Existing DevOps Approach
Today, technology organizations typically have people with two distinct skill sets: Software Engineers and DevOps Engineers. Further, some may have DevOps and compliance functions managed within the same or separate teams. In startups and smaller companies, there may just be the same engineers wearing all three hats.
Software engineers come up with the high level application architecture. The business provides compliance requirements. These two are passed on to the DevOps team who use their subject matter expertise to realize what needs to be done for the cloud infrastructure. There are other elements of operations in scope, such as CI/CD and diagnostics that include central logging, monitoring and alerting.