source/handbook/engineering/security/index.html.md

@@ -447,14 +447,14 @@ These templates should be used during the onboarding process and throughout the
 * All new access or permissioning change requests require a [New Access Request](https://gitlab.com/gitlab-com/access-requests/issues/new?issuable_template=New%20Access%20Request).
 * All access requests must be approved by the team member's manager with the exception of:
-   
+
    - ARs for G-Suite email distribution lists for internal GitLab team members
    - ARs for Slack groups for internal GitLab team members
-  Please note that ARs for access to internal systems for "external to GitLab individuals" (eg. customers, prospects) require managerial approval. This includes access to G-Suite security groups also require managerial approval. 
+  Please note that ARs for access to internal systems for "external to GitLab individuals" (eg. customers, prospects) require managerial approval. This includes access to G-Suite security groups also require managerial approval.
 * Requests for access to Infrastructure assets (servers and databases) require a second layer of approval from Infrastructure Management.
-  
+
 * All requests for new service accounts require a [New Service Account Request](https://gitlab.com/gitlab-com/access-requests/issues/new?issuable_template=New%20Service%20Account%20Request)
 * All requests for new service accounts must be approved by a member of Infrastructure Management.
@@ -475,7 +475,7 @@ These templates should be used during the onboarding process and throughout the
 ### Access Requests and Onboarding
-During the onboarding process, the manager should determine which email and slack groups the new team member should be added to. Also determine if new team member will need access to the `dev` server, which is used by engineers to prepare fixes for security issues and also allows for access to version.gitlab.com and license.gitlab.com. If so, request the creation of a [new dev.GitLab.org account](https://dev.gitlab.org/admin/users/new) *with the same username the team member has on gitlab.com* and an invitation to the [gitlab group](https://dev.gitlab.org/groups/gitlab/group_members) as a Developer. Fill out one [access request](https://gitlab.com/gitlab-com/access-requests/issues) for both the groups and Dev account if needed. 
+During the onboarding process, the manager should determine which email and slack groups the new team member should be added to. Also determine if new team member will need access to the `dev` server, which is used by engineers to prepare fixes for security issues and also allows for access to version.gitlab.com and license.gitlab.com. If so, request the creation of a [new dev.GitLab.org account](https://dev.gitlab.org/admin/users/new) *with the same username the team member has on gitlab.com* and an invitation to the [gitlab group](https://dev.gitlab.org/groups/gitlab/group_members) as a Developer. Fill out one [access request](https://gitlab.com/gitlab-com/access-requests/issues) for both the groups and Dev account if needed.
 ### Deprovisioning
@@ -488,7 +488,7 @@ During the onboarding process, the manager should determine which email and slac
 ### Access Reviews
 * Access reviews will be formally documented using the [Access Reviews](https://gitlab.com/gitlab-com/access-requests/issues/new?issuable_template=Access%20Review) template.
-  
+
 * As part of an access review, existing access may be modified or revoked. New access (not modification of existing access) requires the submission of a [New Access Request](https://gitlab.com/gitlab-com/access-requests/issues/new?issuable_template=New%20Access%20Request).
 ### Access Control Process Exceptions
@@ -496,10 +496,10 @@ During the onboarding process, the manager should determine which email and slac
 * An access request is not required for Google Drive folders or files.
 * Managerial approval is not required when requesting access to:
-   
+
   - ARs for G-Suite email distribution lists for internal GitLab team members
   - ARs for Slack groups for internal GitLab team members
-  
+
 * Bulk requests can be submitted for the following three types of requests:
   - Email aliases/forwarding in GSuite
@@ -529,7 +529,7 @@ During the onboarding process, the manager should determine which email and slac
 | gitlab.com            |  SRE      | Admin - admin account-username                   |
 | ops.gitlab.net        |  SRE      | added w/ production group from chef users databag|
 | staging.gitlab.com    |  SRE      | add Admin role to regular account                |
-| GCP                   |  SRE      | Folder Admin/Infra.                              | 
+| GCP                   |  SRE      | Folder Admin/Infra.                              |
 | Chef                  |  SRE      | Admin                                            |
 | Pager Duty            |  SRE      | Admin                                            |
 | Status.io             |  SRE      | Admin                                            |
@@ -806,7 +806,7 @@ Team members remain responsible for their own assigned reports.
   - Import the report into a GitLab issue using `/h1import *report_id* [ce/ee] [Sx] [Px]` in Slack
     - Assign the appropriate [Severity and Priority](#severity-and-priority-labels-on-security-issues).
     - Assign the appropriate [Due Date](#due-date-on-security-issues)
-   - @ mention product manager of appropriate teams for scheduling and/or the engineering managers if additional engineering feedback is required to complete the triage, based on the [current organization chart](/company/team/org-chart).
+   - @ mention product manager of appropriate teams for scheduling and/or the engineering managers if additional engineering feedback is required to complete the triage, based on the [product categories page](https://about.gitlab.com/handbook/product/categories/)
     - As applicable, notify relevant team members via the issue, chat, and email, depending on the chosen security level.
   - Change the state of the report to "Triaged" in HackerOne and include a link to the issue as the reference.
     - Fill in the comment using the `00 - Triaged` Common
@@ -832,6 +832,14 @@ Team members remain responsible for their own assigned reports.
       as the template for the bounty award if approved.
     - In any case, no report should go "stale" where updates are not provided within the last month.
+#### Critical Vulnerabilities
+
+When critical vulnerabilities are identified, it is necessary to quickly get the attention of the appropriate engineering team and the security operations team
+in order to fully determine impact to `gitlab.com` and to self-managed customers. When a vulnerability is determined to be P1/S1, do the following after following
+the steps above:
+- [Engage the security oncall](#engaging-the-security-on-call) with a link to the issue.
+- Post the link to the issue in the appropriate engineering team's Slack channel, requesting review.
+
 #### If a Report is Unclear
 If a report is unclear, or the reviewer has any questions about the validity of the finding or how it can be exploited, now is the time to ask. Move the report to the "Needs More Info" state until the researcher has provided all the information necessary to determine the validity and impact of the finding. Use your best judgement to determine whether it makes sense to open a confidential issue anyway, noting in it that you are seeking more information from the reporter. When in doubt, err on the side of opening the issue.

source/handbook/engineering/ux/experience-baseline-recommendations/index.html.md

@@ -24,7 +24,7 @@ Creating an Experience Baseline with associated Recommendations enables us to *i
     - **Positive:** The user’s experience included a pleasant surprise—something they were not expecting to see. The user enjoyed the experience on the screen and could complete the task, effortlessly moving forward without having to stop and reassess their workflow. *Emotion(s): Happy, Motivated, Possibly Surprised*
     - **Neutral:** The user’s expectations were met. Each action provided the basic expected response from the UI, so that the user could complete the task and move forward. *Emotion(s): Indifferent*
     - **Negative:** The user did not receive the results they were expecting. There may be bugs, roadblocks, or confusion about what to click on that prevents the user from completing the task. Maybe they even needed to find an alternative method to achieve their goal. *Emotion(s): Angry, Frustrated, Confused, Annoyed*
-1. Use the [Grading Rubric](#grading-rubric) below to provide an overall measurement that becomes the **Benchmark Score** for the experience, and add it to each JTBD issue's description. 
+1. Use the [Grading Rubric](#grading-rubric) below to provide an overall measurement that becomes the **Benchmark Score** for the experience (one grade per JTBD), and add it to each JTBD issue's description.
 1. Once you’re clear about the user’s path, create a clickthrough video that walks through the experience and includes narration of the Emotional Grading Scale and Benchmark Score.
 1. Post your video to the [GitLab Unfiltered YouTube](https://www.youtube.com/channel/UCMtZ0sc1HHNtGGWZFDRTh5A) channel, and link to it from each JTBD issue's description.
 1. Create an issue to revisit the same JTBD the following quarter to see if we have made improvements. We will use the grades to monitor progress toward improving the overall quality of our user experience. Add that issue as related to each JTBD issue.

source/handbook/marketing/corporate-marketing/index.html.md

@@ -501,12 +501,12 @@ Corporate handles the creating and ordering of all new swag. All swag designs sh
     * Aim to keep the cost per lead for a live event around $100.
   * **Thought Leadership and Education**
-### How We Evaluate Potential Events
+### How We Evaluate and Build Potential Events
 All GitLab events must check at least drive two or more of the aims of our events below to be considered.
+  - Brand awareness- we want to be a house hold name by 2020!
   - Build community
   - Gain contributors
   - Thought leadership
-  - Brand awareness
   - Help with hiring
   - Get new relevant leads/ drive ROI  
   - Educate possible buyers or users on our product or features
@@ -520,6 +520,7 @@ In addition, corporate events must meet:
   * Audience demographic requirements. We consider the balance of roles represented (contributor, user, customer, potential hires), and the Global reach of the audience. 
  
 We also ask the following questions when assessing an event:
+- How and where will this position us as a brand? 
 - Does it drive business goals forward in the next quarter? Year?
 - Is the event important for industry, thought leadership, or brand visibility? We give preference to events that influence trends and attract leaders and decision makers. We also prioritize events organized by our strategic partners.
 - Will there be a GitLab speaker? We do not require a speaker slot in return for sponsorship but we do prioritize events where the audience will be hearing about GitLab - either from a GitLab team-member or a member of the wider GitLab community.
@@ -637,7 +638,7 @@ To be done by DRI once contract signed
      * All leads gathered through meeting setting initiatives must be tracked in their own campaign. 
      * We generally like to provide a small gift (unedr $50) for anyone who takes a meeting with us. 
      * Find ouy more on [meeting setting in the FM handbook](https://about.gitlab.com/handbook/marketing/revenue-marketing/field-marketing/#scanning-best-practices)
-17. Demos, booth decks and documentation
+17. Demos, booth decks, and documentation
      * Procuct marketing helps to make all displayed collateral at events. 
      * These are the standard [demos](https://about.gitlab.com/handbook/marketing/product-marketing/demo/) we use/ present at events. They should be preloaded on event iPads. 
      * If you need soemthing specific for a show, start an issue in the PMM project and tag Dan Gordon. They need at least 3 weeks to produce something custom. 

source/handbook/tools-and-tips/index.html.md

@@ -485,6 +485,10 @@ Especially when talking with customers, it's good to make a good impression! One
 Using a [green screen](https://www.amazon.com/dp/B00JSAOGWG/ref=psdc_3443951_t1_B0053EBFRU), you can create [virtual backgrounds](https://support.zoom.us/hc/en-us/articles/210707503-Virtual-Background) so that you don't have to worry about what's behind you while on a video call and you can use a [nice](http://incurs.us/sites/default/files/2016-07/gitlab-wallpaper-1.png) [background](https://about.gitlab.com/images/press/gitlab-summit-south-africa.jpg).
+1. In your Zoom [In Meeting (Advanced)](https://zoom.us/profile/setting#advanced_meeting_options) settings, enable `Virtual background`
+1. In your Zoom application on your computer, open settings and click on the `Virtual Background` setting
+1. Select a background you want to use or, click the \[+] to add a picture from your computer.
+
 ## Krisp
 [Krisp](https://krisp.ai/) will mute background noise when you're in a noisy environment so you can hear and be heard more easily on calls.