CYBER LIBRARY
Explore the bootcamp
Making change happenIntermediate

Definition of Done

A shared quality threshold makes completion transparent.

3 min readUpdated 12 Oct 20265 connections
Markdown

The idea

In Scrum, the Definition of Done describes the quality requirements that an Increment must satisfy. It creates a shared understanding of completed work. Teams may include testing, security checks, documentation, and integration requirements as appropriate. Acceptance criteria describe specific item behavior, while Done expresses the shared quality standard. Unfinished work should not be represented as a usable completed Increment.

In practice

A team’s Done criteria require code review, passing relevant tests, deployment readiness, and updated operating guidance before claiming an improvement is finished.

A common misunderstanding

Acceptance of one example does not automatically satisfy every shared quality requirement.

Check your understanding

Why separate item criteria from the Definition of Done?

Think it through: They address different levels: the specific behavior and the common quality threshold.

Make completion comparable across work

A shared completion threshold prevents one person from calling code finished while another expects tests, review, documentation, and deployability. The exact threshold should fit the product and organization. It must be explicit enough that unfinished quality work cannot disappear behind a positive status label. Passing a functional demonstration alone may be insufficient.

Security expectations belong in normal delivery where they are applicable. A change involving access decisions may need authorization tests and a review of audit behavior. A documentation-only change may need a different form of verification. The shared standard can define required categories while allowing the relevant evidence to vary by the nature of the work.

A fictional hidden backlog

A team calls several access-service features done because their screens work. Later, it discovers missing negative tests, unclear operational instructions, and unreviewed permission checks. The remaining effort is substantial even though the task board showed completion. A clear threshold would have kept that work visible at the time the features were discussed.

Improving the threshold may reveal existing gaps. That does not mean all historical work instantly satisfies the new standard; the team needs a transparent plan for addressing relevant unfinished quality. A threshold should improve the truthfulness of completion claims, rather than merely add a new document nobody checks.

Draft evidence requirements

For a fictional access-request application, write a small set of completion conditions covering behavior, review, testing, and support information. For each, specify what evidence would demonstrate it. Then apply the conditions to one sample change and identify what remains unfinished. Distinguish the shared quality threshold from that feature's particular acceptance criteria so both can be evaluated clearly.

Keep exploring

GO TO THE SOURCE

References & further reading

Original explanations, with primary references for deeper study.

The official Scrum Guide
EXPLORE THIS IDEA’S CONNECTIONS

A small part of a bigger picture.

4 notes · 3 connections
100%
Definition of Done · depth 1
Drag to pan · Pinch or use +/− to zoom · Click to preview · Double-click to read
Browse notes as a list (4)
FOLLOW ANOTHER THREADExplore the rest of the library
Start with a concept. Follow its connections.
Detection & responseAbuse Elevation Control MechanismElevation-control abuse bypasses or misuses mechanisms governing privileged execution.Making change happenAcceptance criteriaDefine observable conditions for a deliverable to be accepted.Security essentialsAccess controlUnderstand subjects, resources, permissions, and enforcement through a shared-drive example, including how access changes over time.Detection & responseAccess Token ManipulationAccess token manipulation changes or adopts operating-system security contexts.Risk & resilienceAccount Access RemovalAccount access removal disrupts legitimate users by changing, deleting, or restricting their identities.Evidence & investigationAccount DiscoveryAccount discovery enumerates identities available in a system or environment.Detection & responseAccount ManipulationAccount manipulation changes identity settings to preserve or expand access.Adversarial thinkingAcquire InfrastructureInfrastructure acquisition obtains domains, servers, or other resources used to support operations.Adversarial thinkingActive ScanningActive scanning probes target infrastructure to learn reachable services or weaknesses.Security essentialsAdversary in the middleAn intermediary may observe or alter a communication path.Security essentialsAESA symmetric block cipher whose safe use depends on its mode and implementation.Making change happenAgile deliveryUse short feedback cycles to adapt toward a useful outcome.