Maintenance & Risk Management
After launch, your product enters its most challenging phase. This deliverable prepares your team to handle security incidents, service outages, compliance requirements, and technical risks.
1. Security & Compliance Checklist
Security and compliance must be designed in — not bolted on after launch. Define your security posture upfront.
🔐 Authentication & Auth
🛡️ Data Protection
📋 Regulatory Compliance
GDPR
🇪🇺 Europe
- • Right to erasure
- • Cookie consent
- • Privacy policy
CCPA
🇺🇸 California
- • Opt-out of data sale
- • Right to know
- • Non-discrimination
ISO 27001
🌐 Global
- • Risk assessment
- • Incident procedures
- • Audit trails
2. SLA & Support Plan
A Service Level Agreement (SLA) is a formal commitment to your users about availability and response times.
| Severity | Definition | Response |
|---|---|---|
| P0 — Critical | Complete service outage, data loss | < 15 min |
| P1 — High | Core feature broken for all users | < 1 hour |
| P2 — Medium | Feature degraded, workaround exists | < 4 hours |
| P3 — Low | Minor bug, cosmetic issues | < 24 hours |
3. Incident Response & Disaster Recovery
When things break, what is the plan? Define recovery objectives and communication channels.
Recovery Time Objective (RTO)
Max acceptable downtime (e.g., 4 hours)
Recovery Point Objective (RPO)
Max acceptable data loss (e.g., 1 hour)
Incident Communication
Status page, email alerts, Slack channel (#incidents)
4. Risk Mitigation Plan
Proactively identify risks before they become incidents.
Security Vulnerability (CVE / Breach)
Impact: CriticalMitigation Strategy
- ✓Automated dependency scanning
- ✓Regular penetration testing
- ✓WAF in front of APIs
Technical Debt Accumulation
Impact: HighMitigation Strategy
- ✓20% of sprint allocated to refactoring
- ✓Mandatory code review
- ✓SonarQube for code quality
Server Crash / Infrastructure Failure
Impact: CriticalMitigation Strategy
- ✓Multi-AZ deployment
- ✓Auto-scaling groups
- ✓Automated database failover