When to use it
When a decision affects several teams, has serious consequences or involves unclear authority.
Fields to complete
| Field | Your notes |
|---|---|
| Decision and authorized owners | Add known information, your judgment or an open question. |
| Conditions, event and affected people | Add known information, your judgment or an open question. |
| Existing controls and evidence they work | Add known information, your judgment or an open question. |
| Remaining risks and unknowns | Add known information, your judgment or an open question. |
| Immediate containment and other options | Add known information, your judgment or an open question. |
| Business, data, operations and specialist owners | Add known information, your judgment or an open question. |
| Decision, expiry and review conditions | Add known information, your judgment or an open question. |
| Stop and recovery authority, and people to notify | Add known information, your judgment or an open question. |
Example entry
Invalidate old sessions first and use practice tasks to test permission revocation. The data owner decides whether to restore access based on results, while operations retains stop authority.
From the fictional Beichen case. This shows one way to write an entry; your analysis may lead to a different choice.Check your work
Assign authorized owners to consequential risks; a vote cannot bypass specialist requirements.