A resident portal backlog suddenly includes stories that store Social Security numbers. What cross-team communication should the BA ensure?
Select an answer to reveal the explanation.
Short Explanation
SSNs in a resident portal are not a cute backlog surprise—pull security and privacy into the conversation before those stories harden.
Full Explanation
When a resident portal backlog suddenly includes stories that store Social Security numbers, the BA must ensure security and privacy teams stay in the loop whenever requirements touch resident PII. Cross-team communication here is a control obligation, not optional courtesy: PII scope changes risk, compliance posture, and acceptance criteria. Early inclusion prevents hardening unsafe stories into releases that expose residents.
Hiding PII-related stories from security until after release fails conceptually because post-release discovery of SSN handling is a governance and privacy failure, not a smart delay tactic. Assuming clerks can approve privacy controls without specialist review fails because clerical process knowledge is not privacy engineering or legal compliance authority. Communicating PII changes only to marketing fails because branding is irrelevant to privacy control design and verification.
Exam caveat: Requirements that introduce or expand PII demand security and privacy engagement before stories are treated as ready. Operational check: flag SSN-related portal stories, invite security and privacy to the next refinement, update acceptance criteria and threat or privacy controls as required, and block those stories from Done until specialist review is recorded.