CYBER LIBRARY
Explore the bootcamp
Making change happenBeginner

RAID logs

Separate risks, assumptions, issues, and dependencies to support action.

3 min readUpdated 12 Oct 20265 connections
Markdown

The idea

A RAID log tracks risks, assumptions, issues, and dependencies. The categories distinguish uncertainty, things believed true, current problems, and reliance on other work. Entries need ownership, impact, actions, dates, and status. An assumption should be validated when it matters; an issue needs resolution; a dependency needs coordination. Keep the record linked to decisions rather than creating a static administrative artifact.

In practice

A team records an assumption about available audit retention, verifies it early, and converts a failed assumption into an owned issue with a mitigation.

A common misunderstanding

Listing everything under “risk” can hide an immediate problem that needs resolution now.

Check your understanding

Why track assumptions explicitly?

Think it through: Unverified beliefs can shape a plan and cause surprises when they turn out to be wrong.

Four categories answer different questions

A RAID log brings together risks, assumptions, issues, and dependencies. A risk concerns uncertainty; an assumption is something treated as true for planning; an issue is an existing problem; a dependency is an input or relationship needed for progress. Keeping these categories distinct helps people choose a response instead of applying the same status label to everything.

A useful entry includes a clear statement, an owner, an impact, and a next action or review point. Categories may evolve. An assumption that a test environment will be available needs validation. If availability becomes uncertain, it may create a risk. If the agreed environment is unavailable when needed, there is now an issue affecting delivery. Preserve that history rather than merely changing a color.

A fictional migration meeting

A team migrating staff accounts records that the supplier's export format is assumed compatible, a specialist's leave could delay testing, a current test import fails, and production rollout depends on service-owner approval. The log makes it clear that these are four different situations. The failed import needs investigation now, while approval needs a coordinated handoff.

The meeting should focus on decisions and changed circumstances, not reading every unchanged row aloud. Escalate entries that exceed the team's authority or threaten an agreed outcome. Close an item with evidence or a recorded decision so another person can understand why it no longer needs active attention.

Classify an ambiguous concern

Take the statement we need more licenses. Rewrite it four ways: as an assumption about coverage, a risk of procurement delay, an existing shortfall, and a dependency on a purchase order. For each version, name a different next action. Notice how clearer wording changes who needs to act and when, even though the underlying subject remains licensing.

Keep exploring

GO TO THE SOURCE

References & further reading

Original explanations, with primary references for deeper study.

UK Government: Project Delivery Functional Standard
EXPLORE THIS IDEA’S CONNECTIONS

A small part of a bigger picture.

4 notes · 4 connections
100%
RAID logs · depth 1
Drag to pan · Pinch or use +/− to zoom · Click to preview · Double-click to read
Browse notes as a list (4)
FOLLOW ANOTHER THREADExplore the rest of the library
Start with a concept. Follow its connections.
Detection & responseAbuse Elevation Control MechanismElevation-control abuse bypasses or misuses mechanisms governing privileged execution.Making change happenAcceptance criteriaDefine observable conditions for a deliverable to be accepted.Security essentialsAccess controlUnderstand subjects, resources, permissions, and enforcement through a shared-drive example, including how access changes over time.Detection & responseAccess Token ManipulationAccess token manipulation changes or adopts operating-system security contexts.Risk & resilienceAccount Access RemovalAccount access removal disrupts legitimate users by changing, deleting, or restricting their identities.Evidence & investigationAccount DiscoveryAccount discovery enumerates identities available in a system or environment.Detection & responseAccount ManipulationAccount manipulation changes identity settings to preserve or expand access.Adversarial thinkingAcquire InfrastructureInfrastructure acquisition obtains domains, servers, or other resources used to support operations.Adversarial thinkingActive ScanningActive scanning probes target infrastructure to learn reachable services or weaknesses.Security essentialsAdversary in the middleAn intermediary may observe or alter a communication path.Security essentialsAESA symmetric block cipher whose safe use depends on its mode and implementation.Making change happenAgile deliveryUse short feedback cycles to adapt toward a useful outcome.