20 questions for your software risk assessment.

1. Is the complete and current source code stored centrally and traceably?

2. Can the application be reproducibly built from the available source code today?

3. Are all required libraries, OCX/DLLs, tools and versions documented?

4. Is the source code managed in a version control system such as Git?

5. Is there current technical documentation for the application?

6. Are important business rules and special logic documented?

7. Can at least two people make critical changes to the software?

8. Can the effort and risk of changes be estimated reliably today?

9. Are databases backed up regularly and restores tested?

10. Are all internal and external interfaces known and documented?

11. Are errors, outages and critical processes technically monitored?

12. Is there a documented recovery or emergency plan?

13. Does the application run on supported operating systems and platforms?

14. Can security-relevant components be updated regularly?

15. Are user permissions, technical accounts and access rules clearly governed?

16. Has the application been technically reviewed for security risks within the last 24 months?

17. Is there a documented technical roadmap for the next two to three years?

18. Can individual modules or functions be modernized independently?

19. Could the business absorb a multi-day outage of the application operationally?

20. Is enough knowledge available to continue the application independently of the current developer if necessary?