jperezduerto.info
Security in depth · Unit 30 · Lesson 9 of 11
A recommendation needs an owner and outcome
Turn a “development complete” update into an accountable verification plan.
Helpful before thisReporting: turn evidence into useful improvements
After this lesson you can
- Assign ownership and completion evidence across a correction’s deployment dependency.
Ownership connects an intended outcome to the evidence needed for closure.
Agree what completion means
Acceptance criteria are observable conditions agreed in advance for deciding whether work achieved its intended outcome. An owner coordinates delivery; a reviewer evaluates the result. One person can perform several roles in a small team, but the responsibilities must remain explicit.
Assume a fictional document service requires guests to see published documents only. The agreed correction must enforce that outcome while preserving authorized staff access. Its temporary download restriction reduces exposure but is not the permanent correction.
Supplied work-item history
- W1: Nora, the application owner, coordinates the correction. The platform team must deploy a shared policy change; a security reviewer verifies the agreed permission outcomes afterward.
- W2: The planned completion date was day six. On day eight, development is marked complete and the change is merged, but deployment and verification records are absent.
- W3: The temporary restriction remains active. Its approval expired on day seven; no extension or remaining-risk acceptance is recorded.
Write a status that drives action
W2 supports “implementation complete; deployment and outcome unverified.” It does not establish that the production behavior changed. Nora must coordinate the platform dependency and the reviewer’s evidence, rather than passing a supposedly finished item between teams.
W3 requires an explicit decision from the authorized owner of the exception. Do not silently extend approval or label the temporary restriction a verified permanent fix. Record its current state, operational effect, and next decision date.
The closure record should link the delivered change, reviewed environment, acceptance evidence, and accountable decision. A schedule helps coordinate work; evidence establishes which result was achieved.
Model update: Nora owns coordination; deployment and verification remain open; expired temporary approval needs a recorded decision.
Terms you met
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
What should the day-eight update say?
Show the answer
Correct answer: Nora remains accountable; coordinate deployment and verification, and escalate the expired temporary approval. W1-W3 distinguish completed development from an unverified outcome. Cross-team dependencies and expired approval need explicit decisions rather than silent closure.
Try it
- WriteDraft a work-item update naming outcome, accountable owner, deployment dependency, verification evidence, and temporary-control deadline. Model the status as implementation complete but deployment and outcome unverified; Nora coordinates the remaining work and an authorized exception decision.