CYBER LIBRARY
Explore the bootcamp
Making change happenBeginner

Backlogs and prioritization

Order work by value, risk, dependencies, and learning needs.

3 min readUpdated 12 Oct 20266 connections
Markdown

The idea

A backlog is an ordered collection of work that may be needed for a product or improvement. Items should be understandable enough to support decisions, with refinement as knowledge develops. Prioritization considers value, risk, obligations, dependencies, and effort. A backlog is not an unlimited promise to complete every suggestion. Ownership and transparent ordering help the team focus on the most useful next work.

In practice

A team prioritizes fixing an exposed access path before cosmetic reporting changes, while scheduling a small investigation to resolve an uncertain requirement.

A common misunderstanding

The oldest item is not necessarily the highest priority, and a long backlog does not demonstrate progress.

Check your understanding

What makes a backlog item actionable?

Think it through: A clear intended outcome, relevant context, and sufficient detail to discuss acceptance and dependencies.

Ordering expresses a choice

A backlog contains potential work toward a product's purpose, but its value comes from making priorities and tradeoffs visible. An unordered collection of requests does not tell the team what should happen next. Consider expected benefit, security risk, dependencies, cost, and what a small piece of work could teach. The highest-severity label alone may not resolve the choice between unlike items.

Refinement makes upcoming items understandable enough to discuss and plan. It can include clarifying a problem, splitting an oversized request, identifying acceptance evidence, and discovering dependencies. It should not require detailed specification of every distant idea, because priorities and understanding can change before that work is needed.

A fictional access-service backlog

A team has requests for a new dashboard, clearer approval records, and an exception-handling path. Operators currently cannot determine who approved privileged access, so improving the record may deliver more immediate risk reduction than the attractive dashboard. A small exception-handling experiment could also clarify a major uncertainty before broader automation.

The ordering should be explained to stakeholders, especially those whose requests move later. Record the reason and revisit it when conditions change. A backlog is a living decision aid; retaining every obsolete idea forever can make the real priorities harder to find. Archive or remove items that no longer support the purpose.

Compare two candidates

For a fictional employee security portal, choose two improvements and explain their users, intended benefit, dependencies, and evidence of success. Order them and state one fact that would reverse your decision. This demonstrates informed prioritization without pretending that a numerical score can replace judgment. The useful outcome is a clear rationale for the next investment of effort.

Keep exploring

GO TO THE SOURCE

References & further reading

Original explanations, with primary references for deeper study.

The official Scrum Guide
EXPLORE THIS IDEA’S CONNECTIONS

A small part of a bigger picture.

6 notes · 8 connections
100%
Backlogs and prioritization · depth 1
Drag to pan · Pinch or use +/− to zoom · Click to preview · Double-click to read
Browse notes as a list (6)
FOLLOW ANOTHER THREADExplore the rest of the library
Start with a concept. Follow its connections.
Detection & responseAbuse Elevation Control MechanismElevation-control abuse bypasses or misuses mechanisms governing privileged execution.Making change happenAcceptance criteriaDefine observable conditions for a deliverable to be accepted.Security essentialsAccess controlUnderstand subjects, resources, permissions, and enforcement through a shared-drive example, including how access changes over time.Detection & responseAccess Token ManipulationAccess token manipulation changes or adopts operating-system security contexts.Risk & resilienceAccount Access RemovalAccount access removal disrupts legitimate users by changing, deleting, or restricting their identities.Evidence & investigationAccount DiscoveryAccount discovery enumerates identities available in a system or environment.Detection & responseAccount ManipulationAccount manipulation changes identity settings to preserve or expand access.Adversarial thinkingAcquire InfrastructureInfrastructure acquisition obtains domains, servers, or other resources used to support operations.Adversarial thinkingActive ScanningActive scanning probes target infrastructure to learn reachable services or weaknesses.Security essentialsAdversary in the middleAn intermediary may observe or alter a communication path.Security essentialsAESA symmetric block cipher whose safe use depends on its mode and implementation.Making change happenAgile deliveryUse short feedback cycles to adapt toward a useful outcome.