digital-native-governance-check

Digital Native Governance Check

Purpose

Evaluate whether a startup's Azure environment has the foundational governance that enterprise customers, investors, and auditors expect. Produces a maturity score (0–100) with clear next steps.

This is NOT a deep compliance audit (use the Compliance & Governance skill for that). This is a focused "did you get the basics right?" diagnostic for teams of 5–50 engineers who set up Azure fast and moved on.

When to use this skill

• Startup preparing for first enterprise customer security review
• CTO asks "are we production-ready?"
• Pre-Series A infrastructure maturity check
• After first incident: "what basics did we miss?"
• Quarterly governance health check for Digital Natives

Maturity levels

Score	Level	Meaning
0–39	🔴 Foundation	Governance basics missing — will fail any security questionnaire
40–69	🟡 Developing	Some controls exist but significant gaps remain
70–89	🟢 Established	Solid posture — can pass most security reviews
90–100	🏆 Optimized	Enterprise-grade governance on Azure

Assessment procedure

Run all checks in parallel where possible. Score each and sum for total.

---

🏥 CATEGORY 1 — Alerting & Observability (20 points)

Detects: "Azure VM went down and nobody knew" + "you configured one alert type out of four"

Check 1.1 — Service Health alerts exist (8 pts)

az monitor activity-log alert list \
  --subscription <sub-id> \
  --query "[?contains(to_string(condition.allOf), 'ServiceHealth')].{name:name, enabled:enabled}" \
  -o json

Scoring:

• 8 pts: Alert exists covering all 4 event types (Service Issues, Health Advisories, Planned Maintenance, Security Advisories)
• 4 pts: Alert exists but covers only 1–2 types
• 0 pts: No Service Health alerts at all

📖 https://learn.microsoft.com/en-us/azure/service-health/alerts-activity-log-service-notifications-portal

Check 1.2 — Resource Health alerts for compute (6 pts)