{"id":1042,"date":"2026-10-23T17:20:00","date_gmt":"2026-10-23T17:20:00","guid":{"rendered":"https:\/\/bhaso.com\/blog\/?p=1042"},"modified":"2026-10-23T17:20:00","modified_gmt":"2026-10-23T17:20:00","slug":"bhaso-noops-readiness-audit","status":"publish","type":"post","link":"https:\/\/bhaso.com\/blog\/bhaso-noops-readiness-audit\/","title":{"rendered":"The NoOps Readiness Audit: What to Verify Before You Commit"},"content":{"rendered":"<p>An auditor never asks whether you believe a claim. An auditor asks what you can evidence, and NoOps makes a claim that deserves exactly that treatment. The pitch says a company can run its systems without a dedicated operations team because providers and automation have taken the work over. Some of that is true. None of it is true by default. Between the marketing and the reality sits a set of verifiable facts about ownership, coverage, and cost that any leadership team can check before it restructures anything \u2014 and checking first is far cheaper than discovering the gaps during an outage.<\/p>\n<p>This piece is written as an audit in the accounting sense: twelve checks, each one answerable with documents rather than opinions. Run them against your own estate and the results will tell you whether a NoOps-style operating model is a plan or a wish. Where a check fails, that is not a reason to abandon the direction; it is a work item with a name on it. The same discipline applies broadly when <a href=\"https:\/\/bhaso.com\/blog\/navigating-business-technology-solutions-with-bhaso-com\/\">navigating business technology solutions<\/a>: claims first, evidence second, commitment last.<\/p>\n<h2>What a NoOps Audit Actually Measures<\/h2>\n<p>The core idea under examination is that operations gets displaced rather than eliminated. Before checking individual items, an auditor wants the evidence organised into four drawers:<\/p>\n<ul>\n<li><strong>Work:<\/strong> what operational tasks still exist after automation, and how many hours they consume.<\/li>\n<li><strong>Ownership:<\/strong> whether each surviving task has a named human or team behind it.<\/li>\n<li><strong>Exposure:<\/strong> what breaks when a provider, a quota, or a credential fails.<\/li>\n<li><strong>Cost:<\/strong> the total unit cost of the service, people included.<\/li>\n<\/ul>\n<p>The <a href=\"https:\/\/www.xopsschool.com\/noops\/\">NoOps field reference from xOps School<\/a> organises its metrics along much the same lines, which is reassuring: an idea that can be measured is an idea that can be adopted safely. The twelve checks below walk through those drawers in order.<\/p>\n<h2>The Twelve Checks<\/h2>\n<ol>\n<li><strong>Write down every recurring task.<\/strong> Patching, certificate renewal, quota reviews, backup verification, dependency updates. If the list cannot be produced in an afternoon, the estate is not understood well enough to restructure. This inventory is the raw material for every later check.<\/li>\n<li><strong>Name an owner for each task.<\/strong> The share of duties with no assigned owner \u2014 the unowned duty share \u2014 has a target of exactly zero. In a NoOps-shaped organisation the owners are simply different people: product engineers, platform staff, or vendor managers. Anonymous work is how outages incubate.<\/li>\n<li><strong>Read the responsibility boundary for every service you buy.<\/strong> Microsoft&#8217;s service-model matrix makes the pattern explicit: data, identities, configuration, and access policies remain the customer&#8217;s in every model, from self-run to fully managed. A cloud migration never moves those four. Check that someone on your side can prove it.<\/li>\n<li><strong>Test identity hygiene, not just policy documents.<\/strong> The Snowflake account takeovers happened without any provider breach: the compromised customers had no second factor on their sign-ins, no key-rotation habit, and no allow lists limiting where logins could come from. A controlled audit samples real accounts and verifies the controls are switched on, because a policy that is not enforced is a rumour.<\/li>\n<li><strong>Do the dependency arithmetic.<\/strong> Your promise to customers is bounded by the intersection of your critical dependencies. Multiply their availability figures and you get your real ceiling: three dependencies at 99.95%, 99.95%, and 99.99% produce roughly 99.89% before your own contribution. Evidence-led planning quotes that product, not the largest single number in the chain, and it designs for the weakest link accordingly.<\/li>\n<li><strong>Price the people back into the unit cost.<\/strong> A worked example from the reference material puts a fully loaded service at 177.6 per million requests, with about two-thirds of that being human time. Automation changes the mix of that number slowly. Any business case that counts infrastructure but not salaries has already overstated its savings.<\/li>\n<li><strong>Verify backups by restoring, not by dashboard.<\/strong> &#8220;Managed&#8221; has never meant &#8220;backed up&#8221;; AWS&#8217;s own guidance keeps backup strategy on the customer&#8217;s side of the line. The audit standard is a rehearsed restore within your stated window \u2014 a common target is ninety days of demonstrated readiness \u2014 and a screenshot of the recovered data, not the console.<\/li>\n<li><strong>Compare workload against coverage.<\/strong> The hours of operational work are usually far smaller than the hours of staffing needed to cover them around the clock. A service needing a third of a full-time engineer per month still demands a rotation of roughly eight people to satisfy a cap of twenty-five percent on any individual&#8217;s on-call burden. Coverage, not workload, is what makes teams expensive \u2014 and what shared platform groups are designed to amortise.<\/li>\n<li><strong>Check quota headroom.<\/strong> Headroom is one minus peak demand over quota, per limit that matters: API rates, account limits, regional capacity. Managed platforms hide these ceilings until the day they surface as throttling. An evidence-led organisation knows its numbers per service and reviews them when traffic grows.<\/li>\n<li><strong>Confirm runtime currency.<\/strong> Versions and runtimes should sit comfortably inside vendor support windows \u2014 a practical rule of thumb is staying at least 180 days clear of any deprecation date. Under a NoOps model the provider patches, but your application code, extensions, and integrations still age on their own schedule.<\/li>\n<li><strong>Rehearse failure on purpose.<\/strong> A readiness claim without a recent game day is an assertion. Pick the failure that would hurt most \u2014 region loss, identity provider outage, quota exhaustion \u2014 and drill it. What the rehearsal exposes, usually within the first hour, is exactly which operational knowledge quietly disappeared with the old team. Date-stamp the findings and treat a drill older than two quarters as expired evidence.<\/li>\n<li><strong>Price the exit before you need it.<\/strong> Export formats, egress volumes, and the engineering effort of a migration belong in the original decision document. Regulation is pushing switching fees down \u2014 the EU Data Act abolishes egress charges for cloud exits from January 2027 \u2014 but no regulator can repeal the engineering effort. An exit nobody has priced is a lock-in nobody has admitted.<\/li>\n<\/ol>\n<h2>Scoring a NoOps Audit<\/h2>\n<p>Maturity here runs on a ladder. Level 0 is NoOps by assertion: the ops function was disbanded and nothing was measured. The intermediate levels add registers, named ownership, and rehearsed failure, and the top of the ladder \u2014 Level 4 \u2014 is described as low-ops by design: a small, counted, owned set of operational duties that the organisation can defend line by line. Note what the top rung is called. Even the strongest version of the idea keeps a remainder; it just refuses to let that remainder be invisible.<\/p>\n<p><p>One closing habit separates organisations that benefit from this direction from those that merely survive it: cadence. A single audit is a snapshot, and estates drift. Companies that rerun the twelve checks twice a year watch their numbers \u2014 unowned duties, quota headroom, unit cost \u2014 as trends, which turns operations from a staffing argument into a measurable line of the business. The same evidence-first habit pays off across the wider stack, from <a href=\"https:\/\/bhaso.com\/blog\/bridging-web-solutions-cloud-and-artificial-intelligence-for-digital-growth\/\">bringing web solutions, cloud infrastructure, and AI into one coherent picture<\/a> to ordinary budget reviews.<\/p>\n<p>For a business reader the summary is straightforward. Automation genuinely removes tasks, providers genuinely absorb machinery, and a lean company can absolutely run further with fewer operational specialists than a decade ago. What no configuration removes is the residual work, the coverage it needs, and the accountability that follows data, identities, configuration, and access wherever they live. Spotting spending leaks before they drain a runway, as one <a href=\"https:\/\/bhaso.com\/blog\/mastering-modern-cash-flow-how-to-spot-spending-leaks-protect-digital-payments-and-extend-runway\/\">guide to modern cash flow puts it<\/a>, is the same instinct this audit applies to operations: measure the quiet outflows, then decide. Score honestly, fix what fails, and the direction \u2014 whatever you call it \u2014 pays for itself.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A twelve-check audit for the NoOps question: duty inventories, ownership, dependency maths, unit cost with people included, and exit pricing before you commit.<\/p>\n","protected":false},"author":6,"featured_media":1043,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[166],"tags":[],"class_list":["post-1042","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-business-technology"],"_links":{"self":[{"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/posts\/1042","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/comments?post=1042"}],"version-history":[{"count":1,"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/posts\/1042\/revisions"}],"predecessor-version":[{"id":1055,"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/posts\/1042\/revisions\/1055"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/media\/1043"}],"wp:attachment":[{"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/media?parent=1042"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/categories?post=1042"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bhaso.com\/blog\/wp-json\/wp\/v2\/tags?post=1042"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}