Skip to content

Worksheets

Worksheets are the practical counterpart to the roadmap. Each one is a runnable meeting agenda. A facilitator opens the page, shares it on screen, and works through it with the right people in the room.

How to use a worksheet

Every worksheet follows the same structure:

  1. Pre-work: who to invite, what to read, what to bring.
  2. Agenda: a time-boxed structure (usually 60–120 minutes).
  3. Discussion prompts: the specific questions the group must answer.
  4. Outputs: what the worksheet produces, including the Decision Record fields that must be filled in.
  5. Follow-ups: what happens after the meeting, and by when.

Size-agnostic by design

Every worksheet is written to work for companies of any size. Callouts labelled "sizing" explain how to scale up or down. For a 20-person company, a worksheet is typically a 30-minute conversation; for a 10,000-person enterprise, the same worksheet may span multiple sessions with formal sign-off.

The foundational template

Start here if you've never run one of these before.

Phase 0: Readiness worksheets

Run these during the 2–6 weeks before the pilot begins.

Worksheet Duration Who attends Output
Leadership charter 60 min Exec sponsor, CTO/CIO, CISO, Head of Eng, Legal Signed one-page charter + DR
AUP drafting 90 min CISO, Legal, Privacy, 2 senior engineers, 1 tech lead Interim AUP v0.1 + DR
Risk classification workshop 120 min Architecture, Security, Data Protection, business-unit reps Tiered system list + DR
Incident tabletop 120 min IR lead, CISO, Legal, Comms, Eng Updated IR runbook + DR
Metrics baselining 90 min DevEx / Platform, Eng Management, SRE Baseline snapshot + gap list + DR

Phase 1: Pilot worksheets

Run these during the 90-day pilot.

Worksheet Duration Who attends Output
Pilot scope 60 min Exec sponsor, pilot team lead, CoE (or equivalent), Security, DevEx Scope statement + success criteria + DR
Vendor selection 90 min Procurement, CISO, Legal, CoE Lead, Eng rep Completed scorecard + DR
Training needs 60 min Training/enablement owner, tech leads, AppSec Curriculum plan + DR

Phase 2–3: Scale & Optimize worksheets

Run these as you expand and settle into steady state.

Worksheet Duration Who attends Output
SDLC mapping 90 min CoE, Eng Leads, DevEx, AppSec AI-integration map across the SDLC + DR
Pilot retrospective 120 min Pilot team, sponsor, CoE, Security Go/no-go recommendation + DR

Anatomy of a good worksheet session

Across all worksheets, a few ground rules improve the quality of the output:

  • Scribe ≠ facilitator. The facilitator runs the meeting; a separate person drafts the Decision Record live. The chair who also takes notes misses half the room.
  • The "do nothing" option is mandatory. Every decision must compare the chosen path against explicitly not acting. If "do nothing" is worse, record why. That is the evidence for the decision.
  • Absent owners → deferred decisions. If a required sign-off party is not present or represented by a delegate with authority, defer the decision. Don't create a DR you can't sign.
  • Document dissent. If a participant disagrees with the decision, record it in the DR. It does not block the decision, but it is essential context for reviewers and auditors.
  • End with a clear next meeting. Every worksheet produces at least one follow-up action with an owner and a date.

Using worksheets outside the phases

Worksheets can also be triggered by:

  • Incidents. After any AI-adjacent incident, re-run the Incident tabletop with the specific scenario loaded. Every 6 months at a minimum.
  • Vendor changes. Any vendor rename, acquisition, pricing shift, or material terms change triggers the Vendor selection worksheet against the current shortlist.
  • Regulatory changes. EU AI Act staging, sector rule updates, or new guidance (NIST, ENISA) trigger an AUP review via AUP drafting applied as a revision.
  • Team scaling. A new business unit onboarding triggers a Training needs session for that unit, even in Phase 3.

Next