PMI CD-P cheat sheet

Problem statement formula: current state + measurable gap + affected users + cost of inaction; a solution named in the statement means framing is incomplete.

Root cause tools: 5 Whys for linear chains, fishbone for multi-category causes, and process observation when stakeholder accounts conflict.

Discovery evidence hierarchy: observed process data > system logs > structured interviews > opinion; label each requirement with its evidence source.

Value hypothesis must state the metric, baseline, target, and measurement window before build starts; unbaselined metrics cannot prove success.

Stakeholder map axes: influence and interest; high-influence/low-interest parties need concise sign-off summaries, not working sessions.

Minimum viable scope test: if removing a feature does not change the value metric, it belongs in a later release.

Process discovery outputs: trigger, steps, decision points, handoffs, exceptions, cycle time, and volume per period.

A citizen development candidate is a bounded, rule-based, low-data-sensitivity process with a clear owner and a measurable cycle-time or error-rate pain.

Platform selection criteria: data connectors available, identity integration, environment separation, export/ownership of apps and data, and admin analytics.

Licensing models: per-user vs per-app vs capacity-based; capacity models shift cost risk to the maker and require usage monitoring.

Environment strategy: separate development, test, and production; makers build in dev, promoted artifacts only reach production after review.

Connector risk tiers: standard connectors are typically approved by default; premium and custom connectors usually require additional review.

Data loss prevention policies classify connectors as business, non-business, or blocked; mixing business and non-business data in one app is blocked.

Delegation limits in low-code query tools mean client-side filtering silently truncates large datasets; verify row counts against source.

Maker inventory fields to track: app owner, business sponsor, data sources, connector tier, criticality, and last review date.

Shared components (templates, component libraries, reusable flows) reduce duplicate build effort and standardize governance controls.

Separation rule: business rules live in one named place (formula, flow, or data layer), not duplicated across screens and automations.

Form design order: identify the single primary task per screen, place required fields first, defer optional data to secondary panels.

Input validation belongs at the point of entry and again at the data layer; client-only validation is bypassable.

Idempotency rule: any automation that creates records must check for an existing record keyed on a natural identifier before writing.

Error handling pattern: try/catch or scope-level handling, log to a central list with correlation ID, and surface a user-readable message.

Naming conventions: prefix by environment and purpose, version major releases, and never reuse a retired component name.

Accessibility baseline: label every input, maintain logical tab order, do not encode meaning in color alone, and target readable contrast.

Performance rule: filter and aggregate at the data source; loading full tables into the client degrades as record count grows.

Test pyramid for low-code: many unit-level formula and rule checks, fewer integration tests across connectors, few end-to-end UI tests.

Test case template: precondition, input data, action, expected result, actual result, pass/fail, evidence link.

Boundary testing: zero records, one record, maximum allowed, oversized payload, null and blank values, and duplicate submissions.

UAT exit criteria are defined before UAT starts: named testers, scenario coverage, zero open severity-1 defects, signed acceptance.

Defect severity vs priority: severity measures impact, priority measures urgency; they are assigned independently.

Deployment sequence: freeze changes, back up solution and data, deploy to test, regression test, deploy to production, smoke test, announce.

Rollback plan must name the artifact version to restore, the data restore point, and the decision owner who can trigger rollback.

Post-deployment monitoring: error log volume, failed flow runs, adoption counts, and cycle-time metric against the value hypothesis baseline.

Three lines of defense: maker owns build quality, citizen development center of excellence sets standards, audit or risk provides independent assurance.

Risk scoring = likelihood x impact; apps handling regulated data or money movement require IT and security review before production.

Tiered review model: low-risk apps get self-service checklist, medium get center-of-excellence review, high get full architecture and security review.

Center of excellence responsibilities: standards, reusable components, coaching, intake triage, and platform roadmap with IT.

IT collaboration contract: shared responsibility matrix naming who owns platform, connectors, data, app support, and incident response.

Data classification drives controls: public, internal, confidential, restricted; restricted data typically cannot be stored in citizen-built apps.

Alm and lifecycle controls: named owner, support contact, review cadence, orphaned-app detection, and retirement criteria.

Audit trail requirements: who changed what and when; maker environments should log app edits, permission changes, and data exports.

Test pyramid for low-code: many unit-level formula and rule checks, fewer integration tests across connectors, few end-to-end UI tests.

Test case template: precondition, input data, action, expected result, actual result, pass/fail, evidence link.

Boundary testing: zero records, one record, maximum allowed, oversized payload, null and blank values, and duplicate submissions.

UAT exit criteria are defined before UAT starts: named testers, scenario coverage, zero open severity-1 defects, signed acceptance.

Defect severity vs priority: severity measures impact, priority measures urgency; they are assigned independently.

Deployment sequence: freeze changes, back up solution and data, deploy to test, regression test, deploy to production, smoke test, announce.

Rollback plan must name the artifact version to restore, the data restore point, and the decision owner who can trigger rollback.

Post-deployment monitoring: error log volume, failed flow runs, adoption counts, and cycle-time metric against the value hypothesis baseline.

Three lines of defense: maker owns build quality, citizen development center of excellence sets standards, audit or risk provides independent assurance.

Risk scoring = likelihood x impact; apps handling regulated data or money movement require IT and security review before production.

Tiered review model: low-risk apps get self-service checklist, medium get center-of-excellence review, high get full architecture and security review.

Center of excellence responsibilities: standards, reusable components, coaching, intake triage, and platform roadmap with IT.

IT collaboration contract: shared responsibility matrix naming who owns platform, connectors, data, app support, and incident response.

Data classification drives controls: public, internal, confidential, restricted; restricted data typically cannot be stored in citizen-built apps.

Alm and lifecycle controls: named owner, support contact, review cadence, orphaned-app detection, and retirement criteria.

Audit trail requirements: who changed what and when; maker environments should log app edits, permission changes, and data exports.