The proposed Build and Deployment/Deployment and the activity "Use of User Roles for SCM" are sub-categories of Role Based Access Control and BCDR.

Options

I see the following two options here:

• Allow Sub-Activities marked as such and add a filter to the UI
• Attached details to existing activities

Allow Sub-Activities marked as such and add a filter to the UI

Benefits:

• The generic activity, e.g. "Role based authentication and authorization", is often too generic so that depending on the system implemented, it might be on an other level. Sub-Activities would allow to point this out by having their own level.

Weakness:

• In maturity models, we try to de-duplicate activities

Attached details to existing activities

Put the details as an assessment / comment into the father category.

Weakness/Benefits swapped.