Least-privilege access, audit trails, encryption in transit, retention, and what regulators expect.
Audit trails, least-privilege access, encryption in transit, and credential handling — the paper trail auditors and regulators actually ask for after a migration.