know whats funny, that i just realized about 'risk acceptance forms'?
even if some business unit signs one and says they accept the risk for whatever it is...
guess whos problem it is if it gets popped?
guess who has to do IR?
not them
@Viss At best, it's a little bit of CYA when management comes demanding an RCA.
we need a "OK, it's your problem now" form.
when you sign it, you don't get to drag us back in to fix the problem we warned you about that you got popped on because you didn't do any of the remediations we told you to do. you acknowledge that we did all we could but couldn't save you from yourself.
:)
@paul_ipv6 @Viss Every risk acceptance you sign off on, you owe SRE and IR another 1/4 FTE headcount.
well played. ;)