When a security fix competes with a feature, write a one-page memo with the risk, the options, the cost of each and a named decider. Present it before the meeting. The memo turns an argument about values into a choice between stated options, and it leaves a record you can revisit.
Why a memo beats a meeting
Verbal debates favor whoever speaks loudest and whoever has the nearest deadline. A written memo forces both sides to state facts and gives the decider something to approve. It also protects the engineering manager: if the decision is to defer, the reasons and the owner are on paper.
Keep it to one page. If it cannot fit, the question is not yet clear.
The template
Copy this structure.
1. Decision needed. One sentence, with a date. Example: "Decide by Friday whether to ship the export feature this sprint or patch the file upload library first."
2. The risk. What can go wrong, where, and who is affected. State whether the weakness is reachable, whether exploitation is known, and what an attacker gains. Separate facts from judgment.
3. The feature. What it delivers, who is waiting, and what a delay costs in business terms.
4. Options. At least three, in a table.
| Option | Security effect | Feature effect | Cost | Residual risk |
|---|---|---|---|---|
| A. Fix first, feature next sprint | Risk removed this sprint | Delayed one sprint | One sprint of one engineer | None expected |
| B. Ship feature, fix next sprint | Risk remains for a sprint | On time | Same, in other order | Exposure for a sprint |
| C. Ship both, reduced scope | Risk removed | Smaller first release | Extra coordination | Low |
5. Recommendation. One option, with the reason in two sentences.
6. If we defer. Compensating controls, a review date, and who owns the follow-up. See what fields belong in a risk acceptance record.
7. Decider and date. One name, not a committee.
Fill in section two carefully
This is where memos go soft. Resist adjectives like "critical" without evidence. Use specific signals. Is the vulnerability on the CISA Known Exploited Vulnerabilities catalog? Is the exploit probability high on EPSS? Is the vulnerable code called by your application? A reachability finding can change the whole decision, as described in can reachability analysis justify a risk acceptance.
Fill in section three honestly
Do not minimize the feature. If sales has a signed customer waiting, say so. The memo only works if the product side sees their case stated fairly. An unfair memo gets ignored the next time.
After the decision
File the memo with the ticket. Set a calendar reminder for the review date. If the decision was to defer, check that the compensating controls are actually in place before closing the loop. If the same trade comes up three times, you have a capacity problem, not a decision problem, and the answer is a reserved slice, as in how much sprint capacity to reserve for security work.
Safeguard's policies and gates can record which findings blocked a release and which were waived, which gives the memo a factual attachment. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Who should make the decision?
One accountable person with authority over both the product and the risk, often a director or product lead, with security input. Avoid committees.
Should the memo always recommend the fix?
No. It should recommend what the evidence supports. Sometimes shipping with a compensating control and a dated follow-up is the right call.
Last reviewed: 19 October 2026.
