Operational checklists

Can you produce evidence for a sampled control today, without a fire drill? Run this a quarter before the audit, not a week before.

The four things that separate an experiment from a self-inflicted outage: a written hypothesis, a bounded blast radius, a tested abort, and responders who know it is happening.

The controls that must be true for every cloud account before workloads land in it — identity, logging, network exposure, and drift.

Move workloads to the cloud without surprises: scope, cost, security, egress, and an exit story.

Before a pipeline becomes something other teams depend on: ownership, freshness expectations, quality gates, and a known answer for when it breaks.

Run one access or deletion request end to end and find out whether you can actually meet the deadline — before a regulator sets it for you.

Change production data shape without downtime: expand, migrate, contract — and rehearse the backup restore.

The unglamorous controls that prevent most host-level incidents: inventory, patch cadence with measured lag, a declarative baseline, and a restore someone has actually performed.

From alert to resolution: assign command, communicate early, decide severity honestly, learn without blame.

Before trusting a definition to represent your estate: state stored safely, plans reviewed before apply, drift detected, ownership tagged, and one environment actually rebuilt from code.

Before a workload takes production traffic: resources, probes, limits, and failure behavior all decided.

Before a feature built on someone else's model reaches users: version pinning, an evaluation set, cost and latency limits, guardrails, a tested fallback, and a clear account of what leaves your boundary.

Ship an LLM feature to production with known failure modes: evals, grounding, cost caps, privacy, and human fallback.

Verifying that someone who left actually lost access everywhere — the completion check behind the most common finding in any access review.

The recurring pass that keeps certified metrics trustworthy: definitions still match the business, owners still exist, and the certified set stays small enough to mean something.

Extract or launch a service without distributed-monolith regret: contracts, observability, failure modes, ownership.

Before a model influences a real decision: reproducible training, consistent features, an evaluation gate, drift monitoring, and a rollback someone has actually performed.

The gate a consequential model passes before an organisation relies on it: tiering, independent testing against written criteria, recorded approval, and an expiry date.

Before a change to routing, filtering or topology: a tested back-out, an answer for losing your own access, a defined blast radius, and someone watching the paths rather than the devices.

Ship a change to production safely: verify, deploy, watch, and know how to get out.

The review a prompt change passes before it reaches users — because editing one word changes behaviour for everyone, and no compiler objects.

Before a change reaches users: the gates passed, the exposure is controllable, the people who need to know have been told, and the way back is known and timed.

Before a grounded system answers from your content: measured retrieval quality, versioned embeddings, permissions enforced in the query path, corpus freshness, and citations that hold up.

A quarterly review that keeps the risk register a decision tool rather than a document — owners, treatments, acceptance, and honest closure.

Before you trust your detection pipeline: can a human take an alert from arrival to a decision, with the context and the authority to act?

The control review that catches what pentests find later: authz, secrets, dependencies, data, and audit trails.

Review an infrastructure change the way infrastructure breaks: plan first, state safe, blast radius known.