Engineering and Security Staging Review | Collaboration cycle

Last updated: October 26, 2026

Waiver available: No

Recommended timing: Schedule once your product is production-ready and all required artifacts are complete

How this touchpoint helps you, VA, and Veterans

An Engineering and Security Staging Review is your last checkpoint before launch. Use it to confirm your product meets the Platform QA Standards, and Engineering and Security Standards — before Veterans use it. This gives you one more chance to catch issues before Veterans use your product, so you can launch with confidence.

This touchpoint is required for any product that does not result in visible changes to the Veteran experience or is built for Organizations.

This isn’t the right review for you if:

You're making changes Veterans can notice. Instead, complete a Staging Review.

Not sure which applies? Review the touchpoint flowchart or tag @platform-governance-team-members in your team's Slack channel.

No GitHub ticket yet? Start with a Collab Cycle kickoff first.

What you need to bring

Complete these artifacts before you schedule your Staging Review meeting. They’ll need to be complete and unchanged while the Platform conducts their review (4 working days before your meeting).

Engineering and Security Staging Review artifacts

Artifact	Required?	What to include
Engineering Launch Plan	Required	The Collab Cycle Engineering Launch Plan is the primary engineering documentation for Staging Review. In this document you will describe project context, engineering and architectural changes, data flows and handoffs, and add links to specific diagrams, documentation, and plans for testing, monitoring, and more.
Pull Requests for this work	Required	List all PRs created for this work
Scoped code links	Required	Provide links to relevant code changes
System / Backend flow diagrams	Required	Link diagrams showing backend logic, data flow, or system interactions
Incident response plan	Required	Link or description of your Incident response plan
Functional monitoring dashboards	Required	Provide links to monitoring dashboards
QA Artifacts	Required	Three standards apply to backend-only work: Test Plan, Endpoint Monitoring, and Logging Silent Failures. The other QA standards don't apply.
Updated release plan	Required	Link to your updated release plan with all sections complete
Product access instructions	If applicable	Direct link or instructions for accessing your product in staging. Required if FE surfaces are impacted by engineering changes (e.g., API changes, FE error handling) Link to production, if this work is already released and the staging environment includes unreleased work.
Test users	If applicable	Only required if FE surfaces are impacted by engineering changes
Figma mockups	If applicable	Only required if FE surfaces are impacted by engineering changes

You’re ready for this touchpoint when

All other touchpoints have been completed
Your product is ready to launch
All test scenarios can be successfully navigated
Required artifacts (listed above) are ready

How to schedule your review

Create a ticket
Click "Initiate an Engineering and Security Staging Review" in your Main Collab Cycle ticket to generate an Engineering and Security Staging Review GitHub ticket
Add your artifacts
Add links to your artifacts in your Engineering and Security Staging Review GitHub ticket before scheduling your meeting
Book a time
Click the Calendly Engineering and Security Staging Review calendar link in your GitHub ticket when you’re ready to schedule

Anyone on your team can do this — no specific role is required.

How to prepare for your review

Test your scenarios first — an untestable scenario may cancel your review
Do not merge changes to VA.gov or test users for 4 working days before your meeting while Platform conducts its review
Confirm your product is live on an approved staging environment

What happens during the meeting

Format: 30-minute Microsoft Teams meeting, hosted by the Platform Engineering Team and recorded

Who should attend: Your product manager, Gov Lead, and anyone who contributed to the artifacts

Who else attends: Relevant Platform participants and Gov Leads, invited by the Governance Team

Agenda:

Welcome and team updates
Platform Engineering and Security findings
Launch-blocking tickets, if any
Non-launch-blocking tickets, time permitting
Your questions

What to expect: Top findings are shared live.

Two types of findings:

Launch-blocking — must fix before launch. Examples: QA standards issues, missing endpoint monitoring, security findings.
Non-launch-blocking — worth fixing, doesn't stop launch. Examples: typos, inconsistent link behavior.

Too many findings? At 25+ total or 10+ launch-blocking, we'll pause, share what we found, and ask you to schedule a second Staging Review.

What happens after the meeting

A link to the recording will be available when you sign-in to Teams with your PIV card. If you don’t see it, tag @platform-governance-team-members in your team's Slack channel.
Engineering and Security feedback will be added as a comment on your GitHub ticket by end of day.
Fix all launch-blocking findings before you launch.
If a second review is required, resolve as much as you can and retest thoroughly before rebooking.

Waiver process

A waiver is not available for Engineering and Security Staging Reviews. Every team whose work does not result in visible changes to the Veteran experience or is building for Organizations must complete this touchpoint before launch.