- When working on IAC, utilize the corresponding sectestbed- vm. The intent of those is to be snapshotted to the base state (joined to tailscale, registered in beszel , ssh keys in place). Over time the base state will change (ie domain joined , baseline STIG remediations applied etc) and the delta of tested code will be smaller. However , at any time , a new functional area vm can need to be stood up , and it will start in that ultra basic base state and have the roles applied. 

- Preprod- vm machines are for testing upgrades to new versions of vendor software. They’ll always have a snapshot of current prod. This is… complicated and will need work stream specific discussion on how to snapshot , rollback etc. also , compliance mitigations may need to go through some combination of sectestbed- and preprod- testing. How compliance and upgrade work streams progress is somewhat TBD , but they’ll need to be somewhat in lockstep from time to time. Redmine gantt and overall dependency relationship modeling will be very heavily used here.