Decision logs
Preserve the reason for a choice so future work can build on it.
The idea
A decision log records important choices, options considered, reasoning, authority, time, and consequences. It helps teams avoid repeating the same debate and exposes assumptions that may later change. Security decisions often involve tradeoffs between risk, usability, cost, and delivery. Record enough context to evaluate whether a decision remains valid, without turning every minor action into a lengthy formal document.
In practice
A team chooses a private source repository and public reading access, records the publishing workflow, and identifies what would trigger a future contribution model.
A common misunderstanding
The selected option alone does not explain why it was appropriate or when it should be revisited.
Check your understanding
What makes a decision record useful later?
Think it through: Its context, assumptions, alternatives, rationale, owner, and conditions for review.
Preserve the reasoning that will otherwise disappear
A decision log records an important choice, when it was made, who had authority, and why the chosen option was preferred. Include alternatives considered, constraints, and conditions that would justify revisiting the choice. A log should not reproduce every conversation. Its purpose is to make the reasoning recoverable when the original participants are unavailable.
Security projects often involve tradeoffs between protection, usability, cost, and operational complexity. Recording only approved says little about those tradeoffs. A decision to retain a legacy integration temporarily should identify the accepted limitation and the review trigger. Otherwise, a temporary compromise can become permanent simply because nobody knows it was meant to expire.
A fictional platform selection
A team compares two authentication approaches. One meets the immediate needs with less integration work, while the other offers features the team may need later. The decision log records the current scope, support capacity, evaluation evidence, and reason for choosing the simpler option. It also states that a future customer-account expansion would require reassessment.
Six months later, a new engineer asks why the more feature-rich product was rejected. The log supplies a context-bound answer rather than a judgment that the product is universally inferior. If the context has changed, the team can revisit the decision intelligently. A decision log supports learning without requiring people to defend an old choice forever.
Write a reversible decision
Choose a fictional log-retention period for a training environment. State the purpose, options, cost and privacy considerations, approving owner, and next review date. Add one event that would cause an earlier review. Do not pretend the example establishes a legal retention requirement; the useful skill is explaining a choice and the conditions under which it remains appropriate.
Keep exploring
References & further reading
Original explanations, with primary references for deeper study.
UK Government: Project Delivery Functional Standard