Govern Stage

1. You are here:
2. Sec Section
3. Govern Stage

Maintained by:

On this page

• Vision
• Groups
• Priorities
• Stage development people leaders
• All Team Members
  • Anti-abuse
  • Authentication
  • Authorization
  • Compliance
  • Security Policies
  • Threat Insights
• Stable Counterparts
• Skills
  • Cross-functional Backlog
  • Merged Merge Request Types
  • Product Documentation Links
• Engineering Managers
  • Engineering Leadership - Backup Plans and Escalation
• Weekly updates
• Govern staff meeting
• Links and resources
  • Technical Documentation Links

The Govern engineering groups are responsible for the Govern Stage of the product.

Vision

Help users manage security vulnerabilities, policies, and compliance across their organization.

The stage vision is captured on the Govern product direction pages.

Groups

• Anti-abuse
• Authentication
• Authorization
• Compliance
• Security Policies
• Threat Insights

Priorities

Group priorities are reviewed collaboratively with product counterparts and published on the Govern direction pages

• Anti-abuse
• Authentication
• Authorization
• Compliance
• Security Policies
• Threat Insights

Stage development people leaders

To contact Govern stage development people leaders leaders use the following aliases:

• GitLab: @gitlab-org/govern/managers
• Slack: @s_govern_managers

All Team Members

Anti-abuse

Authentication

Authorization

Compliance

Security Policies

Threat Insights

Stable Counterparts

The following members of other functional teams are our stable counterparts:

Skills

Because we have a wide range of domains to cover, it requires a lot of different expertise and skills:

Cross-functional Backlog

Sisense

We also track our backlog of issues, including past due security and infradev issues, and total open SUS-impacting issues and bugs.

Merged Merge Request Types

Sisense

MR Type labels help us report what we're working on to industry analysts in a way that's consistent across the engineering department. The dashboard below shows the trend of MR Types over time and a list of merged MRs.

Product Documentation Links

• Security Dashboard
• Vulnerability Pages
• Security scanner integration
• Secure and Govern terminology

Engineering Managers

We meet bi-weekly synchronously to discuss stage and group wide topics. We primarily try to use Epics/Issues to initiate discussions and maintain transparency. We use the Govern Compartment Board to better organize our discussions.

Engineering Leadership - Backup Plans and Escalation

The following table lists the Govern Stage management backup plan.

Team members should contact any Govern Engineering Manager by mentioning in #sd_govern_engineering or #sec-growth-development-people-leaders if they need management support for a problem that arises, such as a production incident or feature change lock, when their direct manager is not available. The Govern manager can provide guidance and coordination to ensure that the team member receives the appropriate help.

The Engineering Manager will allocate open issues and merge requests to another engineer, ideally in the same group, if an engineer is absent.

Some people management tasks, including Workday and Navan Expense, may require for escalation or delegation.

In the event that one or more team members become unavailable for any reason, this can serve as the foundation for a business continuity plan (BCP) and serve as a basic guide for Managing Engineering continuity.

Weekly updates

The Govern development teams provide weekly status updates using an issue template and CI scheduled job. As priorities change, engineering managers update the template to include areas of interest.

An example template highlighting priorities, opportunities, risks, and security and availability concerns is:

<!--
How to fill in this section.

- Be opinionated. There are no wrong answers, we want our counterparts to know what we are working towards, and let us know if that doesn't align with their goals.
- Summarize - just enough information to provide an overview and to start a discussion

Priorities: A subset of the highest priority projects the group is working on - these could include Shared OKRs, Product priorities for Development, other initiatives (Development led, Development OKRs). List with links to epic/issue/work item. Should only include work that is currently scheduled (not a roadmap).

Risks: (One line) summary and link to discussion (epic/issue).

Opportunities: What we could do differently to mitigate risks and ensure delivery of priority projects.

Work in progress: (One line) summary and link to planning issue, workflow board, epic/issue list.
-->
## How to use this issue

Engineering Managers to provide status updates, to be shared with product counterparts and both product and engineering leadership for discussion.

<!--<details>-->
<summary>Copy this section into a new thread for your group</summary>

## Department: Group

### Priorities

<!-- Include to any relevant OKRs, or key roadmap deliverables -->

1. ...


### Risks

1. ...

### Opportunities

1. ...

### Work in progress

1. ...

### Error Budget,  Security & Reliability

1. Error Budget
   - ...

1. Security Issues
   - ...

1. Reliability Issues
   - ...
<!--</details>-->

### Updated (by EOD Monday)

- [ ] Govern: Anti-abuse
- [ ] Govern: Authentication and Authorization
- [ ] Govern: Compliance
- [ ] Govern: Security Policies
- [ ] Govern: Threat Insights
- [ ] SSCS Working Group
- [ ] Quality Engineering

#### After last update

- [ ] Add comment `cc at-mention team members here`

<!-- App appropriate assignees, epic, and labels
/label  ~"workflow::in dev"
/assign `@pcalder`
/epic `epic-link`
-->

Govern staff meeting

The Govern stage engineering department leaders meet every two weeks to discuss stage and group topics in the Govern and Growth staff meeting, and optionally every week in the Expansion Development staff and Sec Growth senior leaders development staff meetings.

Meetings have an agenda and are async-first, where the aim is to resolve discussions async and leave time in the meeting to deep dive into topics that require more discussion.

Links and resources

• Stage links
  • Discussions and issues are located at gitlab-org/govern
  • General Slack #s_govern
  • Social channel #sec-section-social
  • Engineering Slack #sd_govern_engineering
  • Govern Shared Calendar ID [email protected]
• Group #g_govern_security_policies
• Group #g_govern_threat_insights
• Group #g_govern_compliance
• Software Supply Chain Security working group

Technical Documentation Links

• End-to-end tests