Switzerland's cloud moment: is your business ready?

Swiss cloud adoption arrived later than in neighbouring markets and has arrived properly. The question for most Swiss companies is no longer whether, but whether they are ready — which is a different assessment.

This is a readiness check rather than a migration guide. The mechanics sit in cloud migration roadmap: a decision framework.

What changed

Three developments removed the objections that held Swiss adoption back.

Swiss regions exist. The major providers now operate in Switzerland, which removes the simplest version of the residency objection — though not the access question underneath it, which is the one that matters.

The regulatory position clarified. revDSG has been in force since September 2023, and FINMA’s expectations on outsourcing are documented rather than inferred. A clear rule is easier to comply with than an unclear one, even when it is strict.

The hardware argument expired. A large share of Swiss mid-market estates installed around 2019–2020 are reaching refresh. That date forces a decision that could previously be deferred indefinitely.

That last point is worth dwelling on: the refresh date is the natural decision point, and migrating a stable workload well ahead of it usually means paying for both.

Are you ready? Six questions

1. Do you know what you have?

Not a list of servers — a list of workloads with usage patterns, dependencies and data sensitivity. Most organisations discover during this exercise that several systems have no users at all.

If you cannot produce this, that is the first project, and it takes weeks rather than months.

2. Do you know what it costs today?

Fully loaded: hardware depreciation, housing, power, licences, and the operations hours it consumes. Without this number no later claim about savings can be evaluated, and it cannot be reconstructed after the fact.

3. Have you classified your data?

Not all data carries the same constraint. Treating it as one block forces the most restrictive answer onto everything and rules out options unnecessarily.

The classification needs to distinguish personal data under revDSG/nDSG, EU personal data under GDPR, anything under FINMA outsourcing rules, and everything else — which is usually the majority.

4. Can you answer the access question?

Where data is stored is the easy half. Who can reach it — including support staff in other jurisdictions and sub-processors two layers down — is the half that gets audited.

If your provider’s answer is a region setting, you do not have an answer yet.

5. Do you have an exit path?

For FINMA-supervised businesses this is a requirement, not a precaution: a documented, demonstrable way to end the outsourcing. For everyone else it is the difference between a supplier relationship and a dependency.

6. Does your team have the skills, and if not, what is the plan?

Cloud needs identity, network architecture and infrastructure-as-code depth. Assuming a team carries these because it ran servers well is a common and expensive assumption. The realistic answer is usually a mix — internal people who know your business, external capacity that has done this several times.

Where hybrid and edge fit

Hybrid is frequently the correct end state for Swiss companies rather than a transitional stage, because the constraints genuinely differ across an estate: regulated data stays in Switzerland, variable-load workloads go to the cloud, non-production goes to the cloud without argument, and stable workloads on un-depreciated hardware stay until the refresh date decides. The reasoning is developed in why the DACH market prefers evolution over revolution.

Edge matters for a narrower set: manufacturing with latency-sensitive control systems, and anything where connectivity cannot be assumed. It is not a general requirement, and treating it as one adds operational burden for no return.

What readiness actually looks like

A Swiss company genuinely ready to migrate has, before anything moves:

• A workload inventory with a disposition each, including what will be retired
• A fully-loaded current cost figure
• A data classification with the regulatory constraint named per class
• Written answers on residency, access, sub-processors and exit
• A landing-zone design including cost attribution from day one
• A first wave small enough to prove the process, with the rollback tested

Six items. None requires a platform decision, and all of them are harder to produce after the migration than before.

The honest counter-case

Not every workload should move, and the cases where staying is correct are real: steady load on hardware with life left, a system constrained to stay by regulation or contract, and anything whose replacement is already scheduled.

A readiness assessment that concludes “migrate three of these eleven workloads this year” is a better outcome than one that concludes “migrate everything”, and it is more often the right answer.

Related reading

• Cloud vs on-premises: what makes sense for SMEs
• Swiss cloud adoption: five lessons on getting to real ROI
• Cloud & DevOps

If you want the readiness check run against your own estate, book a call. No obligation.