Written by the people doing the work, mostly after an engagement taught us something we had assumed. No gated downloads and no lead-capture form in front of any of it.
Almost every self-assessment we re-score comes back lower, and it is nearly always the same three mitigations. Not because anybody lied — because “we patch monthly” and “we patch monthly, including the four systems the vendor will not let us touch” are different sentences, and only one of them is what the model is asking.
Mail and files are the easy 80%. The estimate breaks on the line-of-business application nobody mentioned because the person who owns it does not think of it as IT.
It moves the risk to the supplier, which sounds like your problem solved. What it actually buys you is a supplier with a financial reason to argue about scope for the rest of the project.
If every month is green, the report is decorative. A useful one shows the misses, the trend behind them, and what the provider is doing that you are not being charged for.
The firewall design is the fast part. Working out which devices are load-bearing when half of them are not in any register is where the nine months actually go.
Including the three that make a bad one uncomfortable: who owns the documentation, what does the exit clause say, and can I see last month's SLA report rather than a sample one.
Everyone practises the migration. Almost nobody practises going back, which is the plan you need under the exact conditions where thinking clearly is hardest.
Ask it directly. We would rather spend twenty minutes answering something specific than publish another general guide nobody needed.