Business & Operations

Review DORA readiness for ICT risk management, resilience testing, incidents, third-party risk, roles, policies, evidence, and auditability.

Review documentation freshness, ownership, review cycles, approvals, versioning, validity, and traceability.

Assess maturity across plan, code, build, test, release, deploy, and operate with automation, security gates, ownership, and feedback loops.

Review setup, local development, error messages, Makefiles or scripts, onboarding, tooling consistency, and practicality for teams.

Plan coding work with minimal context, relevant file selection, risk awareness, rollback, and validation strategy.

Map technical measures to DORA, VAIT or BAIT migration needs, ISO 27001, BSI, internal policies, or MaRisk review expectations.

Review Dockerfiles, base images, user rights, capabilities, SBOM, image signing, distroless or slim images, CVEs, and runtime hardening.

Review governance controls such as CODEOWNERS, branch protection, approvals, auditability, and policy compliance.

Review SAP (member) using its official documentation and repository in the CNCF Members / Platinum category. As a global leader in enterprise applications and business AI, SAP stands at the nexus of business and technology. For over 50 years, organizations have trusted SAP to bring out their best by uniting business-critical operations spanning finance, procurement, HR, supply chain, and customer experience.

Review cloud accounts or subscriptions, networks, IAM, logging, policies, baselines, guardrails, encryption, tagging, and tenant separation.

Review cloud naming, tags, ownership, cost centers, allowed services, regions, data classification, policy enforcement, and audit evidence.

Review restore tests, RPO/RTO, data integrity, backup protection, recoverability, and disaster recovery.

Review automated repair actions for safe limits, dry runs, approval modes, rollback, audit logs, blast radius, and loop protection.

Link requirements, controls, implementation, tests, tickets, and evidence into an auditable trace.

Review evidence, approvals, tickets, logs, test protocols, risk decisions, versioning, and accountable owners.

Create and maintain ADRs with context, decisions, alternatives, risks, security impact, compliance relation, and review points.

Review REST, GraphQL, OpenAPI, and gRPC contracts, breaking changes, versioning, AuthN/AuthZ, error formats, and compatibility.

Review Angular components, signals, RxJS, forms, routing, state, accessibility, testing, and bundle performance.

Review alerts for actionability, clear symptoms, runbook links, severity, ownership, SLO relation, deduplication, escalation, and remediation suitability.

Assess correlation of logs, metrics, traces, events, and incidents to reduce noise, improve root-cause analysis, and lower alert fatigue.

Review AI-assisted changes before execution for automation boundaries, human approval, affected-system criticality, and audit evidence.

Compare declared agent contracts with independent runtime enforcement across tools, files, processes, networks, secrets, approvals, and limits.

Design and review Adyen Checkout, merchant references, idempotency, HMAC webhooks, asynchronous results, modifications, and tests.

Assess CVE triage, prioritization, SLAs, exploitability, asset criticality, exceptions, risk acceptance, and remediation tracking.