One of the most interesting parts of becoming a Documentation Lead in the cybersecurity field is how documentation is implicitly part of the definition of “done”.
What do I mean by this?
Many companies see the release cycle as something akin to this:
Plan -> Implement -> Send out Communications -> Release | Create Docs
Creating the docs sits outside the process. It isn’t a blocker.
It is a cycle I am sure many of my #technicalwriting colleagues across industries will relate to. You get told that Product is releasing X feature by Y date. You log it, add the Product Manager to the task, set the deadline, and wait. Suddenly, the release is fast approaching, and you haven’t heard anything from the team leading the product release. It isn’t malicious; they just don’t see docs as a priority. More often than not, by the time the doc is finalized you have passed the release date. The most infuriating part? You know the docs are heavily used. Everything is trackable. Docs are essential to the self-serve experience (from human to AI use). Yet every time a release is announced, the cycle continues.
But when documentation becomes part of the definition of done, it looks more like this:
Plan -> Implement -> Create Docs -> Send out Communications -> Release
This is the cycle I experienced coming into the #Sophos MDR service. It is a culture that not only values the documentation, but also understands how it should fit into the release cycle. I do not need to chase Leads down to get docs drafted, because they understand that without the docs, there are Analysts who might be left without answers to their questions when they are sitting in front of the product and time is of the essence. They know Trainers are using this to onboard. They know other Leads are using it to learn the proper procedures for their team. Ultimately, they know everything just works more efficiently when docs are available.
But in the end, this isn’t unique to cybersecurity. Across each industry, people rely on the docs to understand the product, troubleshoot, power their agents, and so on.
And that is what it always comes down to, isn’t it?
Documentation should always be part of the definition of “done”, whether or not a company’s process formally treats it that way.
Because without the docs, without the information available at release time, you are leaving too much to chance. When people need answers to questions, they should not need to open Teams or Slack to write out the question and hope the answer comes down the pipe before they miss their SLA. It should be there, waiting for them, ready regardless of whether they are manually searching using the doc repository or chatting with their preferred AI agent.
How does your company see docs?
Leave a Reply