Yeah, what's worked well for me is having ops or security people draw up guidelines (for security, it may be something as trivial as require ssh key auth, for o

Yeah, what's worked well for me is having ops or security people draw up guidelines (for security, it may be something as trivial as require ssh key auth, for ops it may be: write a script that matches an existing deployment procedure and we can get your app up and running very quickly).