Landing zones that pass the audit first time
The twelve controls we put in place before the first workload moves.
A landing zone is the part of your cloud you never want to rebuild. We treat it as a product with its own backlog, owner and tests.
The twelve controls
Identity federation, break-glass accounts, organisation policies, network segmentation, central logging, key management, backup policy, tagging, budget alerts, vulnerability scanning, configuration drift detection, and a documented exception process.
Evidence as a by-product
Every control is written as code, and every change produces evidence your auditor can pull without asking an engineer.