Delivery playbook
This playbook explains the baseline questions we use to make ownership, access, change and recovery visible. Controls are adapted to the system and contract; this is not a certification claim.
Record the data classes, environments, integrations, administrators and external services in scope. A diagram must show where trust changes—not merely where servers sit. Unknown scheduled jobs and inherited credentials become explicit findings.
Roles follow actual job tasks and high-impact actions receive narrower privileges. Joiner, mover and leaver paths are documented. Service accounts, API keys and emergency access have owners, storage rules and review dates.
A release record links the approved change, review evidence, test result, known limitations and rollback decision. Urgent fixes may use an expedited path, but the retrospective evidence still has to be completed.
Alerts should point to an action. Incident contacts, severity definitions and communication responsibilities are agreed before a crisis. Backups count as a control only when restoration has been tested at an appropriate interval.
Findings include consequence, evidence, owner and target. Closure means the control is implemented and checked—not that a ticket was moved. Accepted risk is time-bound and approved by someone with authority.