00
By i7ops · Three standardized stages

The Groundwork Delivery Framework

Every engagement measured against the same five lenses: AWS Well-Architected, DORA, cloud-native baseline, NIST, and OWASP. Same standards. One automation flywheel. Repeatable margin.

0
Fixed-scope services
0 min
Free scoping call
0
Hourly meters running
Scroll
Why standardization works

Your company runs its own particular mix of tools. That mix does not change the method, because the assessment lenses are public standards, not opinions about tooling. Same five lenses every time. Same automation flywheel. Margin compounds.

Standardized delivery

Three stages.
One method, every time.

Same scanner battery at the open and close. Automation gathers facts; humans decide what they mean.

01
read-only audit

Discover

Automated audit of AWS accounts, Kubernetes, pipelines, and repos, interpreted by hand. Output: scored gap analysis against five lenses plus a prioritized finding register.

1 week / $3,500
02

Plan

Findings become a prioritized roadmap with effort, dependencies, and standard references. One-page fixed proposal. Complete enough to execute without i7ops.

Included
03
re-verified

Remediate

Build from a proven module library, then re-run the identical Stage 1 scanners. Before/after delta proves closure with evidence, not claims.

2–6 weeks / priced
Assessment lenses

Standards, not opinions.
Public, authoritative, repeatable.

Every finding maps to at least one standard. When your auditor asks why something is built the way it is, the answer cites a standard, not a consultant.

Cloud architecture

AWS Well-Architected

Six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, sustainability. The primary structure for cloud findings.

  • Operational excellence
  • Security
  • Reliability
  • Performance efficiency
  • Cost optimization
  • Sustainability
Source AWS
Delivery performance

DORA metrics

Four proven metrics for delivery excellence: deployment frequency, lead time, change failure rate, mean time to recovery. SLOs with error budgets.

  • Deployment frequency
  • Lead time for changes
  • Change failure rate
  • Mean time to recovery
  • Error budgets & SLOs
Source Google Cloud
CORE
Security & compliance

NIST + OWASP

NIST CSF 2.0 and SP 800-53 for structure; SP 800-190 for containers. OWASP Top 10, Docker/K8s guidance, and practical tooling. Comprehensive government-backed + practitioner-built.

  • NIST CSF 2.0 functions
  • NIST SP 800-53 controls
  • NIST SP 800-190 containers
  • OWASP Top 10
  • OWASP container & K8s guidance
Source NIST & OWASP
Evidence collection

The scanner battery.
Runs at open and close.

Same tools, same versions, same scope. Discovery baseline. Remediation verification. Before/after delta proves closure with evidence, not claims.

Prowler
AWS posture · CIS + NIST mapping
kube-bench
Kubernetes · CIS Benchmark
Trivy
Images + IaC · NIST 800-190
Checkov
Terraform · CIS + NIST policies
gitleaks
Secret detection · OWASP
OWASP ZAP
Web apps · OWASP Top 10
Dependency-Check
CVEs · third-party libraries
DORA collector
GitHub API · deployment metrics

Automation gathers facts; humans decide what they mean. Evidence archive ships with every report. Nothing in the report is asserted without a file behind it.

Standardization payoff

The flywheel.
Why it compounds.

01
Discovery → Remediation

Same scanners open and close

Every project produces a quantified before/after case study. The delta table is persuasive and measurable, not theoretical. Anonymized data compounds the portfolio.

02
Terraform + Actions

Module library hardens

Every remediation adds a reusable Terraform module or GitHub Actions workflow. Next engagement is faster at the same fixed price. Margin compounds while delivery time drops.

03
Kyverno + OPA policies

Guardrails prevent regression

Policy-as-code means closed findings cannot silently regress. Creates natural retainer demand: "keep us green." Ongoing business from a single initial engagement.

Same method → better data → faster builds → higher margin. Standardization works because the lenses don't move.

Why standardization works

The lenses don't move.
Your tools do.

One method. Five lenses. Any tools. Your company runs its own particular mix. That mix does not change the assessment, because AWS Well-Architected, DORA, NIST, and OWASP are public standards, not opinions about tooling. Same five lenses whether you run Lambda or Kubernetes.

Discovery is 80% scriptable. A read-only role + one orchestrator script runs Prowler, kube-bench, Trivy, Checkov, gitleaks, ZAP, and a DORA collector. Same tools, same versions, same scope. Automation gathers facts; humans interpret them. That's where the value lives.

Remediation builds from a module library. Every Terraform module and GitHub Actions workflow from past engagements makes the next one faster. The library compounds. Margin compounds. Same fixed price.

Verification is not optional. Stage 1 scanners run again at close. Before/after delta proves closure. "Critical findings: 14 → 0, with evidence." Not "we implemented it."

Groundwork Framework
Standardized delivery · repeatable margin
Fixed-scope packages

Stage-based delivery.
One price per stage.

Foundation

Discover

$3,500 · 1 week

Read-only audit + gap analysis against five lenses.

  • Full scanner battery
  • Executive scorecard
  • Findings register
  • Roadmap outline
  • Evidence archive
Start here
Included

Plan

Included · with discover

Prioritized roadmap with P0/P1/P2 packages.

  • Effort estimation
  • Dependency mapping
  • Standard references
  • One-page proposal
  • Module library fit
Included
BUILDS IT
Remediate

Implementation

Priced · per package

Build + verify + before/after delta proof.

  • Terraform + Actions
  • Module library build
  • Re-verification scan
  • Runbooks + handoff
  • Evidence delta
Get a proposal

Every engagement is measured twice: once at discovery, once at close. Same scanners. Measured proof, not claims.

FAQ

Asked before.
Answered honestly.

Discovery gives you a baseline. Remediation closes findings. Re-running the identical scanner battery proves closure with evidence, not claims. The before/after delta is the most persuasive artifact you'll ever produce to an investor, auditor, or enterprise customer.

Yes. The roadmap from Stage 2 is deliberately complete enough that your team can execute it without i7ops. Most clients choose to contract Stage 3, but a significant fraction don't, and the Discovery Report still pays for itself.

The framework adapts. AWS Well-Architected is AWS-native, but DORA, NIST, and OWASP are cloud-agnostic. Prowler scans AWS accounts; Steampipe runs multi-cloud queries. GCP, Azure, and Kubernetes get assessed through the same lenses. The standards don't move; the tools do.

With every engagement. A Terraform module or GitHub Actions workflow added per engagement means next engagement is faster at the same fixed price. Margin compounds because the flywheel tightens. After 10 engagements, baseline remediation time drops significantly.

You do. Runbooks, architecture diagrams, and recorded session are delivered alongside the working infrastructure. i7ops access is revoked at close. When you hire your first platform engineer, they inherit a system, not a mystery.

FRAMEWORK

Ready to standardize
your delivery?

Start with a discovery. Same method. Same lenses. Measured proof. Worst case: you leave with a roadmap worth the audit fee.