Project Initiation (1st month)
Project Initiation (1st month)
Meet with a Sonatype Customer Success representative
- Our Customer Success Engineers are the coaches who filter what's important for your deployment.
- Establish a regular cadence with your Account team to guide you along the way.
- Plan to meet weekly for the first month.
- Move to biweekly for the next six months.
- Meet monthly or quarterly depending on additional needs.
Start your deployment with a project plan that aligns with your primary desired outcomes (PDOs)
- We recommend that you define and regularly review your primary desired outcomes.
- These are specific business results or strategic objectives that your company would like to achieve with the Sonatype Platform.
- Results to report to your primary stakeholders by next year's renewal.
- Associate with specific goals
- Measure throughout the deployment.
- A guiding star to keep your team focused on what is most important.
Set a timeline to achieve and review your strategic outcomes
- Start with clear goals that are meaningful and measurable.
- It is seldom possible to do everything, right away.
- Use a short-cycle agile pilot team to document how to expand.
- Report successes and challenges back to management to drive the project forward.
Determine your open-source governance champions
- DevSecOps initiatives require key individuals aligned to a shared goal.
- Responsibilities of champions include:
- Maintain internal documentation
- Determine acceptable risk
- Set expectations for stakeholders
- Design workflows for deployment
- Drive expansion to the rest of the organization
- Respond to questions and feedback
- Publish a list of champions and their roles to assist with adoption.
| Role | Description |
|---|---|
| #### Lifecycle Sponsors | - the primary point of contact for Sonatype Customer Success and Support |
| #### Server Administrators | - maintains the IQ Server software and infrastructure - responsible for: upgrading, cleanup, backup/restore, testing, monitoring, reporting |
| #### Policy Owners | - designs and implements the open-source governance policy - set notifications workflow - manages enforcement through the application lifecycle |
| #### Operations / Build Engineers | - integrate Lifecycle scans into the application build pipeline |
| #### Application / Project Owners | - prioritizes remediation efforts - accepts open-source risk - manages technical debt |
| #### Developers | - research reported risk - remediate issues in the code base - request policy waivers - proactively follows good open-source hygiene |
Use an internal wiki to document requirements and processes
- Plan for long-term success by documenting from the beginning.
- Have Champions own their respective sections of the documentation.
- Include a review of team documentation as a regular task.
- Use Sonatype learning resources to augment developer enablement.
- Use a component remediation catalog for faster remediation of common libraries and vulnerabilities.
Deploy the IQ Server to a testing environment before rolling it out to production
- First, deploy integrations to a testing environment to reduce the impact on production.
- Use a backup of the production in your testing environment to minimize the impact of running intensive reports and scripts.
- Consider using an A/B testing environment to manage upgrades.
- Your Lifecycle license can be used in any of your testing and production environments.