Designing an ISO-27001-Native CI/CD Pipeline on AWS

“We passed an ISO-27001 surveillance audit with zero Jira tickets, zero screenshots, and zero manual evidence.” That line usually gets silence. Then disbelief. Then the real question: “Okay… how?”