Mobilisation checklist¶
What a delivery partner needs in place to start work on a Defra engagement, and who to meet in the first week. Start early: some access takes weeks.
Work through this with your Defra engagement lead before and during your first weeks.
To be confirmed
TODO: typical lead times for security clearance, Defra devices and accounts, GitHub organisation access and Core Delivery Platform access, and who arranges each.
Before day one¶
| What | Why | Who arranges it | Lead time |
|---|---|---|---|
| Security clearance for each team member, at the level the work needs | Access to Defra systems and data | Supplier, with the Defra engagement lead | To be confirmed |
| Defra devices or an approved way to use your own | Access to Defra systems from a managed device | Defra engagement lead | To be confirmed |
| Defra accounts (Microsoft Entra ID) with multi-factor authentication | Single sign-on to Defra tools (GR-IAM-02) | Defra engagement lead | To be confirmed |
| Access to the Defra GitHub organisation | All code lives there from day one (GR-DEV-02) | Defra engagement lead | To be confirmed |
| Access to the Core Delivery Platform | Hosting, pipelines and environments (GR-HOST-01). The CDP portal needs a Defra device or the Defra VPN | Platform team - see getting onto Defra platforms | To be confirmed |
| A cloud account, separate from your standard Defra login, if you need the DEV or TEST environments, infrastructure admin or to deploy to the Defra Cloud Platform | Requested through the Defra Service Desk - see common security tasks in the Defra Digital Service Manual | Each team member, through the Service Desk | To be confirmed |
| Agreement on any AI coding assistants you plan to use | GR-AI-07 | Supplier, with the Defra engagement lead | - |
In the first week¶
Meet:
- your Defra engagement lead and service owner, to agree outcomes, ways of working and how decisions are made
- the solution design authority for your area, to agree how you will share designs and decisions - see solution design authorities
- the architecture team, for the relevant service pattern, patterns and guardrails
- the platform team, for onboarding to the Core Delivery Platform
- a security architect and the service's risk owner, to plan Secure by Design activities and the first threat model
- teams you depend on or that depend on you - see working with other suppliers
Set up:
- the service repository, with a README, a LICENCE file, a
docs/adrfolder and branch protection (GR-DEV-08, GR-OPEN-02, GR-DEV-03) - secret scanning, push protection and automated dependency updates (GR-OPEN-03, GR-DEV-06)
- the guardrail check in your pipeline, so gaps show up from the first pull request
- your first ADR, recording the options you will explore
- a date for your first decision check and self-assurance against the guardrails for your phase
By the end of the first month¶
- Architecture approach shared with the solution design authority
- First threat model session held (alpha onwards)
- Service tier proposed with the service owner
- Knowledge sharing with Defra staff planned - pairing, show and tells, documentation