Topics in this domain
- Enterprise Architecture and IT Risk
- Change Management Risk
- Assets, Configuration and Dependencies
- Incident and Problem Management Oversight
- Project Governance and IT Risk
- Governing the Secure SDLC
- DevOps, CI/CD and Agile Delivery Risk
- Testing, Release and Deployment Risk
- Data Classification, Ownership and Handling
- Data Lifecycle: Integrity, Retention and Disposal
- Business Continuity Planning and Governance
- Disaster Recovery and Testing Recovery Capability
- Emerging Technology Risk: Cloud, IoT and OT
- AI and Machine Learning Risk
- Setting Risk Boundaries for Innovation
- Core Security Concepts: CIA, IAM, Cryptography and Network Security
- Security Frameworks and Control Standards
- Security Awareness Culture and Measuring Training
- Privacy Governance and Data Protection Principles
- Developing a Data Protection Control Strategy
Testing, Release and Deployment Risk
Levels of testing
Controlled release
The go/no-go decision
Example. Two days before go-live, four critical defects were still open. Instead of the project manager deciding, the practitioner made sure the business owner saw the residual risk; go-live was delayed a week and the defects fixed.
Test data
- Use masked or synthetic data where possible.
- Protect test environments if real data is unavoidable.
- Remove test accounts before go-live.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Who accepts a system for production | The business owner |
| Critical defects before go-live | The business owner decides, with full knowledge |
| Essential for a major release | A tested rollback plan |
| Production data in testing | Mask it, or protect it equally |
In short
- Testing moves from unit to integration, system and user acceptance testing, each checking something bigger.
- Users or business owners formally accept a system before go-live.
- Release management moves tested changes into production in a controlled way, with a tested rollback.
- Go/no-go decisions rest with the business owner, based on test results and residual risk.
- Data conversion must be reconciled and signed off by data owners.
Exam traps
- Developers testing and accepting their own work.
- Going live with critical defects open and no formal risk decision.
- No rollback plan for a major release.
- Using unmasked production data in test environments.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Levels of testing
Controlled release
The go/no-go decision
ExampleTwo days before go-live, four critical defects were still open. Instead of the project manager deciding, the practitioner made sure the business owner saw the residual risk; go-live was delayed a week and the defects fixed.
1 / 8