ODPs turn requirements into decisions. Decisions need defending.

What an ODP actually is

Where Rev. 2 might say "review audit logs," a Rev. 3 requirement says the equivalent of "review audit logs [with an organization-defined frequency]." The bracketed value is the ODP. Multiply that pattern across the requirement set and Rev. 3 becomes partly a standard and partly a questionnaire — one your program must answer in writing before an assessor answers it for you.

Who sets the value

• The imposing agency, first. Where an agency specifies ODP values (GSA's CUI guidance is the working example — see GSA authorization), those values are requirements, not suggestions.
• You, otherwise. Where the instrument is silent, the organization defines the value — which means the value must be chosen deliberately, recorded, and justifiable against risk, not inherited from whatever the tooling defaulted to.
• Different customers, different values. Serving multiple agencies can mean the same requirement carries different parameter values per customer. That's a register problem, not a crisis — see dual-baseline operations.

The ODP decision register

The artifact that makes ODPs manageable is a register with one row per parameter:

Column	What goes in it
PARAMETER	The requirement and the specific bracketed value it asks for
VALUE	The chosen value — per customer where values differ
SOURCE	Who set it: agency directive, contract clause, or organizational decision
RATIONALE	Why this value is appropriate for your risk and operations
IMPLEMENTATION	Where the value is enforced — the Conditional Access policy, Intune profile, or process document that embodies it
REVIEW DATE	When the value is next revisited — because values drift out of truth quietly

The failure modes assessors catch

• The undefended default — a value that exists only because the tool shipped that way. "Why 90 days?" needs a better answer than "it was pre-filled."
• Register-configuration drift — the register says weekly log review; the SIEM schedule says monthly. One sentence of testing finds this.
• Value collisions across customers — promising one agency a 15-minute session lock and another 30, then enforcing one policy tenant-wide. Pick the strictest, or segment deliberately.
• Orphaned parameters — ODPs nobody enumerated, so nobody valued. The register must be generated from the requirement set, not from memory.