Onboarding inventory
Before anything is changed, a written record of what exists: services, versions, scheduled jobs, integrations, DNS, certificates, backup destinations and who holds which access. Most of this does not currently exist for the environments we are asked to take on, and it is the first deliverable rather than an afterthought.
Access model
Establishing who can reach the environment, through what, and with what privilege — replacing shared credentials and undocumented keys with named access that can be revoked when someone leaves.
Patch and version management
A defined schedule rather than a policy: what is updated, how it is tested, when it is applied, and what the rollback is if it goes wrong.
Backup verification
Confirming that backups exist, that they complete, and — the part that is usually missing — that a restore actually works. Tested restore is the deliverable; a backup log is not evidence.
Monitoring and alerting
Availability, resource use, certificate expiry, disk growth and service health, wired to somewhere a human actually reads. Alerting nobody receives is indistinguishable from no alerting.
Capacity and performance
Web server, database and application-level tuning reviewed against observed load, with headroom estimated in advance rather than discovered during an incident.
Deployment and change procedure
A documented, repeatable way to ship a change — including how to reverse it — so releases stop being unrepeatable events whose success depends on the person doing them.
Escalation path
A named route for a problem that exceeds the agreed scope, rather than an informal expectation that someone will notice a message.
Written reporting
A recurring report of what was done, what was found and what needs attention, so the state of the environment is visible to the people funding it rather than inferred from the absence of complaints.