Question

During a sprint retrospective, your team identifies that their Definition of Done (DoD) is no longer adequate. Several production incidents in the past month were traced to inadequate security testing, which isn't explicitly required in the current DoD. The team wants to add comprehensive security scanning and penetration testing to the DoD. However, this would reduce the team's velocity by approximately 30% and would require security tools that take three weeks to procure and configure. The Product Owner is concerned about the impact on the product roadmap commitments made to stakeholders. How should this situation be handled?

Accepted Answer

Update the DoD to include security requirements, begin the tool procurement process, and work with the Product Owner to reset stakeholder expectations about delivery timelines while implementing manual security checks in the interim

Answer

Implement the enhanced DoD immediately to prevent future security incidents, and inform stakeholders that velocity will be reduced until the quality standards are met

Answer

Create two separate Definitions of Done: one for regular features and a more stringent one for security-sensitive features, allowing the team to maintain velocity on non-critical items

Answer

Defer updating the DoD until the security tools are procured, continue with the current DoD, but add security testing as a separate backlog item that can be prioritized by the Product Owner

PMP Practice Question: Process — Agile, Hard

More Process Questions