Plan the quarter in six passes: inventory what you run, rank risks, set capacity, assign owners, check your safety net, and schedule a closing review. Work through the list in a single planning session of about two hours. Anything you cannot answer becomes a first-week task.
1. Inventory
- Fresh SBOM or dependency list exists for every deployable service.
- Runtimes, base images and package managers are listed alongside libraries.
- Shared internal libraries are mapped to their consumers.
- Known forks and local patches are recorded.
Our guide to building a backlog from an SBOM shows how.
2. Rank the risks
- End-of-support dates inside the next two quarters are listed, from each project's own published policy.
- Advisories with fixed versions are matched to your versions.
- Reachability is checked for the advisories that matter most.
- Unmaintained packages are flagged, see a quarterly maintained check.
- Each item has a risk level and an effort size, using a simple matrix.
3. Set capacity
- A planned upgrade slice is set from last quarter's actual hours.
- A separate buffer for unplanned security work is named.
- Holidays, freezes and planned launches are on the calendar.
- The cut line is drawn, and everything below it is on a deferred list with a reason.
4. Assign owners
- Every upgrade unit has a team owner and a date.
- A rotating weekly owner is named for bot pull requests and advisories.
- Cross-team upgrades have a dated train, not a hope.
5. Check the safety net
- Smoke tests exist for critical paths.
- Staged rollout and rollback steps are written down.
- A definition of done for upgrade tickets is in the template, see the seven-point version.
- Big majors have a timeboxed spike scheduled before commitment.
6. Close the loop
- A mid-quarter checkpoint is booked.
- A closing retro is booked.
- The slide for leadership is drafted, with one decision request.
- The deferred list will be reviewed at the next planning session.
Common ways this goes wrong
| Mistake | Fix |
|---|---|
| Plan fills 100 percent of capacity | Leave the buffer visible |
| Everything is high priority | Force a cut line |
| No owner on shared libraries | Name the owning team |
| Spike skipped for a major upgrade | Schedule it before committing |
How to use the checklist
Print it or paste it into the quarter's epic. Tick items as you go. The goal is not perfection but visibility: when someone asks why an upgrade is not in the quarter, you can point to the line where it was ranked and the reason it fell below the cut.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how findings are triaged and prioritised, which maps to pass two of the checklist.
Where Safeguard fits
Safeguard covers several passes here: SBOM and dependency scanning for the inventory, reachability analysis for ranking, and policies and gates for keeping merges consistent. You can run a free scan at gold.safeguard.sh/scan.
Quick check
How long should planning take?
About two hours for a team that keeps an inventory current. The first quarter takes longer because you build the inventory.
Can this work for a team of three?
Yes. Trim items that do not apply, such as cross-team trains, and keep the rest.
Last reviewed: 19 October 2026.
