Tech Strategy Questions
This is a list of questions to ask yourself/the team when developing your overall tech strategy.
Additional pages can be linked to each question with a breakdown of considerations.
Some of these questions will have different answers for different applications or functions. That is ok.
Organisational
- Where does the product org sit?
- How do product squads manage cost (including infrastructure)?
- What is your communications plan?
- Who are your most important stakeholders?
- How are projects managed?
User Interfaces
- Mobile application or responsive web only (if applicable)?
- Customer-facing web application?
- Internal web application?
- Any thick clients?
Application Technology Stack
- Which languages are recommended?
- Which languages are allowed?
- “Full stack cloud” or cloud agnostic approach to application building?
- What degree of granularity for microservices (if at all)?
- Functions as a service (“serverless”) or Docker based?
- Are low/no-code interfaces feasible?
- What API gateway to use?
- What identity provider to use?
- How will you conduct A/B experiments?
- Centralized content management system vs separate for marketing vs platform?
Infrastructure Technology Stack
- Which cloud or hosting provider?
- Which physical regions to use?
- How are the infrastructure accounts structured (domain, environment, etc)?
- “Full stack cloud” or cloud agnostic approach to infrastructure provisioning?
- Which Infrastructure as Code provider?
- What is your tagging policy/nomenclature?
- Which core server OS to build on?
- What is the backup policy and tool?
- Multi-tenanted or single-tenanted?
Data Stack
- What is your operational database stack?
- What is your data warehouse/lake stack?
- How will you feed data to your data warehouse?
- What feed quality/timeliness checks will you include?
- How will the data dictionary be maintained?
DevSecOps
- Which application CI/CD pipeline to use?
- Which security scanning tool to use?
- Which open source vulnerability scanner/manager to use?
- Which secrets/keys scanner to use?
- Which mobile deployment/release management tool to use?
- Which build tools to use?
- What is the patch management policy, and which tool to use?
- What is the branching/code review strategy?
- How will automated testing be integrated?
- How are keys & secrets managed?
Security & Compliance
- What is your security risk appetite?
- What compliance standards and regulations will you adhere to?
- How often will you run pen tests?
- What automated intrusion tests will you run?
- What SIEM tool will you use (if any)?
- What cloud misconfiguration checker will you use?
- Can staff and vendors access systems without VPN/VDI?
- What is the key/secret rotation policy?
- What tool are you using for privileged access management (if any)?
- What is your change management process?
- What is your data classification policy and retention for each?
Alerting & Monitoring
- Which centralised logging tool?
- Which alerting/escalation tool?
- What will you monitor?
Business Continuity
- What are your Recovery Time Objective, Recovery Point Objective and Maximum Tolerable Downtime metrics?
- Will blue/green deployments be used for maintaining uptime?
Developer Experience
- Which IDEs are allowed?
- Which AI-assistants are allowed from a security perspective?
IT
- Will you support hybrid or remote work?
- What tools to manage distributed assets?
- What policies are agreed and what’s the review process?
- How are assets budgeted for?
- How are assets managed and procured?
- How will you manage, mitigate and eliminate shadow IT?