Project Preparation
Conduct project kick-off meeting
Technical workshop to gather Azure infrastructure requirements (Azure adoption plan, migration plan) from business units and other stakeholders (e.g. operation risk, information risk, compliance, IT)
Finalize project timeline, tasks and R&R
Azure Environments design (e.g. Dev/Test/Prod)
Formulate an end to end, complete, scalable, extensible system design to support requirement (function/non-functional) gathered
Identity and access management design and implementation
Define up to 3 RBAC roles for Azure subscriptions cloud operation and mangement using built-in Azure roles

Network topology and connectivity design and implementation
Datacenter connectivity requirement discovery
Define hub-and-spoke network architecture design (VNETs, subnets, CIDR, network security groups, route tables)
Setup DNS and name resolutions for Azure resources (Azure Private DNS zone)
Setup S2S VPN connectivity through Azure Virtual Network Gateway (if applicable)
Setup Jumphost or Bastion services for secure remote access to Azure environment
Setup Azure firewall
Setup IP whitelisting for end users
Ensure that all data-in-transit are encrypted for Azure connectivity
Setup Azure Key Vaults for DAP
Setup certificate renewal alerts and auto-rotation
Resource organization and implementation
Define resource groups, naming conventions, tagging conventions
Define resource locations and zones for Azure workload deployment
Core system infrastructure design and implementation on Azure
Define and implement infrastructure-level data architecture (e.g. specifying all physical storages, data flow within, into & out of the System)
Set up and configure common cloud infrastructure components (e.g. landing zone, SMTP gateway, API gateway, etc.)

Infrastructure-as-Code (IaC) enablement and DevOps enablement
DevOps Enablement
Creation of Azure DevOps organization
Creation of Git repositories for storing IaC scripts, Python notebooks for Databricks, schedule jobs, other custom developed scripts for DAP
IaC Enablement
Conversion of infrastructure design to Terraform IaC scripts cover all Azure infrastructure (landing zone and DAP workloads)
Testing and fine-tuning of Terraform IaC scripts
Deployment of Terraform IaC scripts to PROD environment

Setup Azure Infastructure Security baseline
Enable Defender for Cloud
Enable Azure Security Center default policy
Data Security
Ensure that all data-at-rest and data-in-transit are encrypted
Complete security assessment with Customer
Security scanning through Azure Security Center and Azure Advisor
Remediation of Azure Security Center critical findings and Customer-provided security tools critical findings
Compliance Review
Compliance check according to the Customer’s internal IT guidelines
Compliance check with external guidelines such as PDPO, guidelines issued by Insurance Authority

Azure infrastructure governance baseline
Enable Azure Advisor
Define and enable up to 5 Azure policies
Provide Azure well-architected assessment tool output and Azure Advisor output
Setup up to 10 Azure email alerts for Azure system issues

Operational Handover
8 hours knowledge transfer over Teams
for Business Unit representatives
for IT infrastructure / application / operation team

Documentation
Functional Requirement Document
Design Document / Architecture Document / Network Diagram
Setup and Configuration Document / Technical Specifications
System Test Plan
User Guide / Manual
Azure Admin and Operational Manual
Included: Project Management
Define and execute the project delivery methodology (Waterfall/Agile)
Ensure project schedule and deliverable quality

Assumptions
HKMC will handle all Azure AD related operations, including user account creation, service principal creation, Azure AD roles assignment, Privileged Access Management, MFA setup, enterprise applications enrollment
Creation of Python notebook contents for Databricks, scheduled jobs, custom scripts not related to infrastructure-as-code deployment is out of HD scope.
Areas of management and operational excellence are out of scope at this project stage
The business continuity plan and DR plan are out of scope at this project stage
User Manual, System Implementation Procedure and Training Manual will be combined as Azure Admin and Operational Manual
All documentation in form of softcopy in Microsoft Office format with optional video format, and in English