Damian Flynn · Nothing has been written to Jira yet — all content is for review.
ETAT holds 735 issues total — 165 are active (non-Done). They span network security, monitoring, cost, migrations, and governance. No initiative grouping means no way to prioritise across workstreams.
| Signal | Detail |
|---|---|
| 4 ex-team members | Simen Hjelle, Kenneth Hansen, Malin Synnes, Haakon Baglo — all left Innofactor |
| Orphaned in-flight work | ETAT-15 (monitoring), ETAT-227 (MMA→AMA) — abandoned mid-task |
| Deadline breached | MMA deprecated Aug 2024 — 19 months past end-of-support, no replacement confirmed |
| No prioritisation framework | Backlog, Up Next, In Progress, Proposal — all mixed without Initiative context |
| Phase 1 | 165 ETAT active issues enumerated across 4 pages — complete inventory |
| Phase 2 | Issues grouped by theme → 7 Initiatives, 20 Epics (human clustering, not automated) |
| Phase 3 | Each issue assigned a Disposition: Story / Review / Escalate |
| Phase 4 | Product Requirement Docs written for all 7 Initiatives — scope, success criteria |
| Phase 5 | PRD vs backlog gap analysis → 1 new Epic (E2.4), 25 new Stories identified |
| Phase 6 | Escalate items split into Discovery + Remediation tickets, ready to create in NOSD |
Output: this staging branch — ready for team triage, then Jira import
| Initiative | Theme | Epics | Issues | Horizon |
|---|---|---|---|---|
| INIT-1 Secure the Platform | Network, IAM, Defender, Secrets | E1.1–E1.4 | 44 | Q1–Q3 |
| INIT-2 Operate Reliably | Monitoring, Alerting, BCDR, SRE | E2.1–E2.4 | 57+ | Q1–Q4 |
| INIT-3 Modernise Infrastructure | IaC, Pipelines, Fed Creds | E3.1–E3.3 | 11 | Q1–Q4 |
| INIT-4 Optimise Cost | Rightsizing, Test Cost, Decommission | E4.1–E4.3 | 30 | Q1–Q3 |
| INIT-5 Migrate to Gen3 | Gen2→Gen3, Moment v2 | E5.1–E5.2 | 12 | Q2–Q4 |
| INIT-6 Govern the Estate | Classification, Standards, PKI | E6.1–E6.3 | 6 | Q1–Q3 |
| INIT-7 Enable Cloud Operations | Automation, Docs, Service Comms | E7.1–E7.2 | 11 | Q1–Q3 |
| Total | — | 20 | 171 | — |
graph TD
NOSD["NOSD-2303\nMMA Audit\nActive now"]
I1["INIT-1\nSecure Platform"]
I2["INIT-2\nOperate Reliably"]
I3["INIT-3\nModernise IaC"]
I4r["INIT-4 E4.1-2\nRightsize"]
I4d["INIT-4 E4.3\nDecommission"]
I5["INIT-5\nMigrate Gen3"]
I6["INIT-6\nGovern Estate"]
I7["INIT-7\nCloud Ops"]
subgraph NOW["Start Now — no blockers"]
I1
I3
I4r
I6
I7
NOSD
end
subgraph Q2["Q2 — unlocked by Q1"]
I2
I5
end
NOSD -->|findings scope| I2
I6 -->|what to harden| I1
I6 -->|safe to retire| I4d
I3 -->|IaC stable| I5
I5 -->|Gen3 live| I4d
I1 -->|sec baseline| I5
classDef now fill:#0052cc22,stroke:#4c9ee4,stroke-width:1.5px
classDef q2 fill:#00400022,stroke:#4ade80,stroke-width:1.5px
classDef audit fill:#cc000022,stroke:#ff5c5c,stroke-width:2px
class I1,I3,I4r,I6,I7 now
class I2,I5 q2
class NOSD audit
gantt
title ELRD Initiative Roadmap 2026
dateFormat YYYY-MM-DD
axisFormat %b
section Now Mar
INIT-1 E1.4 TLS Secrets DEADLINE :crit, active, 2026-03-10, 5w
INIT-3 E3.3 Federated Creds :crit, active, 2026-03-10, 3w
INIT-6 E6.1 Classification Blocker :crit, active, 2026-03-10, 10w
MMA Audit NOSD-2303 :crit, active, 2026-03-10, 2w
INIT-7 E7.1 Ops Automation :active, 2026-03-10, 12w
INIT-4 E4.1 Rightsizing :active, 2026-03-10, 16w
section Q2 Apr-Jun
INIT-1 E1.1 Network Perimeter :2026-03-24, 12w
INIT-1 E1.2 IAM Access :2026-03-24, 12w
INIT-2 E2.1 Monitoring Migration :2026-03-24, 10w
INIT-2 E2.2 Alerting Rationalisation:2026-03-24, 16w
INIT-2 E2.3 BCDR SRE :2026-04-07, 20w
INIT-2 E2.4 SRE Golden Signals NEW :2026-04-21, 16w
INIT-5 E5.2 Moment v2 :2026-04-07, 6w
INIT-4 E4.2 Test Cost Governance :2026-04-07, 8w
section Q3 Jul-Sep
INIT-1 E1.3 Security Posture :2026-07-01, 14w
INIT-5 E5.1 Gen3 Migrations :2026-07-01, 24w
INIT-4 E4.3 Decommission Wave :2026-08-01, 16w
INIT-6 E6.3 PKI Modernisation :2026-07-01, 12w
| Epic | Theme | Stories | Reviews |
|---|---|---|---|
| E1.1 Network & Perimeter | Firewall, App GW, NSG, DNS, Private Endpoints | 9 | 3 |
| E1.2 IAM & Access | RBAC migration, AAD Connect, PIM, ADO access | 5 | 4 |
| E1.3 Security Posture | Defender for Cloud, Advisor, vuln assessment, TLS | 4 | 13 |
| E1.4 Secrets & Encryption | Secure sharing, public access removal, TLS 1.0/1.1 | 4 | 0 |
| Epic | Stories | Reviews | Escalates |
|---|---|---|---|
| E2.1 Monitoring Migration | 2 | 1 | 3 |
| E2.2 Alerting Rationalisation | 11 | 11 | 1 |
| E2.3 BCDR & SRE Fundamentals | 11 | 10 | 1 |
| E2.4 SRE Golden Signals NEW | 8 | — | — |
E2.4 is a new Epic — identified by PRD gap analysis. Without it, INIT-2 delivers Maturity 1 (telemetry visible, threshold alerts) but not Maturity 2 (SLO-driven alerting, error budgets, burn rate KQL).
Active MMA Policy Audit. 2-week window. Findings directly scope E2.1 remediation — if MMA is present on VMs, a remediation NOSD is raised immediately after close.
Action: Russell Lack must confirm E6.1 priority and owner this week. Slippage delays both E1.3 and E4.3.
INIT-7 is the enablement layer — makes all other work visible and actionable to the wider Elmera team. No blockers.
No separate escalate track needed. P1 completes in Jira; P2/P4/P5 become stories in the relevant Initiative Epics; P3 closes.
Each "Review" item is a Jira Proposal — raised but never committed to. Each needs one decision before Jira import:
| Decision | Meaning | When |
|---|---|---|
| Story | Carry into ELRD with acceptance criteria | Clear value, fits Epic, team has capacity |
| Defer | Keep in backlog, revisit Q3/Q4 | Valid idea, but blocked or no capacity now |
| Archive | Mark Done in ETAT, do not import | Already resolved, duplicate, or superseded |
initiatives/init-N-*.md fileReview → Story, Defer, or Archive + one-line rationaleinit-N-*.mdfeat/elrd-roadmapfeat/elrd-roadmap
Staging only — PRs target this branch, NOT main
Labels: escalate, pre-import
Issues + PRs in one view
pre-import)| ETAT | Story | Status | Disposition |
|---|---|---|---|
| ETAT-501 | Firewall Policy Analytics Review | Blocker | Story |
| ETAT-3 | Firewall Cleanup | Blocked | Story |
| ETAT-7 | App Gateway Cleanup and Review | Blocked | Story |
| ETAT-679 | Cleanup Temp Firewall/NSG Rules GE | Up Next | Story |
| ETAT-725 | Organise firewall code | Up Next | Story |
| ETAT-696 | App GW endpoints with public DNS problems | Up Next | Story |
| ETAT-13 | Optimise and Consolidate DNS | Backlog | Story |
| ETAT-532 | Clean openings to Service Tags | Backlog | Story |
| ETAT-87 | Address subnet limitations in salgsl | Backlog | Story |
| ETAT-92 | Firewall VPN Access for PostgreSQL | Proposal | Review |
ETAT-501 must be first. Firewall Policy Analytics reveals which rules are actually used. Without it, cleanup (ETAT-3, 679, 725) may remove rules that are still active.
ETAT-92 (VPN PostgreSQL), 591 (PE policy), 611 (Redis Private Link) — triage as Story, Defer, or Archive based on current VNet topology.
| ETAT-146 | Reassign memoryPercentage Alerts for App Service Plans |
| ETAT-147 | EPAC Policy for ServerErrors on Web/Function Apps |
| ETAT-148 | Investigate ServerErrors on p-hubapi-momprox |
| ETAT-149 | Improve responseTime Alert Configuration |
| ETAT-156 | Implement Monitoring for Azure Container Apps via EPAC |
| ETAT-595 | Configure Alerts for Critical Autoscale Events |
| ETAT-603 | False CPU alert triggers [ESCALATE] |
ETAT-563 (alert procedures doc) must be done before ETAT-151 (IFMS CPU instructions). Procedures first, then the how-to-respond docs.
E2.2 has zero upstream dependencies. Assign this workstream independently and run in parallel with all other Initiatives.
escalateinit-6-govern-estate.mdROADMAP.md or init-2-operate-reliably.mdDamian returns week of 2026-03-30. All triage decisions recorded this week will be reviewed on return and Jira import will be scheduled.
Open a GitHub Issue on InnofactorOrg/innofactor-datacenter
or ping on Teams — tag Damian Flynn
feat/elrd-roadmap
Innofactor Platform Engineering · March 2026 · Nothing written to Jira yet