# DevOps & DevSecOps Infrastructure Readiness Checklist

Answer each question honestly with yes, partly or no. Areas with several “no” answers are usually the best place to start.

## CI/CD

- [ ] Does every service build, test and deploy through an automated pipeline?
- [ ] Is the same artifact promoted from staging to production, rather than rebuilt?
- [ ] Can you deploy to production without manual steps on a server?
- [ ] Is there a documented, tested rollback procedure?
- [ ] Are pipeline definitions shared or templated across services?
- [ ] Do you know your deployment frequency and change failure rate?

## Infrastructure

- [ ] Is all production infrastructure defined as code (Terraform, Pulumi, CloudFormation, Bicep)?
- [ ] Are infrastructure changes reviewed and applied through a pipeline, not from laptops?
- [ ] Is Terraform (or equivalent) state stored remotely with locking and restricted access?
- [ ] Could you rebuild a non-production environment from code in a day or less?
- [ ] Do you detect configuration drift between code and reality?

## Security

- [ ] Do pull requests run SAST and dependency (SCA) scanning?
- [ ] Are container images and IaC scanned before deployment?
- [ ] Is there an agreed severity policy that defines what blocks a release?
- [ ] Are secrets stored in a managed secret store and never committed to Git?
- [ ] Does CI use short-lived credentials (e.g. OIDC) instead of long-lived cloud keys?
- [ ] Is access to production based on least privilege and reviewed regularly?
- [ ] Is someone accountable for remediating each class of finding?

## Observability

- [ ] Are logs from all services and infrastructure centralized and searchable?
- [ ] Do you collect latency, traffic, error and saturation metrics per service?
- [ ] Does every alert have an owner, a severity and a runbook?
- [ ] Do you usually learn about incidents from monitoring rather than customers?
- [ ] Can you correlate a spike in errors with a recent deployment?

## Reliability

- [ ] Have you defined service-level objectives for your most important user journeys?
- [ ] Are backups restored and tested on a schedule?
- [ ] Is there a documented incident response process with clear roles?
- [ ] Do you run blameless post-incident reviews with tracked follow-ups?
- [ ] Have you tested how the system behaves when a zone or node fails?

## Cost visibility

- [ ] Are cloud resources consistently tagged with owner, service and environment?
- [ ] Can each team see the cost of the services they own?
- [ ] Are budget alerts configured for unexpected spend?
- [ ] Do you review idle or oversized resources on a regular cadence?
- [ ] Are log, snapshot and backup retention policies defined deliberately?

---

This checklist is a starting point for discussion, not a formal audit or compliance assessment.