Define secure release governance and rollback procedures
Implementation Effort: Medium – Configuring deployment approvals, security gates, release manifests, and tested rollback procedures is a multi-step effort coordinated across release and platform teams. User Impact: Low – Release governance and rollback controls apply to deployment pipelines and approvers; end users are not affected. Lifecycle Stage: Deploy
Overview
Define a formal release governance and rollback process for production deployments, with approvals, security gates, artifact traceability, and tested rollback steps.
Without formal release governance, deployments happen through informal processes and the organization discovers problems only after they reach users. In a Zero Trust context, every production deployment is a trust decision that should be explicitly verified rather than implicitly assumed safe because it passed a CI pipeline.
Use platform-native controls to enforce that model. In GitHub, configure environment protection rules for production environments that require designated reviewers, restrict which branches can deploy, and enforce wait timers or required checks before deployment.
In Azure DevOps, distinguish between platform models: if you still use Classic Release pipelines, configure approvals and gates; for YAML pipelines, use Environments with Approvals and checks such as manual approvals, branch control, business hours, and REST or Azure Function checks. Maintain a release manifest that records the exact artifact version, Git commit SHA, approver identity, artifact attestation or provenance record where available, and timestamps of all gate evaluations so each deployment can be traced back to the approved build input.
Define explicit rollback criteria — such as error rate thresholds, health probe failures, or critical security alerts — and document the rollback procedure for each production platform. The rollback plan should identify the last known-good artifact, where it is stored, how to verify its provenance, and how to redeploy it safely.
Test rollback procedures periodically so the organization can revert to a known-good artifact under pressure without improvisation. Gating each release behind approvals and security checks supports Verify explicitly, while maintaining and testing rollback procedures supports Assume breach by ensuring the organization can recover quickly when a deployment proves harmful.