Web Application Setup and Maintenance RACI
Digital Solutions Operating Model
The operating model is designed to create a close partnership between marketing agencies, service partners and Client resources to deliver quality digital products securely and efficiently.
Roles | Responsibilities |
---|---|
Stakeholder | As business lead, provide strategic guidance and ownership Confirm the solution design and operational procedures Obtain appropriate approvals per PRT process |
Agency | Develops creative strategy, campaign, copy layouts, messaging and style guide Participate in PRT submissions & client reviews |
I.S / BPS | Manage the digital technology portfolio and applications Develops and supports the digital operating model Participates in status and prioritization meetings Continually evolve the digital technology roadmap |
Service Partner | Provides the implementation services of the selected solution Documents the implementation process, builds design documents, and functional specs Provide best practices on architecture and act as Subject Matter Expert |
PRT | Provide review and approval of all promotional material |
New Application RACI
Client BPS | Client IS | Motionstrand | 3rd Party Agencies | Hosting Provider | ||
---|---|---|---|---|---|---|
1 | Hosting Environment | |||||
1.1 | Codebase request | C | I | R | I | |
1.2 | Codebase request cost approval | A | R | C | I | |
1.3 | Codebase provisioning | I | I | R | ||
1.4 | Assign codebase access to Motionstrand | I | I | R | ||
1.5 | Create team for new agency | A | I | R | C | |
1.6 | Assign teams and members to codebase | A | I | R | C | |
2 | Drupal Development (Hosting Development Environment) | |||||
2.1 | Install and configure Drupal 10 | I | R | |||
2.2 | Responsive theming and module development | R | ||||
2.2.1 | Non-standard Frontend & Backend development | I | R | I | ||
2.3 | Apply Drupal core and contributed module security updates | I | R | |||
2.4 | Deploy application to staging environment for review and testing | I | R | |||
3 | Quality Assurance (QA) Testing (Hosting Staging Environment) | |||||
3.1 | Complete frontend and backend application testing | I | R | R | ||
3.2 | Identify and address QA issues | I | I | R | I | |
3.3 | Code Review | C | R | |||
3.4 | CMS configuration review | I | R | |||
3.5 | Hosting Code and configuration audit report | I | I | R | ||
3.6 | Application updates to meet Hosting environment best practices and Drupal 10 coding standards | I | I | R | ||
3.7 | Revisit QA test plan and confirm release candidate for production | A | I | R | ||
3.8 | OWASP top 10 penetration testing | C | R | C | I | |
4 | Deployment/Testing (Hosting Production Environment) | |||||
4.1 | Setup application domain(s) and SSL certificate | I | C | R | C | I |
4.2 | Deploy application to Production environment | A | C | R | C | |
4.3 | Configure domain DNS settings | I | R | C | I | I |
4.4 | Post deployment QA testing | I | I | R | R | |
4.5 | OWASP top 10 penetration testing | C | R | C | C | C |
5 | Reporting | |||||
5.1 | Functional specification document and/or annotated design/flowchart | A | I | R | ||
5.2 | Website tracking and reporting | C | R |
R = Responsible, A = Accountable, C = Consult, I = Inform
Application Maintenance RACI
Client BPS | Client IS | Motionstrand | 3rd Party Agencies | Hosting Provider | ||
---|---|---|---|---|---|---|
1 | Drupal Development (Hosting Development Environment) | |||||
1.1 | Responsive theming and module development | R | ||||
1.2 | Non-standard Frontend & Backend development | I | R | I | ||
1.3 | Apply Drupal core and contributed module security updates | I | I | R | ||
1.4 | Deploy application to development environment for review and testing | I | R | |||
1.5 | Deploy application to Stage environment for review and testing | I | R | |||
2 | Quality Assurance (QA) Testing (Hosting Staging Environment) | |||||
2.1 | Complete frontend and backend application testing | R | R | |||
2.2 | Identify and address QA issues | I | R | |||
2.3 | Code Review | I | R | I | ||
2.4 | Drupal configuration review | R | I | |||
2.5 | Code and configuration audit report | I | R | C | ||
2.6 | Application updates to meet Acquia environment best practices and Drupal 10 coding standards | I | I | R | ||
2.7 | Revisit QA test plan and confirm release candidate for production | A | R | |||
2.8 | OWASP top 10 penetration testing | C | R | C | I | I |
3 | Deployment/Testing (Hosting Production Environment) | |||||
3.1 | Deploy application to Production environment | A | I | R | I | |
3.2 | Post deployment QA testing | I | R | R | ||
3.3 | OWASP top 10 penetration testing | C | R | C | I | I |
4 | Reporting | |||||
4.1 | Functional specification document and/or annotated design/flowchart | A | I | I | R | |
4.2 | Website tracking and reporting | C | I | I | R |
R = Responsible, A = Accountable, C = Consult, I = Inform
Task Details
Hosting Environment | |
---|---|
Hosting environment request | Motionstrand to setup a web application environment to be added to Client Hosting subscription. |
Identify hosting environment requirements | Motionstrand to determine application upstream type (Drupal, WordPress, or Custom). Review application and production server requirements. Approve associated costs. Site plan - https://pantheon.io/docs/site-plans-faq#plan-resources Custom Upstreams - https://pantheon.io/docs/guides/custom-upstream |
Hosting environment provisioning | Motionstrand team provisions new environment for use on the Hosting subscription. The production environment will not be activated until the web application is ready for production. No additional costs are associated until the production environment is enabled. |
Assign developer(s) to environment | MOS hosting administrators will provide developer(s) access to the appropriate Hosting environment. Each developer will need to create their own Hosting account so all changes can be tracked. Shared accounts are not allowed. |
Web Application Development | |
---|---|
Install and configure Drupal, WordPress, or Custom upstream | Begin developing the application within the Hosting development environment. Drupal - https://docs.pantheon.io/drupal-10 or https://docs.acquia.com/acquia-cloud-platform/create-apps/install WordPress - https://pantheon.io/docs/WordPress-best-practices Custom - https://pantheon.io/docs/guides/custom-upstream |
Frontend & Backend development | All code committed to Hosting is required to meet Client's coding standards documented here. Coding standards apply to all code within the application, its contributed modules/plugins, and custom modules/plugins. |
Non-standard Frontend & Backend development | Any code that does not meet Client's coding standards and/or Drupal/WordPress development best practices should be identified and include a description detailing the reason for objection. |
Committing Code | All code must be committed to the Hosting GIT Repository for version control tracking. All code must be committed to a topic branch. All application environments are to be kept in GIT mode. Hosting best practices and Client GIT coding standards are to be followed. https://pantheon.io/docs/code https://docs.acquia.com/acquia-cloud-platform/develop-apps/repository/git |
Apply security updates | Apply any available Drupal/WordPress core or contributed module/plugin security updates released by the associated security team. https://www.drupal.org/security https://wordpress.org/about/security/ |
Deploy application to Stage environment for review and testing | Move application to the Hosting Stage environment to conduct quality assurance (QA) testing. |
Quality Assurance Testing / Updates | |
---|---|
Complete frontend and backend application testing | Create an application testing plan in a format that can be easily updated and shared across multiple teams to accommodate current and future application requirement testing. All frontend and backend functional/visual requirements and devices/browsers should be accounted for in the test plan. |
Identify and address QA issues | Ensure all issues identified have been resolved, tested, and updated within the application test plan. |
Code Review | Notify Motionstrand to request a review of the application release candidate within the Hosting multidev staging environment. |
CMS configuration review | Motionstrand to review Drupal or WordPress configuration settings to ensure best practices for applications hosted within the Hosting environment |
Code and configuration audit report | Motionstrand to provide an audit report identifying any updates required for compliance with Client coding standards and Drupal/WordPress development best practices. |
Address issues identified within the audit report | Application updates to meet Hosting environment best practices and Client Coding standards. |
Revisit QA test plan and confirm release candidate for production | If any code or configuration updates were made revisit all tasks within section 3 of the RACI. |
OWASP top 10 penetration testing | Client IT to initiate OWASP top 10 penetration test and report any issues identified. |
Deployment/Testing | |
---|---|
Setup application domain(s) and SSL certificate | Work with Client IT and ThreatX teams to generate an SSL certificate for production domain(s). Configure domains and install SSL certificate within the Hosting Production environment. |
Deploy application to production environment | Deploy application to Hosting production environment |
Configure domain DNS settings | Complete DNS updates to direct domain(s) to the associated Hosting application. |
Enable server performance monitoring | Enable New Relic server performance monitoring on production environment. |
Post deployment QA testing | Revisit QA test plan within Hosting production environment. |
OWASP top 10 penetration testing | Client IT to initiate OWASP top 10 penetration test and report any issues identified. |
Reporting | |
---|---|
Functional specification document and/or annotated design/flowchart | Provide documentation that identifies the application functional and visual configurations in a version controlled format. Any updates to the application should be highlighted and saved as a new version of the document(s). |
Website tracking and reporting | Website tracking (i.e. Google Analytics and custom event KPI's) scripts are enabled and reporting analytics. |