A city CISO ties the automation backlog to OKRs for mean time to respond. What roadmap practice is that?
Select an answer to reveal the explanation.
Short Explanation
You're buying faster response when you tie work to MTTR OKRs, and chasing velocity OKRs won't show that payoff. Tie automation work to MTTR OKRs and the roadmap earns its keep. You'll struggle to defend funding if you're chasing MTTD OKRs since it doesn't prove you cut response time.
Full Explanation
A city CISO who ties the automation backlog to OKRs for mean time to respond is aligning the roadmap to civic security outcomes. Automation stories then compete on how they shrink detect-to-contain time for municipal incidents—phishing, ransomware precursors, or account takeover—rather than on delivery outputs such as velocity OKRs. Outcome-linked OKRs give councils and department heads a clear reason to fund backlog items and a way to judge whether shipped automation improved response for citizens and staff.
Why the other options fail by concept: Aligning DevOps-style automation roadmaps to delivery outputs such as velocity OKRs optimizes for delivery pace instead of measurable civic risk reduction and MTTR outcomes. Aligning DevOps-style automation roadmaps to change outcomes such as CAB approval OKRs adds bureaucratic friction without proving faster or better incident handling. Aligning DevOps-style automation roadmaps to civic detection outcomes such as MTTD OKRs prioritizes detection speed over incident response outcomes and weakens the MTTR linkage.
Exam caveat: MTTR OKRs are directional; over-optimizing for speed alone can push unsafe full-auto containment without adequate approval gates. Operational check: map each automation epic to an MTTR or related outcome metric, baseline before deploy, and review post-deploy civic incident timing in the OKR cycle before expanding scope.
Prefer to study offline? Printable PDF study book + test engine ($7.50, unofficial). These questions stay free here.