A migration is only frightening when it happens in production. The order below exists so that every risky step is taken on a copy first, and the live site spends most of the window serving pages.
Before anything is touched
Take a full backup of files and database and confirm it restores somewhere else; an untested backup is a rumour. Inventory what is custom: modules with no maintained branch, theme code written against a retired API, content entities whose fields no longer map. That inventory, not the version number, decides the size of the job.
On the copy
Run the database updates, then re-run them; a second pass that changes nothing means the schema settled. Export configuration, deploy it, and read the watchdog log with the filters off, because the failures that matter are usually warnings nobody looked at. Test the editor paths, not only the visitor paths: forms, file uploads, moderation and anything a person does five minutes a week.
The live window
Put the site in maintenance mode, deploy, run the updates, flush caches, smoke-test the three pages that carry revenue, then lift maintenance. The whole event should be minutes. If it needs hours, the rehearsal was not the same build.