Delivery is the beginning, not the end

Before we take responsibility for an environment we establish what is actually running, what it costs, how it is protected and where the undocumented dependencies sit. The output is a transition plan with a written acceptance point.

• Inventory including the undocumented. Subscriptions or accounts, workloads, data pipelines, integrations and third-party dependencies, including the ones nobody has written down.
• Coverage verified, not assumed. Current monitoring, alerting and backup configuration reviewed to record which workloads are genuinely covered and which only appear to be.
• Access tested before transition. Administrative and break-glass access, credential ownership and licence entitlements proven now, so none of it is discovered during an incident.
• Cost and posture baselined. Spend baselined by application and environment, and posture baselined against the control set you align to, so later reporting has a starting point.
• Scope agreed in writing. Coverage hours, contact channels, escalation path, what is in scope, what is explicitly out of scope and who decides, all recorded in the service description.
• Remediation list before acceptance. A prioritised list for anything unsafe to operate as found, separating what we fix during transition from what becomes funded project work.

A service is only as good as the signals it runs on. We design the monitoring, automation and reporting that make an environment operable, then hold that configuration in code so it survives staff changes.

• Indicators taken from the business process. Service-level indicators defined per workload from what the process depends on, such as nightly load completion, integration success rate or order submission availability.
• Retention decided per source. Metric, log and trace collection configured with retention and sampling chosen source by source, so observability cost is a decision rather than an accident.
• Owned alerts with linked runbooks. Alert rules carry a severity, a named owner and a linked runbook, and the alerts nobody has ever acted on are removed rather than muted.
• Repetitive work automated in code. Patch cycles, certificate renewal, scaling schedules and non-production shutdown automated, with the automation held in version control you own.
• Guardrails expressed as policy. Environment standards written as policy so configuration drift is detected and, where it is safe to do so, corrected automatically.
• Reporting generated, not assembled. The reporting pack built once from platform data, so monthly reporting is produced automatically rather than by hand the week it is due.

Security work does not stop at go-live and neither does exposure. Posture, identity and data protection stay under review on an agreed cycle, and you receive evidence of the state of each.

• Findings triaged by exploitability. Posture findings ranked on a set cadence by exploitability and business impact, with every one tracked to closed, accepted with an owner, or scheduled.
• Access reviews on a set cycle. Privileged roles, service identities, guest accounts and dormant users reviewed periodically, with standing access removed where it is no longer justified.
• Secrets tracked by age and expiry. Secrets, keys and certificates monitored for age and expiry, then rotated on a schedule agreed with each application owner instead of at the point of outage.
• Patch status visible per workload. Vulnerability and patch state reported workload by workload, with every exception recorded against a named owner and a review date.
• One destination for security signals. Detections routed into a single place so an investigation starts with context, following escalation steps agreed before an incident rather than during one.
• Evidence, never certification. We produce operational evidence supporting your alignment to frameworks such as the Essential Eight or ISO 27001; we hold no certification and perform no audit.

A managed service that only functions while we are in the room has failed. Knowledge transfer is deliberate, and your team stays able to operate the environment without us.

• Service commencement run jointly. A session with your team covering what we watch, what we change, what we escalate and what still needs a decision from you.
• Runbooks kept in your tenancy. Documentation and automation live in your tenancy or repository rather than ours, updated as part of each change instead of once a year.
• A service review with both audiences. A scheduled review with the technical owner and the business sponsor covering incidents, changes, cost, posture and the improvement backlog.
• Your staff coached on the tooling. Your internal engineers taught the tools we use, so routine questions can be answered by your team without raising a ticket with us.
• A report a sponsor can read. A plain-language monthly report that needs no translation, including what we recommend next and what we need from you to do it.
• Exit path documented from day one. The handback path kept current so you can bring the service in-house or move it elsewhere without an archaeology exercise.

This is the work that happens every month once transition is complete. Scope, coverage hours, escalation and reporting cadence are agreed per engagement and recorded in your service description.

• Health monitored against agreed indicators. Platform, application, pipeline and AI workload health watched against the indicators set at design, with alerts acted on under the arrangements in your service description.
• Incidents coordinated end to end. Vendor escalation, communication to your stakeholders and a written review for anything significant, so the same fault does not recur unexamined.
• Changes through your process. Patches, minor upgrades and configuration changes applied inside your change process, with rollback tested where the change warrants it.
• Restore tests on the agreed schedule. Restore and resilience checks run on the cycle you set, with the result recorded including anything the test failed to prove.
• Cost and commitments reviewed monthly. Spend, licence use and commitment coverage examined each month, with costed optimisation recommendations brought for your approval.
• Improvement backlog worked down. A visible backlog ranked by business value, with part of every service cycle spent reducing it rather than only responding to alerts.