You Can’t Govern What You Can’t See: The Three-State Model Every integration inventory is a list of the integrations someone remembered to register. The dangerous ones are the ones nobody registered including Azure Functions that exist only as code in a repository and were never formally deployed. Governance starts with discovery, not documentation. The integration…
Segregation of Duties in Azure DevOps: Proving Who Approved What Segregation of duties means the person who makes a change isn’t the person who approves it. If your team uses pull requests, you’re already complying the problem is that the evidence is scattered across your ticketing system, git history and pull requests, so proving it…
What Auditors Actually Ask For in an Integration Review Auditors ask for the same five things every year: a diagram showing how your systems integrate, an inventory of integrations per system, who owns each one, what data each handles, and evidence that changes were controlled. Most teams can produce two of these on demand. I’ve…
IT General Controls for Azure Integration: A Practical Guide Short answer: IT General Controls (ITGC) are the foundational controls auditors test to decide whether they can trust your systems at all. For an Azure integration estate, four things matter most: knowing what integrations exist, who owns them, what data they move, and proving that every…