& secure c. CREATE OUR SINGLE REPOSITORY OF TRUTH FOR THE ENTIRE SYSTEM i. ALL parts (code & environments) of the system are shared in a version control repository ii. Version control is for everyone without accompanying automated tests. Spread Testing Grouplet team approach. Google – single, share repository of billions of files. 50% of code is changed each month. 40K code commits/day, 120K automated of pain b. HP LaserJet Firmware –i. Before CI: 2 releases per year. 5% of effort supporting new features, 20% on detailed planning, 25% on porting code amongst branches, 10% integrating, 15% manual testing

requirements/desired functionality for the program Release Backlog – Subset of the program backlog listing features intended for the release Sprint Backlog – Subset of the release backlog listing the user stories activity. Teams populate the program backlog during an initial planning session, identifying all features the team considers relevant to building the product. The program backlog serves as the primary highest priority items are implemented first. The team need not document all the requirements or features up front, as the program backlog will evolve over time. Subsequent strategic, high-level planning

simultaneously. Key Measures Mean-time to production: the average time it takes from when new software features are required until they are running in production. Average lead-time: how long it takes for a Program-specific Log Storage and Retrieval Service 2. Service Mesh 3. Program-specific artifact repository 4. Runtime Behavior Analysis Artificial Intelligence (AI) service 5. DCAR for the hardened https://www.csiac.org/podcast/dod-enterprise-devsecops-initiative/ DoD Centralized Container Source Code Repository (DCCSCR) https://dcar.dsop.io/ DSOP Group Workspace https://dccscr.dsop.io/dsopDCCSCR Project

Created a self-improvement project  2 week iterations, planning and demos  Put everything into a repository (configurations, scripts, etc.) Infrastructure as Code  Turned over repeatable and automatable development support team with the production support team.  Operations becomes familiar with new features in QA, rather than in front of and with the customer – shorter feedback loop  More opportunities

expressed as code.” c. CREATE A SINGLE, SHARED SOURCE CODE REPOSITORY FOR OUR ENTIRE ORGANIZATION i. Firm-wide shared source code repository is powerful way to share local discoveries to the entire organization pipeline tools 5. Monitoring and analysis tools 6. Tutorials and standards ii. Google – Single repository with over 1B files and over 2B SLOC, over 25K engineers for every Google property d. SPREAD KNOWLEDGE work i. Make security part of everyone’s jobii. Integrate preventative controls into our shared repository iii. Integrate security with our deployment pipeline iv. Integrate security with our telemetry

shared goals ii. See problems as they occur iii. Enable quick detection & recovery iv. Ensure features operate as intended and achieve organizational goals 2. Ch. 14 – Create Telemetry to Enable Seeing of Production Engineering) iii. Find the proper balance between fixing production issues and new features development – feature is only “done” when it’s performing as expected in production c. HAVE DEVELOPERS successful at improving the key metric!” iii. A/B testing helps reduce zero or negative value add features to the baseline that also increase maintenance costs and identify opportunity costs. d. INTEGRATE

Off-the-shelf systems are more expensive than we expect, and take longer to roll out. We pay for features that we don’t actually use.  It resists change—we can’t even change it ourselves, but have to in the hands of users. This not only delivers value immediately, but also lets us validate the features that have been deployed.  we would carefully set boundaries for planning. A detailed plan is a

self-organizing, self-managing team-of-agile-teams  release trains  working off a single backlog of features, driven by vision and roadmap  product and release management, release planning  program psi

Software Development unless otherwise noted: a. Partially done work: b. Extra processes: c. Extra features: d. Task switching: e. Waiting: f. Motion: g. Defects: h. Nonstandard or manual work:i.