# Project Initiation (1st month)

## Meet with a Sonatype Customer Success representative

- Our Customer Success Engineers are the coaches who filter what's important for your deployment.
- Establish a regular cadence with your Account team to guide you along the way.
  - Plan to meet weekly for the first month.
  - Move to biweekly for the next six months.
  - Meet monthly or quarterly depending on additional needs.

## Start your deployment with a project plan that aligns with your primary desired outcomes (PDOs)

- We recommend that you define and regularly review your primary desired outcomes.
  - These are specific business results or strategic objectives that your company would like to achieve with the Sonatype Platform.
- Results to report to your primary stakeholders by next year's renewal.
- Associate with specific goals
- Measure throughout the deployment.
- A guiding star to keep your team focused on what is most important.

## Set a timeline to achieve and review your strategic outcomes

- Start with clear goals that are meaningful and measurable.
- It is seldom possible to do everything, right away.
- Use a short-cycle agile pilot team to document how to expand.
- Report successes and challenges back to management to drive the project forward.

## Determine your open-source governance champions

- DevSecOps initiatives require key individuals aligned to a shared goal.
- Responsibilities of champions include:
  - Maintain internal documentation
  - Determine acceptable risk
  - Set expectations for stakeholders
  - Design workflows for deployment
  - Drive expansion to the rest of the organization
  - Respond to questions and feedback
- Publish a list of champions and their roles to assist with adoption.

| Role | Description |
| --- | --- |
| #### Lifecycle Sponsors | - the primary point of contact for Sonatype Customer Success and Support |
| #### Server Administrators | - maintains the IQ Server software and infrastructure<br>  <br>- responsible for: upgrading, cleanup, backup/restore, testing, monitoring, reporting |
| #### Policy Owners | - designs and implements the open-source governance policy<br>  <br>- set notifications workflow<br>  <br>- manages enforcement through the application lifecycle |
| #### Operations / Build Engineers | - integrate Lifecycle scans into the application build pipeline |
| #### Application / Project Owners | - prioritizes remediation efforts<br>  <br>- accepts open-source risk<br>  <br>- manages technical debt |
| #### Developers | - research reported risk<br>  <br>- remediate issues in the code base<br>  <br>- request policy waivers<br>  <br>- proactively follows good open-source hygiene |

## Use an internal wiki to document requirements and processes

- Plan for long-term success by documenting from the beginning.
- Have Champions own their respective sections of the documentation.
- Include a review of team documentation as a regular task.
- Use Sonatype learning resources to augment developer enablement.
- Use a component remediation catalog for faster remediation of common libraries and vulnerabilities.

## Deploy the IQ Server to a testing environment before rolling it out to production

- First, deploy integrations to a testing environment to reduce the impact on production.
- Use a backup of the production in your testing environment to minimize the impact of running intensive reports and scripts.
- Consider using an A/B testing environment to manage upgrades.
- Your Lifecycle license can be used in any of your testing and production environments.