Goal
Keep the product healthy after handover: fix defects under warranty, handle incidents by the book, patch regularly.
Inputs → outputs
Inputs
- Handover record, SLA, runbook
- Monitoring and alerting
Deliverables
- SLA (severity levels, response times)
- Incident log & postmortems
- Periodic maintenance report
Teams & roles
- Support & Customer Successintake, triage, client communication
- DevOps / SREincident handling, monitoring, backups
- Engineering (FE · BE · Mobile)warranty fixes
- Application Security (AppSec)security patches, CVE tracking
- Project Management / Scrum Mastermaintenance reports, renewals
- Client (Product Owner / sponsor)reports incidents, decides on renewal
RACI matrix
R — does the work · A — accountable, final sign-off (exactly one A per activity) · C — consulted before · I — informed after.
| Activity | PM | Dev | QA | Sec | Ops | CS | Client |
|---|---|---|---|---|---|---|---|
| Intake & triage of requests / incidents | · | · | · | · | C | A | R |
| Resolve incidents within SLA | · | R | · | · | A | C | I |
| Warranty defect fixes | · | A | R | · | · | · | · |
| Blameless postmortem | C | R | · | · | A | · | I |
| Routine updates & security patches | · | R | · | A | R | · | · |
| Periodic maintenance report | A | · | · | · | · | R | I |
PM = Project Management / Scrum Master; Dev = Engineering (FE · BE · Mobile); QA = Quality Assurance (QA/QC); Sec = Application Security (AppSec); Ops = DevOps / SRE; CS = Support & Customer Success; Client = Client (Product Owner / sponsor)
Quality gate
Warranty ends: move to a maintenance contract or close formally.
Entry criteria
- Handover record signed
- Intake channel and SLA in force
Exit criteria
- Warranty period over, no open warranty defects
- Warranty summary report sent
- Client decided: renew maintenance, transfer, or decommission
Activities
- 1.Contractual warranty period (defects against spec fixed free)
- 2.Take incidents by severity; respond and resolve within SLA
- 3.Blameless postmortem after every major incident
- 4.Dependency updates, security patches, cert / domain renewals
- 5.Periodically verify backups by actually restoring
Checklist
Tick to self-review — 0/6. Ticks stay in this browser only and are not sent anywhere.
Document templates
Markdown (.md) files: open in any editor, or paste into Word / Google Docs. Each states its purpose, who fills it in and when.
Client involvement
- Report incidents via the agreed channel, with screenshots / repro steps
- Decide on a maintenance contract after warranty
Tools
- Sentry
- Uptime monitor
- Dependabot
- Status page
Reference standards
- NIST SP 800-61 Rev. 3
- Incident response recommendations
- ISO/IEC/IEEE 14764:2022
- Software maintenance processes
- ITIL® 4 — Incident management
- Log, classify and restore service
Common pitfalls
- Not separating warranty defects from new requests
- Hot-fixing production outside the process
- Postmortems that blame individuals
- Forgetting disk / log cleanup → incidents
Real example
cuongthai.com: a weekly workflow reclaims VPS disk space — added after a disk-full incident stopped PostgreSQL. The secrets it uses are documented as "do not delete", because deleting them would silently kill the cleanup and bring the old incident back.
Where to learn
Subjects and courses on cuongthai.com that teach this stage’s work.