Rollback criteria before approving changes
Overview
Define when to abort before starting—not during panic.
Examples
Auth failures >1% synthetic checks; latency >2× baseline 10 minutes; error budget burn.
Mechanics
Scripted rollback steps documented; vendor support case pre-opened for major upgrades.
Psychology
Permission to rollback without blame improves MTTR.
Review
Post-change review documents whether criteria were right or need tuning.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...