Question 700
A product owner and security manager disagree whether a high-priority user story can omit data-retention requirements. The team has identified a response and must obtain a justified decision before moving forward. What governance decision should leadership make before the next commitment?
Explanation
Correct Answer
This decision respects the accountable project authority and the scenario’s remaining exposure: Escalate unresolved regulatory interpretation to the designated legal authority before approving scope. The response being governed is Use the agreed risk and compliance framework to facilitate a solution rather than bargaining away a mandatory control. and the completion measure is Acceptance criteria satisfy the required retention constraints while retaining the story's customer value.
Incorrect Answers
Publish approved decisions without exposing private resident information or promising every request will be met. That safeguard does not address the specific risk here: calling a legal obligation a product preference turns a resolvable conflict into noncompliance. The relevant follow-up is: Escalate unresolved regulatory interpretation to the designated legal authority before approving scope.
Refer contractual remedies to procurement after a documented good-faith technical resolution attempt. That safeguard does not address the specific risk here: calling a legal obligation a product preference turns a resolvable conflict into noncompliance. The relevant follow-up is: Escalate unresolved regulatory interpretation to the designated legal authority before approving scope.
Seek formal sponsor approval to retire obsolete acceptance criteria and revise targets. That safeguard does not address the specific risk here: calling a legal obligation a product preference turns a resolvable conflict into noncompliance. The relevant follow-up is: Escalate unresolved regulatory interpretation to the designated legal authority before approving scope.