concerning
Monitoring and Observability
The "Three Pillars" to assess:
- Metrics: Are key business and technical metrics tracked? (Datadog, CloudWatch, Prometheus)
- Logs: Centralized logging with search capability? (ELK, Splunk, CloudWatch Logs)
- Traces: Distributed tracing for request flows? (Jaeger, X-Ray, Datadog APM)
Cloud Security Configuration
Common Misconfigurations
| Issue | Risk | Prevalence |
|---|
| Public S3 buckets / storage | Data exposure | Very common |
| Overly permissive IAM | Lateral movement | Very common |
| Unencrypted data at rest | Compliance, breach impact | Common |
| Missing VPC flow logs | Forensics gap | Common |
| No MFA on root/admin | Account compromise | Moderate |
| Default security groups | Excessive access | Very common |
Cloud Red Flags and Costs
| Red Flag | Risk | Remediation Cost |
|---|
| No Infrastructure as Code | Deployment risk, no auditability | $75K - $200K |
| Manual deployments | Human error, slow releases | $50K - $150K |
| Single region, no DR | Business continuity | $100K - $500K |
| Shared root credentials | Security, accountability | $25K - $50K |
| No cost monitoring | Budget overruns | $10K - $25K |
| No auto-scaling | Outages during peaks | $50K - $150K |
| Lift-and-shift only | Inefficient, high costs | $200K - $2M (modernization) |
Cloud Migration Assessment
If post-acquisition cloud migration or consolidation is planned:
| Migration Type | Complexity | Typical Duration | Cost Range |
|---|
| Re-host (lift & shift) | Low | 3-6 months | $100K - $500K |
| Re-platform | Medium | 6-12 months | $300K - $1M |
| Re-architect | High | 12-24 months | $500K - $5M |
| Cloud-to-cloud | High | 12-18 months | $500K - $3M |
Key Takeaway: Cloud costs often have 20-40% optimization potential that flows directly to EBITDA. Beyond cost, assess operational maturity carefully—immature cloud operations create ongoing risk and efficiency drags. Request 12 months of cloud bills and architecture documentation as standard TDD data room items.