Documentation debt remediation proposal

Overview

Inherited environments often lack diagrams, credential hygiene, and license records. Sell remediation as a bounded project, not endless T&M sink.

Assessment deliverable

Gap list prioritized by risk: unknown domain admins > missing Visio > stale Wi-Fi password doc.

Phasing

Phase 1: survival docs (core infra creds, DR contacts). Phase 2: network + app inventory. Phase 3: automation / CMDB sync.

Estimating

Use fixed discovery days + variable build based on site count; buffer 20% for rabbit holes explicitly disclosed.

Visuals

Before/after secure score or incident response readiness score sells value beyond “pretty diagrams.”

Risks

Client staff hiding tribal knowledge—interview calendar mandatory; exec air cover for cooperation.

Payment milestone

Invoice after each phase sign-off; do not wait 9 months for giant reveal.

Exit criteria

Defined checklist in SOW: e.g., “100% critical servers in vault with tested credential.”