Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

ADR ###: Specific Decision Title

Status: Proposed | Date: YYYY-MM-DD | Review: YYYY-MM-DD

Set Review to one year after Date.

Synopsis

  • Use when: One sentence describing the conditions that make this ADR applicable.
  • Avoid when: One sentence describing important exclusions or simpler alternatives.
  • Decision: One sentence stating the selected approach.
  • Required evidence: The minimum artifacts that demonstrate implementation.
  • Dependencies: Link direct ADR dependencies, including their status where relevant, or write None.

Context

What problem are we solving? Include background and constraints.

Policy and Standards

  • Authoritative policy or guidance landing page
  • Durable capability terms supported by this decision
  • External guidance used to implement the decision

Prefer terms such as multi-factor authentication, application patching, or secure software development over policy clause numbers. Record exact policy versions and clauses in agency assurance records when point-in-time traceability is required.

State whether the ADR fully or partially supports each capability. Do not claim that use of an ADR proves compliance.

Applicability

Use this ADR when:

  • Project or service condition 1 applies
  • Project or service condition 2 applies

Do not use this ADR for:

  • Out-of-scope condition 1
  • Out-of-scope condition 2

Decision

What we decided and how to implement it:

  • Requirement 1: Specific implementation detail
  • Requirement 2: Configuration specifics
  • Requirement 3: Monitoring approach

Implementation Checklist

  • Configuration or control 1 is in place
  • Configuration or control 2 is in place
  • Logging, monitoring, or review evidence is captured

Required Evidence

  • Configuration or policy export showing the control is enabled
  • Test, monitoring, or review record showing the control is effective
  • Named owner and review date for retained evidence

Exceptions

Where a mandatory requirement cannot be implemented, record the reason, compensating controls, residual risk, accountable executive approval, expiry date, and reassessment date in the implementing agency’s risk system.

  • ADR ###: Related Decision

Consequences

Positive:

  • Benefit 1 with explanation
  • Benefit 2 with explanation

Negative:

  • Risk 1 with mitigation
  • Risk 2 with mitigation