How to manage and document decisions
from wop@infosec.pub to cybersecurity@infosec.pub on 21 Sep 2024 12:24
https://infosec.pub/post/17850546

Big or small, we make decisions every day. Rules, policies, processes, templates, etc.

How do you document the process and results of your decision making and track changes?

To give you some background, a lot of departments discuss certain topics every two weeks, but nothing is written down - it takes a lot of time and worse, some decisions change every two weeks.

I’ve been trying to fight this battle with OneNote atm and was inspired by some software change management frameworks (wild mix of things):

Each decision/problem gets a new page.

• What is the question/problem?
• Why is this decision necessary?
• What are the pros and cons?
• Which departments need to be involved? What is the scope? (department, site, country, continent, international, etc.)
• What are the alternatives and consequences of not implementing?
• plus changelog
• plus metadata, such as parties involved, who proposed it, dates, etc.

Still a work in progress, but it is a mix of RFC, ADR, and some other frameworks.

How do you handle that?

#cybersecurity