DevOps & DevSecOps Infrastructure Readiness Checklist

Does every service build, test and deploy through an automated pipeline?

Is the same artifact promoted from staging to production, rather than rebuilt?

Can you deploy to production without manual steps on a server?

Is there a documented, tested rollback procedure?

Are pipeline definitions shared or templated across services?

Do you know your deployment frequency and change failure rate?

Is all production infrastructure defined as code (Terraform, Pulumi, CloudFormation, Bicep)?

Are infrastructure changes reviewed and applied through a pipeline, not from laptops?

Is Terraform (or equivalent) state stored remotely with locking and restricted access?

Could you rebuild a non-production environment from code in a day or less?

Do you detect configuration drift between code and reality?

Do pull requests run SAST and dependency (SCA) scanning?

Are container images and IaC scanned before deployment?

Is there an agreed severity policy that defines what blocks a release?

Are secrets stored in a managed secret store and never committed to Git?

Does CI use short-lived credentials (e.g. OIDC) instead of long-lived cloud keys?

Is access to production based on least privilege and reviewed regularly?

Is someone accountable for remediating each class of finding?

Are logs from all services and infrastructure centralized and searchable?

Do you collect latency, traffic, error and saturation metrics per service?

Does every alert have an owner, a severity and a runbook?

Do you usually learn about incidents from monitoring rather than customers?

Can you correlate a spike in errors with a recent deployment?

Have you defined service-level objectives for your most important user journeys?

Are backups restored and tested on a schedule?

Is there a documented incident response process with clear roles?

Do you run blameless post-incident reviews with tracked follow-ups?

Have you tested how the system behaves when a zone or node fails?

Are cloud resources consistently tagged with owner, service and environment?

Can each team see the cost of the services they own?

Are budget alerts configured for unexpected spend?

Do you review idle or oversized resources on a regular cadence?

Are log, snapshot and backup retention policies defined deliberately?