AWS DevOps, Terraform & Kubernetes — field notes.

Straight comparisons and guides from 16+ years shipping production AWS.

• What an ISO 27001 scope statement actually looks like
  A real ISO 27001 scope example, broken into its component parts, plus the exclusions and boundary decisions that actually get challenged at audit.
• What a Lead Implementer ISO 27001 qualification actually gets you
  Lead Implementer ISO 27001 is a training credential for building an ISMS, not a certifying qualification. Here's what it covers and when you need one on staff.
• How to choose an ISO 27001 certifying body
  What an ISO 27001 certifying body actually does, how accreditation works, and how to pick between BSI, DNV, Schellman, A-LIGN and others without overpaying.
• What ISO 27001 actually is and why it exists
  ISO 27001 is the international standard for an information security management system. Here is what it covers, how it is structured, and who needs it.
• What an ISO/IEC 27001 information security management system actually is
  An ISO/IEC 27001 ISMS is a documented, risk-based system of policies, controls and reviews, not a one-off audit. Here's how it's structured and run on AWS.
• What people actually mean by an AWS DevOps agent
  AWS DevOps agent means two different things: an AI automation tool inside your pipeline, or a person running your AWS operations. Here's how to tell which you need.
• What it actually means to be PCI DSS compliant on AWS
  PCI DSS compliant means you meet all 12 requirements of the current standard, validated by SAQ or QSA audit based on transaction volume and merchant level.
• What it actually means when a company says it is ISO 27001 certified
  ISO 27001 certified means an accredited body audited your ISMS and issued a certificate valid for three years. Here is what that process involves and costs.
• SOC 2 vs ISO 27001 (2026): Which First?
  What each proves, who asks for which, cost, timeline and how to sequence them - from a CISA + AWS Solutions Architect Professional.
• How to Pass SOC 2 Type 2 (2026)
  A practical 7-step roadmap on AWS - scope, controls, evidence automation and the observation window.
• AWS Compliance Controls Mapping (SOC 2 / PCI / ISO)
  How IAM, KMS, CloudTrail and Config map to SOC 2, PCI DSS and ISO 27001 - and the evidence each produces.
• vCISO vs Compliance Consultant: Which Do You Need?
  Ongoing security leadership vs a one-off project — when a fractional CISO makes sense for SOC 2 / ISO 27001.
• How a Fractional CISO Gets You SOC 2-Ready
  The real 8-14 week roadmap: AWS controls, evidence automation, and handling security questionnaires.
• Terraform vs CloudFormation (2026)
  Terraform vs CloudFormation compared for AWS in 2026 — multi-cloud, modules, state, drift, ecosystem and when each wins, from a CISA + AWS Solutions Architect Professional.
• EKS vs ECS (2026)
  Amazon EKS vs ECS compared for 2026 — control, portability, operational overhead, cost and when each wins, from a CISA + AWS Solutions Architect Professional.
• GitHub Actions vs GitLab CI vs Jenkins
  GitHub Actions vs GitLab CI vs Jenkins compared for 2026 — hosting, maintenance, security, scale and when each wins for AWS CI/CD, by a CISA + AWS Solutions Architect Professional.
• ArgoCD vs Flux (2026)
  ArgoCD vs Flux compared for 2026 — UI, multi-tenancy, footprint, progressive delivery and when each wins for Kubernetes GitOps, by a CISA + AWS Solutions Architect Professional.