1. Paved Roads advanced

    From 2011 the UK's Government Digital Service required central approval for departmental digital spending above a threshold (about £100,000, and zero for some categories such as public-facing websites) alongside a published service standard and assessments. By 2026 the GDS-run controls had been retired in favour of departmental ownership with a much higher pipeline threshold. What did controlling the money achieve that a standards document could not, and where would copying it be a mistake?

    4 min answer gdsgovernancefundingstandards
  2. Paved Roads intermediate

    How does a paved road achieve governance outcomes without a mandate, and what makes it fail?

    2 min answer paved-roadgovernanceadoptiondefaults
  3. PCI-DSS Scoping advanced

    A commerce platform wants to reduce the systems in scope for payment card compliance. What architecture achieves that?

    2 min answer pcitokenisationscope-reductionsegmentation
  4. PCI-DSS Scoping advanced

    A merchant keeps card entry inside a provider-hosted iframe and believes its scope is minimal. Customer support uses a screen-sharing tool that can see and record the customer's browser during checkout, calls are recorded, and a session-replay script runs on every page for analytics. Review the arrangement.

    3 min answer pci-dssscopesession-replayscreen-sharing
  5. PCI-DSS Scoping advanced

    A payments platform wants to reduce the systems subject to card-data compliance. What actually reduces scope, and what does not?

    2 min answer razorpaypciscopetokenisation
  6. PCI-DSS Scoping advanced

    An e-commerce platform stores card numbers to support repeat purchases. How do you reduce PCI scope?

    2 min answer pcitokenisationscopepayments
  7. PCI-DSS Scoping intermediate

    An e-commerce site collects card details in its own form and posts them to a payment provider's API. What would you change and why?

    2 min answer stripepciscopesecurity
  8. PCI-DSS Scoping advanced

    Your first PCI assessment finds the whole estate in scope. How did that happen and how do you reduce it?

    2 min answer pcisegmentationcompliance
  9. Peak Event Readiness advanced

    A live platform has two weeks before a major event expected to bring ten times normal traffic. What should the readiness work consist of, in priority order?

    2 min answer peak-readinesscapacitydegradationrehearsal
  10. Peak Event Readiness advanced

    A retailer expects 20× normal traffic for a two-hour sale launch. Plan the readiness.

    2 min answer peakcapacitydegradationwar-room
  11. Peak Event Readiness advanced

    A streaming platform is broadcasting a scheduled cricket match and forecasts 40 million concurrent viewers, but the real number could be double. How should pre-scaled capacity, CDN pre-positioning, ingest redundancy, bitrate ladders, connection limits and feature degradation be planned together?

    3 min answer hotstarjiocinemalive-streamingconcurrency
  12. Peak Event Readiness advanced

    A trading platform faces its largest load at a precisely known time every day. What does readiness for a scheduled peak involve beyond capacity?

    2 min answer zerodhapeakreadinesswarmup