# MOVEit Migration Checklist for Regulated File Transfer

Use this checklist to scope one critical MOVEit replacement flow before a wider
platform decision. It is an operational planning aid, not legal advice or a
compliance certification.

## 1. Pick One Flow

- Name the business process.
- Name the internal owner.
- Name every external party.
- List file types, sensitivity, volume, and schedule.
- Confirm whether the flow supports a regulated service, vendor obligation, or
  customer commitment.

## 2. Capture The Current State

- Export the current transfer route, users, service accounts, folders, and jobs.
- Record authentication method, password or key rotation owner, and MFA status.
- Save the latest successful transfer evidence.
- Save the latest failed transfer or retry evidence.
- Identify logs that must be retained after migration.

## 3. Define Access Evidence

- Map every user, group, service account, and partner account to an owner.
- Mark accounts that are stale, shared, or missing MFA.
- Capture approval evidence for privileged access.
- Define the review cadence for partner and emergency access.
- Decide what evidence must be exportable for auditors.

## 4. Define Reliability Evidence

- State the required transfer window.
- Set retry, alerting, and escalation rules.
- Name the person who receives failed-transfer alerts.
- Define manual fallback steps.
- Confirm how the business knows a file arrived complete and on time.

## 5. Define Incident And Recovery Evidence

- Name the incident owner for the flow.
- Define who contacts the partner or customer.
- Capture the evidence needed for timeline reconstruction.
- Confirm recovery point and recovery time expectations.
- Decide how long incident records and transfer logs are retained.

## 6. Define Exit Criteria

- Export all required files, logs, users, partner mappings, and retention rules.
- Confirm the replacement route can be disabled without orphaned dependencies.
- Document rollback conditions for the pilot.
- Name the final decision maker.
- Set the day-25 decision: continue, extend, or stop.

## Pilot Acceptance Criteria

- The flow runs end to end in the pilot route.
- Owner, access, retention, retry, incident, and exit evidence can be exported.
- Stale or unowned access is either removed or assigned.
- The business owner signs off that the flow is usable.
- Security or risk signs off that the evidence is usable for review.

## Next Action

Send one flow name, current MOVEit route, and the owner to
yair@cloudevolvers.com to scope a free xEvolve pilot.