Websphere commerce code review checklist

The WebSphere Commerce deployment checklist is based on lessons learned from IBM internal groups, external customers and business partners deploying WebSphere Commerce-based solutions. This checklist is intended to provoke discussion; it is not a detailed set of instructions.

Access control

Is access control on commands and on JSP pages applied appropriately?
Is access to administration tools (WebSphere Commerce Accelerator, Administration Console and Organization Administration Console) outside the firewall properly configured, or disabled?
Are the right subset of roles assigned to the right set of administrators? Do any passwords need to be reset?

Database

Is the production database free from test data, or erroneous data?
Are the database statistics up-to-date?
Are the database configuration and tuning parameters signed off by the Database Administrator (DBA)?

Caching

Is the cachespec.xml file set up appropriately for caching and invalidation?
Are the caches primed (pre-populated) to maximize response times?
Is the Web server cache and Edge Server cache configured and properly loaded?

Integration

If a back-end system is unavailable, or too slow to respond, is there a alternative solution in place?

Store pages

Is the final artwork and store JSP pages approved?
Are the error JSP pages meaningful and helpful for the customer?

Initial data load

Are the final catalog updates loaded and verified?
Are the final prices and inventory levels loaded and verified?
Are the right set of contracts deployed?

Campaigns

Are the right set of campaign activities Active ?

Site Monitoring

Are the system administrators aware of how to tell if the site is working well or if the site is experiencing problems?
Is there a plan to monitor resource utilization (CPU, disk, memory)?
As traffic increases, is the site's expected breaking point known?
Are the right WebSphere Application Server logs turned on?
Is an appropriate level of WebSphere Commerce logging turned on?

Reporting

Is there a need to turn on the User Traffic Log?
Is there a need to turn on the Marketing Event Monitors?
Are the right Web Server logs turned on?

Backup and recovery

Is there an available backup of the production site database, customized code, and configuration parameters?
Is a disaster recovery plan in place?
Is there a plan for how the site will be managed in the case where the site needs to be brought down temporarily or for an extended period of time?

Upgrades and fixes

Is a regular maintenance window planned?
Is there a plan for how upgrades and fixes will be applied to the site?
Is there a plan for how emergency updates will be made to the catalog (products or prices)?

Development, test, staging and production

Have you confirmed that key functionality, scripts, processes work the same way in the production environment as they did in the test environment?

Related reference