Case studies and field notes
Two client engagements, described as they were built, and the architecture guidance behind our tiers: governance, compliance frameworks, idle cost, and private networking on Azure.
Client engagements
Client names stay private. The architecture is described as it was built.
-
Securing Payment Processing on Azure with No Public Endpoints
How a payments company moved its Kubernetes workloads on Azure to a private control plane with no public endpoints ahead of its PCI-DSS 4.0 assessment.
Reference callavailable on request -
Governing Patient Data Across a Private Databricks Lakehouse and Palantir Foundry
How a healthcare provider network governed protected health information across a private Azure Databricks lakehouse and Palantir Foundry under HIPAA.
Reference callavailable on request
Field notes
Short, problem-first notes on the compliance, governance, and cost decisions that come up on every engagement.
-
SOC 2 Type II on Azure: Enforcing the Infrastructure Controls Auditors Test
Which Azure infrastructure controls SOC 2 Type II auditors test, how to enforce them with Azure Policy, and how to stage Audit and Deny modes without breaking production.
-
Selling Software in Europe: Preparing Azure for an ISO 27001:2022 Audit
Why European enterprise buyers often ask for ISO/IEC 27001 certification rather than a SOC 2 report, what a certification auditor looks for in an Azure environment, and how Annex A controls can be mapped to Azure Policy.
-
PCI-DSS 4.0 on Azure: Isolating the Payment Enclave to Keep Assessment Scope Small
How to segment a cardholder data environment (CDE) on Azure with a dedicated management group, Private Link, Key Vault Managed HSM, and deny-mode policies so connected systems stay out of PCI-DSS 4.0 scope.
-
Preparing Azure for a Hospital Security Review: HIPAA Controls for ePHI
What a hospital security team typically checks before signing a Business Associate Agreement, and how private endpoints, customer-managed keys, enforced TLS, audit logging and Azure Policy address the HIPAA Security Rule's technical safeguards on Azure.
-
The Cloud Diligence Checklist: What Investors Check in Your Azure Tenant
What investor technical due diligence teams look for in an Azure tenant, and how to fix standing access, flat networks, missing encryption, absent guardrails, and unmanaged spend before the review.
-
The Idle Cost of an Azure Landing Zone: Governance First, Connectivity Later
Why a connectivity-first Azure landing zone bills by the hour before any workload runs, which governance controls carry no Azure charge, and how to sequence a landing zone so network appliances arrive when traffic does.
-
Azure Subscription Vending: Replacing the Shared Owner Subscription
Why one shared Azure subscription with standing Owner rights becomes a risk as a team grows, and how an automated subscription vending pipeline places new subscriptions under management groups, policy, scoped RBAC and budgets.
-
Passing Enterprise Vendor Diligence: What CISOs Look For in Your Azure Hierarchy
Why a flat Azure tenant slows enterprise security reviews, and what buyers' security teams check in your management group structure, RBAC scoping, policy guardrails and architecture documentation.
-
Why Azure Migrations Stall, and Why the Foundation Comes First
Why enterprise Azure migrations stall on governance sprawl, unmanaged networking, and compliance blockers, and how putting a landing zone foundation in place first removes those blockers before workloads move.
-
Why Enterprise AKS Clusters Need a Private API Server
Technical analysis of public Kubernetes API risks in enterprise Azure environments, Private Link DNS resolution challenges, and how to configure zero-trust ingress.
Talk through your own Azure environment.
Start with a free 30-minute architecture assessment, or find your tier in three questions.