Technical Debt — Governance & SLA

Ownership, due dates, policies and escalation for technical debt

It introduces governance and SLA management for technical debt. It helps you define ownership, set due dates, apply policies, track exceptions and ensure timely remediation with clear escalation rules.

♟

Items with Owner

208↑ 18%vs previous period

◷

Overdue Items

32↑ 6%vs previous period

▤

SLA Violations

12↑ 20%vs previous period

✓

Within SLA

204↑ 15%vs previous period

Ownership model

Assign owners to technical debt items to ensure accountability and faster resolution.

Item type	Default owner	Owner source	Example
Cloud resource	Platform Team	Tag (owner), LDAP group	EC2 instance (owner: platform)
Security finding	Security Team	Security Hub, Code scanning	S3 public access (owner: security)
Policy violation	Compliance Team	Policy mapping	Encryption disabled (owner: compliance)
Drift item	Infra Team	Resource tag, service catalog	Unapproved change (owner: infra)
Code dependency	Application Team	GitHub CODEOWNERS	Outdated library (owner: app team)

SLA policies

Define remediation timelines based on severity, item type and business impact.

Severity	Default SLA (days)	Example item types
Critical	7	Public S3 bucket, Critical CVE, Policy violation (encryption)
High	30	Outdated runtime, High risk security finding
Medium	60	Deprecated instance type, Drift detection
Low	90	Recommendations, Informational findings

Policy configuration (example)

Define custom policies for ownership, SLA and escalation.

yaml

policy:
  itemType: SECURITY_FINDING
  severity: CRITICAL
  slaDays: 7
  owner: security-team
  escalation:
    - afterDays: 7
      notify: ["team-lead", "security-head"]

Governance workflow

Automated governance with clear escalation paths.

▤

Identify
technical debt item

→

♟

Assign owner
and due date

→

⬟

Apply policies
and SLA

↓

Within SLA?

Yes

No

✓

Track progress
and close

♟

Trigger escalation
and notify owner

Escalation rules

Automatically escalate overdue items to the right teams.

Condition	Escalate to	Action
Overdue > 7 days	Owner + Team Lead	Create notification
Overdue > 30 days	Department Head	Create issue + email
Overdue > 90 days	Cloud Center of Excellence	Create incident
SLA breach (critical)	Security/Compliance	Immediate alert (Slack/Email)

Benefits

• Clear ownership and accountability
• Configurable SLA policies based on risk and business impact
• Automated escalation and notifications
• Better compliance and audit readiness
• Faster remediation and reduced risk