A landing zone is not a Control Tower checkbox.

The management account is a blast-radius problem. A landing zone that’s a Control Tower tick doesn’t change who can take production down. Retrofit is the work — existing accounts, existing politics, no flag day if you can help it.

For a platform already in motion, not a greenfield “best practice” deck. Not an AWS Marketplace landing-zone product. Not a two-week workshop that hands you a slide.

This is planned work. If production is down tonight, that’sproduction recovery.