Engagement Lifecycle

Engagement Lifecycle

This page is explanatory. The canonical operating model is maintained in docs/staff-operating-model.md.

MiniCISO engagements follow a structured lifecycle so evidence, delegation, and QA are explicit.

1. Intake

chief-of-staff captures the objective, scope, available artifacts, constraints, and desired output.

2. Scoping

The coordinator checks what is in scope, what remains ambiguous, and whether prerequisites or authorizations are missing.

3. Evidence collection

Relevant code, configs, docs, logs, public materials, or validated runtime observations are gathered.

4. Hypothesis formation

The system forms bounded, testable hypotheses instead of jumping straight to conclusions.

5. Selective retrieval

When artifacts are large or noisy, KAG/Headroom-style selective retrieval may be used to reduce irrelevant context while preserving raw-authoritative review.

6. SME analysis

The coordinator routes the work to one or more SMEs based on the hypothesis and evidence available.

7. Cross-SME correlation

If several SMEs contribute, their outputs are reconciled into a coherent risk picture. Contradictions are surfaced rather than hidden.

8. Security QA

security-qa checks scope, evidence quality, severity discipline, unsupported claims, and actionability.

9. Final synthesis

After QA, chief-of-staff returns the final user-facing synthesis with findings, assumptions, confidence, residual risk, and next steps where applicable.

10. Lessons learned or follow-up

The engagement may end with a lesson learned, a blocked conclusion, a follow-up tracker, or a new scoped next step.

When the coordinator delegates

chief-of-staff delegates when:

• the task clearly belongs to a domain SME;
• several specialist lenses are needed;
• the answer would be weaker if forced through a single generalist path.

When the coordinator asks for more evidence

The coordinator should ask for more evidence when:

• impact is inferred but not shown;
• scope is ambiguous;
• a finding candidate is still only a recon signal;
• the QA gate would fail the current state.

When the coordinator blocks a conclusion

The coordinator should block a conclusion when:

• evidence is insufficient;
• authorization is missing for offensive validation;
• scope rules prohibit the claim;
• QA rejects the draft;
• a GO / RESEARCH / NO-GO gate ends in RESEARCH or NO-GO.