Most SME directors don’t wake up wanting to discuss infrastructure. The question of whether to move to the cloud usually lands on the desk because something has forced it — a quote for a server refresh, an auditor’s finding, or a buyer asking awkward questions. This piece is a framework for working out when to move to the cloud: a four-trigger checklist, a five-year worked example, and how to read the numbers without vendor spin.
Four Trigger Events Usually Force the Cloud Decision
For UK SMEs between 20 and 200 staff, four triggers usually drive the cloud migration conversation.
Hardware end-of-life. A typical server refresh for a small business sits somewhere between £15,000 and £40,000 once you factor in the box itself, Windows Server and CAL licences, the UPS, switches, and the engineer time to commission it. Signing that purchase order resets the depreciation clock for another five to seven years and locks you into the same operating model. If you’re already mid-discussion with finance about a refresh, you’ve effectively been handed a free reason to evaluate the alternative.
Audit findings and compliance pressure. Cyber Essentials Plus, ISO 27001, the NHS Data Security and Protection Toolkit, and FCA expectations for regulated firms increasingly assume a level of patch hygiene, access control, and logging that is achievable on-prem but exhausting to evidence. Auditors are flagging the same on-prem gaps repeatedly: unsupported operating systems, weak admin separation, inconsistent backup verification. If you’ve just had findings against any of these, that’s a trigger.
M&A activity. Buyers do technical due diligence now. An acquirer’s IT team will spot the £18,000 of accrued infrastructure debt within a fortnight, and it will either knock value off the deal or appear as a remediation clause. Sellers who’ve already moved tend to find the conversation cleaner.
New compliance regime. UK GDPR enforcement has matured, and NIS2 obligations are expanding the scope of who’s expected to have proper incident reporting and supply chain controls in place. The cost of staying put quietly rises every time the regulator publishes new guidance.
The Five-Year Financial Picture Usually Favours Cloud for SMEs
Sticker price comparisons are where most cloud business cases go wrong. Someone takes the monthly Azure or AWS estimate, multiplies by 60 months, and concludes cloud is more expensive than the on-prem quote sitting next to it. That comparison is meaningless because it ignores everything else on-prem actually costs.
A fair on-prem total cost of ownership includes the hardware, the Windows Server and CAL licences, the UPS and rack, power and cooling (now a non-trivial line at £0.25/kWh), the proportion of your IT generalist’s time spent patching and babysitting backups, the backup software and offsite target, the air-conditioning service contract, and the cost of the floor space the kit sits on. Most finance directors’ spreadsheets capture roughly half of that.
The shift from CapEx to OpEx matters for SME cash flow in a way that’s often underweighted. Instead of going to the board every five years for a £25,000 capital approval, you have a predictable monthly cost that scales with headcount. For businesses that are growing, contracting, or seasonal, that flexibility is worth real money.
There are workloads where cloud is genuinely more expensive. High-compute scientific applications, video rendering pipelines, and data-heavy workloads with constant egress traffic can run the bill up quickly once you’re outside the reserved instance sweet spot. If your workload is steady-state, 24/7, and CPU-bound, do the maths carefully — the answer isn’t automatic.
Worked Example: A 30-Seat SME, On-Prem vs Azure Over Five Years
The numbers below are illustrative. They’re built on assumptions that won’t match your business exactly, but the structure transfers.
Assumptions: 30 staff, two physical servers (one application, one file/print/DC), Windows Server 2022, 1TB usable storage, 30 Microsoft 365 Business Premium seats (in both scenarios, so neutral), one IT generalist allocating roughly 20% of their time to infrastructure, and on-site or co-lo power at £0.25/kWh.
On-prem, five years: – Hardware refresh (servers, switches, NAS): £22,000 – Windows Server OS and CAL licences: £6,500 – UPS, rack, ancillary infrastructure: £3,200 – Power and cooling: £7,500 – IT staff time (20% allocation of a fully-loaded £42k IT generalist, over five years): £42,000 – Backup solution and offsite target: £2,400 – Five-year total: circa £83,600
Azure equivalent, five years: – Azure IaaS and PaaS compute and storage (rightsized): £14,400 – Azure Backup: £1,800 – Migration project, one-off: £8,500 – Ongoing managed service or governance support: £12,000 – Five-year total: circa £36,700
That’s a gap of roughly £45,000 over five years, and break-even on the migration spend typically arrives inside the first year for SMEs in this size bracket. The gap widens if you factor in the productivity gains (next section) or narrow if your workload turns out to need refactoring rather than lift-and-shift. Treat these figures as a template to fill in with your own numbers, not a quote.
Cloud Is Usually More Secure Than On-Prem — When You Configure It Right
The honest answer is: usually yes for SMEs, sometimes no for specific edge cases, and never automatically.
The shared responsibility model is the bit most people skip past. Microsoft and AWS secure the underlying platform — the hypervisors, the data centres, the network fabric, the physical security. You remain responsible for identity, access control, data classification, and how your applications are configured. A misconfigured Azure storage account exposed to the public internet is your problem, not Microsoft’s.
Where on-prem still wins: genuinely air-gapped environments, certain government and defence workloads, and scenarios where data sovereignty rules are stricter than what the public cloud’s UK regions can evidence. These are real but rare in mainstream SME work.
Where cloud wins for most SMEs: patch cadence is enforced rather than aspirational, threat intelligence is operating at hyperscaler scale (Microsoft sees signals from billions of endpoints), MFA can be enforced by conditional access rather than hoped for, and geo-redundant backup is a checkbox rather than a project. Compared to a small business running an unpatched Windows Server 2016 in a cupboard with backups that nobody has tested in eighteen months, cloud is a step change.
The risk that actually gets SMEs breached isn’t the platform — it’s misconfiguration, weak admin accounts, and phishing. Those happen on both sides of the fence. Competent setup matters more than the venue.
Cloud Migration Returns IT Staff Time From Maintenance to Projects
The productivity case is the one that’s most often underweighted in business cases because it’s harder to quantify. It’s also the one staff feel most.
Hybrid and remote work stops being an exception you’ve bolted on with a VPN. Files live where they need to, accessible from any managed device, without the split-tunnel headaches and dropped connections that come from routing everything through an on-prem firewall.
Teams, SharePoint, and co-authoring work properly when everyone is on the same tenant rather than wrestling with mapped drives, locked files, and the eternal pattern of emailing “FINAL_v7_actually_final.docx” around the business. Document collaboration is one of those things that sounds trivial until you’ve experienced both modes.
Your IT person — or your managed service partner — stops spending Friday afternoons watching backup jobs and Tuesday mornings applying patches. That time redirects to projects that matter to the business: integrations, reporting, automation, the things you actually hired them for.
Onboarding a new starter goes from “we’ve ordered the laptop, it’ll be here next week, and we’ll get them set up the Monday after” to provisioning an account and posting a device the same day. Offboarding gets cleaner too, which matters for compliance.
When to Move to the Cloud: Five Questions Decide It
Run your business through these five tests. They take an afternoon, not a fortnight.
Hardware age. If your primary server is over four years old, the refresh-versus-migrate decision is live whether you’ve acknowledged it or not. Pretending otherwise just means you’ll make it under time pressure later.
Compliance exposure. List every regulatory obligation you carry — Cyber Essentials, ISO 27001, FCA handbook references, NHS DSP Toolkit, sector-specific contractual requirements from clients. For each one, ask: could we evidence compliance to an auditor walking in tomorrow? If the answer is “probably, with some scrambling,” that’s a problem answer.
Workload suitability. Categorise your applications into three buckets: lift-and-shift ready (most file shares, AD, common line-of-business apps), refactor-required (older databases, custom-built tools), and stay on-prem (genuinely incompatible legacy systems, specialist hardware integrations). Almost every SME has at least one application in the second or third bucket that needs proper assessment before you commit to a date.
Internal capability. Do you have someone in-house who can run cloud governance — cost management, identity, conditional access, backup verification — after the migration consultants leave? If not, you need a managed service partner, and that cost belongs in the TCO from day one, not as a surprise in month four.
Trajectory. Is the business growing, contracting, or being prepared for sale in the next three years? Each of those changes the answer. Growth favours cloud’s elasticity. A sale favours having clean, documented infrastructure that due diligence won’t snag on.
If three or more of these tests return a problem answer, the strategic question isn’t whether to move to the cloud. It’s when, in what order, and with which partner. The longer that question sits unanswered, the more it tends to be decided for you by a failing server or an awkward audit.