Acquisition Executives. DoD Instruction 5000.02 (Dec 2013) heavily emphasizes tailoring program structures and acquisition processes to the program characteristics. Agile development can achieve these ................................... 51 15 Pulling It All Together – Potential Agile Program Structures ......................................................... 52 16 Scaling Agile ............. practices does not guarantee program success, as many variables that affect success lie outside the control of the government program manager and his team. In the government context, Agile represents a good

“All software construction involves essential tasks, the fashioning of the complex conceptual structures that compose the abstract software entity, and accidental tasks, the representation of the abstract the essential parts of the software task, those concerned with fashioning abstract conceptual structures of great complexity. I suggest: • Using rapid prototyping as part of a planned iteration in establishing which address the essence of the software problem, the formulation of these complex conceptual structures”Attack the essence of the software problem • Buy versus build • Requirements refinement and

which design systems…are constrained to produce designs which are copies of the communication structures of these organizations…The larger an organization is, the less flexibility it has and the more Matrixed-oriented 1. Combines functional and market orientation 2. Often results in complicated structures iii. Market-oriented 1. Optimized for responding quickly to customer needs 2. Often flat, cross-disciplined organization, but how people act and react. The roots of Toyota’s success lie not in its organization structures, but in developing capability and habits in its people.” f. TESTING, OPERATIONS, AND SECURITY

https://techfarhub.cio.gov/ Handbook for Procuring Digital Services Using Agile Processes All structures (standard C, IDIQ, BPA, GWAC, set-aside, etc.) can support Lean-Agile contracts All types (FFP

advance, and that we have a way to (try to) control them.  The relationship between uncertainty, risk, and change is far too complicated for such control when delivering IT systems, where complexity silos in a way that values skills and contributions. Shadow IT—rogue IT, IT that is out of the control of the IT organization. It is what has saved IT up to this point. It is a powerful phenomenon that that we have not yet learned to take advantage of, caught up as we are in the contractor-control model of IT. Shadow IT is what happens when the IT organization is unable to meet the needs of a part of

environments matched Prod. They fixed forward, but changes not put back into version control. Focused on version control and automated environment creation – time reduced from 8 weeks to 1 day b. ENABLE system are shared in a version control repository ii. Version control is for everyone in the value stream iii. Everything, everything, everything is checked into version control 1. Application code & dependencies includes pre-production and build processes 9. Tools iv. 2014 State of DevOps Report – use of version control by Ops was the highest predictor of both IT performance & organizational performance d. MAKE INFRASTRUCTURE

of the time, the tasks would spend in queue a total of nine hours time the seven steps…” Change Control  “We need to tighten up our change controls… what’s preventing us from getting there?”  “That right.” Lesson: Don’t let your change control process become a change prevention process. Don’t let your change control board become a bottleneck. The change control board is not the place to decide whether whether a change is a good idea, the role of change control board is to ensure changes have been properly coordinated with and agreed to by proper stakeholders. Attributions [1] Amazon, http://www.amazon

TESTING INTO OUR RELEASE i. A/B testing requires fast CD to support ii. Use feature toggles to control experiments, cohort creation, etc. iii. Use telemetry to measure outcomes iv. Etsy open-sourced trading loss ii. Counterfactual Narratives 1. Accident due to change control failure – seems valid since we can imagine better control practices could have detected the risk earlier prevent the issue or valid since better testing practices could have mitigated iii. In low-trust, command & control cultures, change control often results in worse outcomes d. POTENTIAL DANGERS OF “OVERLY CONTROLLING CHANGES”

integrity and code signing – all contributors should have their own key and sign all commits to version control. All created packages should be signed and hash recorded for auditing h. ENSURE SECURITY OF OUR types of test code) 4. Ensure every CI process is in an isolated container 5. Make the version control credentials of the CI system read-only 3. Ch. 23 – Protecting the Deployment Pipeline a. INTEGRATE demonstrate high success rates and low MTTR iii. Link and provide traceability from planning to version control to production implementation for visibility and auditing c. WHAT TO DO WHEN CHANGES ARE CATEGORIZED

dominated the IT world because it appears to offer predictability, control, and efficiency, the key values of the contractor-control model. But it doesn’t. Requirements: Requirements are a way of controlling used to set boundaries for developers when they began a project. In other words, a vehicle for control. But standardization also imposes costs by:  limiting agility and adding bureaucratic waste: exceptions nevertheless gives all stakeholders good insight into the status of the initiative. It allows me to have control—or at least influence—over the direction of the initiative. It is based on a positive, supportive