# Software readiness checklist

The checklist is Taiga’s review framework. Applicability depends on your system and obligations; individual checks may be manual, advisory or automated.

This is a self-assessment, not an audit, certification or automated release gate. “Yes” records your answer; it does not verify the evidence.

For each applicable question, record Yes, Partly, Not yet or Not sure, the supporting evidence and an accountable owner. If a question does not apply, record why. Use these notes to decide what to verify next.

## GOVERN

- [ ] Did a DPIA exist before the build started?
- [ ] Does a written threat model exist for it?
- [ ] Could you produce a record of who changed what, when, and why?
- [ ] Did every change go through a documented change-control step?
- [ ] If AI is in the loop, could you show conformity evidence this quarter?

## SECURE

- [ ] Was the code hardened against a written security policy, not reviewed by eye?
- [ ] Are its IAM roles least-privilege, and has anyone checked since launch?
- [ ] Are all secrets out of the code, stored and rotated?
- [ ] Is threat detection watching it in production right now?
- [ ] Can you show where its data lives, and prove it stays there?

## BUILD

- [ ] Are its integrations (ERP, IdP) documented outside the code?
- [ ] Does the documentation match what actually shipped?
- [ ] Do its tests check what the business asked for, not just what the code does?
- [ ] Could you rebuild the environment from the repository alone?
- [ ] Is there a tested rollback path, versioned with the delivery?

## RUN

- [ ] Would you know it is degrading before a user tells you?
- [ ] Are its logs centralized and retained per your policy?
- [ ] Is someone on call for it, in writing?
- [ ] Are SLOs and error budgets defined?
- [ ] Do you have a current SBOM and a patch cadence?
- [ ] Has a backup ever been restored on purpose, as a test?
- [ ] Would it survive one availability zone failing?

Review six related areas: https://tai.ga/en/gate/