Field-tested patterns, mistakes worth avoiding, and architecture decisions from cloud and CI/CD work in healthcare and defense engineering teams. Written for senior engineers and engineering leaders.
The Field Notes archive is structured. Pick the path that matches where you are right now.
SOC 2 Type II grades whether your controls operated for months, not whether they existed on audit day. Map CC6.1 access, CC6.6 and CC6.7 encryption, CC7 detection, and CC8.1 change management to Terraform modules that produce the operating-effectiveness evidence automatically, with real HCL.
Read the post →The reference module layout for a HIPAA environment: account isolation, customer-managed keys with rotation, least-privilege IAM, centralized tamper-evident audit logging, and a plan-time policy gate around the PHI boundary, with the control-to-module crosswalk an auditor can read.
Read the post →A GitLab-specific breakdown of the parent/child architecture. What moves to the parent (gates, evidence, deploy authorization), what stays in the child (build, test, scan, sign), the artifact contract between them, and multi-project pipelines for a polyrepo split across backend, frontend, infra, networking, and security.
Read the post →Three GitHub-specific decisions separate a HIPAA-aligned GitHub Actions pipeline from a SOC 2 one. The OIDC trust scope. The runner labeling discipline. The reusable workflow boundary as the compliance contract. With Terraform, workflow YAML, and the OPA gate that ties them together.
Read the post →The practitioner's control map we use during 2-week audit engagements. Every Security Rule control mapped to a specific pipeline touchpoint, with the CFR section, the auditor's question, what passes, what fails, and the architectural fix. Includes a printable PDF.
Read the post →SOC 2 audits the policies you chose. HIPAA audits the system you built. A control-by-control map of where the two pipelines actually diverge (BAA scope, six-year retention, encryption verification, sanction enforcement) with Rego, GitHub Actions, and cosign code.
Read the post →Three architectural decisions separate HIPAA-compliant pipelines from generic CI/CD: parent/child pipeline separation, isolated runners per environment, and security scanners as policy gates. With GCP and AWS code examples.
Read the post →Five patterns I keep seeing in healthcare CI/CD pipelines that fail audits and slow teams down, plus what actually works instead. None of them are about not knowing what HIPAA requires. They're structural.
Read the post →The Field Notes posts are individual angles on the same underlying methodology. Boundary First, Continuous Evidence, Policy as Code, and Founder-Delivered. If you want the framework as a whole instead of pattern by pattern, read the methodology page.
Read the methodology →The Field Notes posts are derived from real engagement work. If you want help applying any of this to your team's pipeline or architecture, here's how Stonebridge engages.
2-week audit ($15K) or 8-week build. Pipeline architecture against the Security Rule.
See engagement →PHI boundary mapping, encryption topology, IAM federation, audit-ready from day one.
See engagement →FedRAMP Moderate and High baselines for federal and defense engineering teams.
See engagement →HIPAA-aligned EKS, GKE, AKS platforms with policy gates and runner isolation.
See engagement →HIPAA-aligned AI infrastructure for regulated industries. Model serving, pipelines, governance.
See engagement →Complete service catalog. Audit, build, retainer, and emergency engagements.
See all services →Every Security Rule technical safeguard mapped to a specific pipeline touchpoint. The auditor's question for each control, what passes, what fails, and the architectural fix. The reference document we use during 2-week audit engagements. Get the PDF and join the Field Notes list.
Six years building cloud infrastructure and CI/CD pipelines in regulated environments. HIPAA, FedRAMP, and SOC 2 engagement work for healthcare and defense engineering teams across AWS, GCP, Azure, and OCI.
Read published case studies, see how we engage, read the Evidence-Driven Infrastructure methodology, or book a 20-minute scoping call.
Monthly. Cloud architecture patterns, CI/CD lessons, and compliance engineering observations from active client work. No marketing, no fluff. Unsubscribe in a click.