CYBER LIBRARY
Explore the bootcamp
Making change happenBeginner

Acceptance criteria

Define observable conditions for a deliverable to be accepted.

3 min readUpdated 12 Oct 202611 connections
Markdown

The idea

Acceptance criteria state what a result must satisfy for the appropriate owner to accept it. They should be specific, testable, and linked to the intended outcome. Include functional, security, operational, and accessibility needs where relevant. Agree criteria early and refine them transparently as requirements change. They are different from merely reporting that implementation work finished.

In practice

A knowledge library’s criteria include working concept links, usable mobile navigation, valid metadata, readable content, and a repeatable publishing process.

A common misunderstanding

“Looks good” can be useful feedback, but it is not a sufficient criterion for important security behavior.

Check your understanding

Who should accept a deliverable?

Think it through: The designated owner or authority who can evaluate the agreed criteria and take responsibility for the result.

Replace adjectives with observable conditions

Acceptance criteria describe what a particular deliverable must satisfy for the relevant stakeholder to accept it. Words such as secure, fast, and user-friendly express intentions but leave room for disagreement. Translate them into conditions that can be evaluated in the actual environment. Some conditions require a test; others require an approved record, a demonstration, or an operational handoff.

For an administrator access workflow, useful criteria could include rejecting an unapproved request, recording the approver, limiting the granted role, and allowing the service owner to review current access. The exact conditions depend on the intended use and risk. Avoid prescribing a specific implementation unless that technology is genuinely required. The criterion should usually describe the result.

A fictional late disagreement

A team demonstrates a new backup configuration and expects acceptance because scheduled jobs succeed. The application owner expected proof that the service can be restored to usable operation. Both parties used the word working while meaning different things. Agreeing on restore validation before implementation would have exposed this difference when it was cheaper to resolve.

Acceptance is also distinct from general quality requirements. A shared Definition of Done can apply across many deliverables, while acceptance criteria describe the particular behavior of this one. A feature might satisfy its functional example yet still fail the team's required review or documentation threshold. Both perspectives can be necessary.

Write a testable condition

Take the phrase alerts should be useful and rewrite it for a fictional administrator sign-in alert. Specify the event, the information available to the responder, and the expected routing. Include one negative case, such as an approved test event that should be handled according to a documented rule. Ask another learner to explain how they would decide whether each condition passed.

Keep exploring

GO TO THE SOURCE

References & further reading

Original explanations, with primary references for deeper study.

UK Government: Project Delivery Functional Standard
EXPLORE THIS IDEA’S CONNECTIONS

A small part of a bigger picture.

9 notes · 10 connections
100%
Acceptance criteria · depth 1
Drag to pan · Pinch or use +/− to zoom · Click to preview · Double-click to read
Browse notes as a list (9)
FOLLOW ANOTHER THREADExplore the rest of the library
Start with a concept. Follow its connections.
Detection & responseAbuse Elevation Control MechanismElevation-control abuse bypasses or misuses mechanisms governing privileged execution.Making change happenAcceptance criteriaDefine observable conditions for a deliverable to be accepted.Security essentialsAccess controlUnderstand subjects, resources, permissions, and enforcement through a shared-drive example, including how access changes over time.Detection & responseAccess Token ManipulationAccess token manipulation changes or adopts operating-system security contexts.Risk & resilienceAccount Access RemovalAccount access removal disrupts legitimate users by changing, deleting, or restricting their identities.Evidence & investigationAccount DiscoveryAccount discovery enumerates identities available in a system or environment.Detection & responseAccount ManipulationAccount manipulation changes identity settings to preserve or expand access.Adversarial thinkingAcquire InfrastructureInfrastructure acquisition obtains domains, servers, or other resources used to support operations.Adversarial thinkingActive ScanningActive scanning probes target infrastructure to learn reachable services or weaknesses.Security essentialsAdversary in the middleAn intermediary may observe or alter a communication path.Security essentialsAESA symmetric block cipher whose safe use depends on its mode and implementation.Making change happenAgile deliveryUse short feedback cycles to adapt toward a useful outcome.