roqy.io / learn

DevOps Readiness Audit: What to Check Before Your First DevOps Hire

Most startups hire a DevOps engineer after the first bad outage. The smarter move is cheaper: run a readiness audit first, fix the cheap things yourself, and hand the new hire a prioritized list instead of a mystery. This is the exact audit we run, adapted from the methodology Cloudflare open-sourced for code security.

The 9 areas, in the order they bite

  1. IAM and access: who can do what, and are there long-lived keys?
  2. Terraform state and drift: does the code still match reality?
  3. Secrets: in code, in git history, in CI variables?
  4. CI/CD gates: can a compromised action ship to prod with no review?
  5. Monitoring: if prod dies at 3am, does a human find out?
  6. Backups and DR: do they exist, and has anyone ever restored one?
  7. Cost guardrails: is there a budget alert?
  8. Review gaps on large or AI-assisted PRs?
  9. Visibility into production changes: can you tell what changed and who?

What a real audit found (our own stack)

We ran this audit on our own infrastructure before selling it. Five confirmed findings, two of them the kind that hurt:

F1 · Secrets: Plaintext database passwords committed to git

Anyone with repo access gets live credentials. We found this in our own repo while testing the audit.

Fix: Move to env interpolation, rotate, 1-2h

F2 · Deploy gates: Push to main auto-deploys to production with no review

One bad push takes prod down. No approval step, no undo.

Fix: Branch protection + required CI, 30min

F3 · CI/CD: Third-party GitHub Actions not pinned to a commit SHA

A compromised upstream action runs with your repo token.

Fix: Pin to SHA, least privilege, 1h

F4 · Backups: Backups run on a schedule but were never restore-tested

A backup you cannot restore is not a backup. This is the one that ends companies.

Fix: Quarterly restore drill, 2h

F5 · Monitoring: Auto-restart script exists, but nobody is alerted when prod is down

The site can be down for hours while the restart loop silently fails.

Fix: External uptime monitor, 30min

Total fix time for everything above: under a day. None of it required a DevOps hire. That is the point of the audit.

The rule that makes it work

Every finding needs evidence and a concrete consequence. A missing best practice with no failure story is a note, not a finding. And every finding gets a second pass that tries to disprove it, because half of what looks broken is handled somewhere you did not look: org settings, another repo, a SaaS tool.

Get the full checklist

The complete 9-area checklist with the exact read-only commands for AWS, GCP, Docker and GitHub Actions. One email, no sequence, unsubscribe anytime.

Want us to run the audit on your stack instead? That is the first thing we do at roqy.io.