Ensure every product has a backlog

[ryanwoldatwork]

Every GSA web product being developed or in production should have a backlog.

Security scans occur against systems that are online, regardless of the how a product is staffed. Security scan findings are tracked by specific tools and in other organizational lists, but ultimately, each scan finding that requires work should be tracked in a Product Backlog.

Without a backlog:

• How is a team to account for their work to be done (or technical debt)?
• How is the product organization to estimate the resources/assets required to pay that debt?
• How does the organization to assess whether to pay that debt?

---

Acceptance criteria

Given I'm logged into Touchpoints Website Inventory at https://touchpoints.app.cloud.gov/admin/websites When I view a list of all websites And I download that list And I view it in a spreadsheet Then all "active" websites have a valid URL indicated in the "repository url" field of Touchpoints Website Inventory.

For exceptions, note this in the Website "notes" field.

[ADean27]

are we defining "product" as "web site or service?"

[ryanwoldatwork]

Yes,

Websites are products. Digital services (provided via websites) are also products.

Services provided in-person may not be a product itself, but typically generate one or more products (an ID card, an approval of a policy, etc)