Page 374 - CyberSecurityEssentialsEnglish

An exit plan is not pessimism; it is the condition for avoiding vendor lock-in and the loss of
the ability to operate.

FIGURE 8-6: THE LIFECYCLE OF A RESPONSIBLE USE

What to notice: Seven connected stages from registration to retirement, with decision gates
that prevent moving on without evidence proportionate to the level of risk.

Source: Prepared by the author, drawing on established risk management and impact
assessment guidance [2][4].

TABLE 8-6: DECISION GATES ACROSS THE LIFECYCLE

Gate The question it settles Evidence required to pass

Is this a real problem worth A described problem, an owner, and an
Registration
solving? expected outcome.

Impact Who could be harmed, and Affected groups, harm scenarios, and

assessment how? named controls.

Pre-release Does it work well enough Acceptance results on representative
testing for this use? and edge cases.

Does it hold in real Measured indicators and a documented
Pilot
conditions? rollback.

Under what scope may it Stated conditions, limits, and a decision
Approval
operate? owner.

Change Has something material Re-tested results after an update or a
review shifted? new purpose.

Revoked access, retained records, and a
Retirement How do we stop it safely?
replacement plan.

373