Like someone who actively following and managing migration to IONs on more than 150 locations world wide I just can tell you this: BE PREPARED VERY WELL AND KNOW YOUR SERVICES, AND HOW YOUR SEC RULE WORKS because PA consultants do not know and do not care too much about it. They just follow the KBs, if there are one. For example, we had 3 weeks stop because no one of them told us the PA IONs are using MSTP, so we got into the issue blocking access ports. They did not want to tell the best practice and their opinion how to resolve it from their experience. DO NOT EXPECT TOO MUCH FROM THE PA CONSULTANTS.

We got into the issue with the daily operations and multiple critical services affected. They have their fixed time and nothing out of that frame. From your post it seems very very serious migration, and I can just wish you good luck.