- Security should be boring, predictable, measurable.
- Controls as Code is the default for enforceable standards.
- Least privilege is enforced with just-in-time access.
- Central logging is required for all critical workloads.
- Hybrid parity: on-prem/hybrid receives equivalent baseline coverage.
- Evidence by design: build audit artifacts into processes.
- Segregation of duties for critical change and approval paths.
- Centralized policy assignments at management group level.
- Logging pipelines are standardized and monitored for gaps.
- Landing zones include baseline networking, identity, and monitoring.
- Exceptions are documented, time-bound, and reviewed.
- Reference architecture:
04-reference-architecture.md - Operating model:
05-operating-model.md