Published September 13, 2026. Reading estimate uses 200 words per minute; completing the worksheet takes additional time.
Begin with candidate status
RookHaven is publicly described as a security-hardened Linux production candidate available for controlled customer evaluation. Your pre-read should preserve that qualification. Do not brief colleagues as though they are selecting an already-certified, generally available service.
Identify whether the immediate decision is to learn about the architecture, conduct a controlled exercise, or consider a specific deployment. Those decisions need different evidence and commitments. The first discussion can narrow the question without authorizing testing or reserving a deployment.
Prepare a high-level environment summary
Describe the intended authorized assessment work, approximate locations, hardware constraints, network restrictions, and available local support. Name the owner of the environment and the person responsible for the evaluation decision.
Keep initial contact material free of credentials, private endpoint details, and customer secrets. If deeper evidence is needed, agree an appropriate exchange channel during the evaluation process. A useful pre-read can explain a constraint without disclosing the sensitive configuration behind it.
Ask different participants different questions
The business sponsor should explain the outcome and procurement constraints. Technical evaluators should identify architecture and acceptance questions. Operators should examine placement, maintenance, recovery, and closeout responsibilities. An approver should examine how scope and significant decisions will be governed.
Ask participants to label their questions as blocking, important, or informational. That classification helps use the review time well. It should not become a score that lets several convenience features cancel out one missing authorization or recovery requirement.
Leave with a written evidence request
For each unresolved question, record what material would answer it, who will supply or review it, and which decision depends on it. The relevant RookHaven gates include exact-platform validation, signing custody, applicable resilience controls, recovery exercises, and independent review.
Use the agenda below as a preparation tool. Actual outputs, duration, equipment, fees, and support are agreed for the engagement. A productive review may conclude that more evidence is needed or that the model does not fit; it does not need to end with a commitment to deploy.
Your working record
Adapt these criteria to the engagement. The CSV includes blank evidence, status, owner, and review-date fields. Nothing is pre-marked as passed. Scroll the table horizontally on small screens.
| Topic | Prepare | Question to resolve |
|---|---|---|
| Use case | Authorized work, expected outcome, and customer owner. | Why is an appliance-based assessment model relevant? |
| Components | Questions about Portal, Rook, Forge, and Sentinel. | Which responsibilities belong to each component and which remain with people? |
| Environment | High-level platform, placement, connectivity, and local support constraints. | Which exact profile and operating dependencies must be evaluated? |
| Evidence | Blocking requirements and desired evidence references. | What is available now and what requires new validation? |
| Operations | Proposed approvers, operators, recovery contacts, and handoff owner. | Who owns the appliance after a controlled exercise? |
| Commercial scope | Required deliverables, schedule constraints, equipment, and procurement needs. | Which commitments require written agreement before work? |
| Decision record | Proceed / defer / decline; conditions and next owner. | What evidence would change the decision? |
Worked example: architecture review before placement
Illustrative scenario: a consultancy wants to assess whether RookHaven fits work across several approved locations. Its first review concerns roles and appliance lifecycle, not an immediate installation. The pre-read names those questions and identifies local support as an unresolved constraint.
The discussion can produce a list of architecture questions, required candidate evidence, and responsibilities to confirm. Placement remains a later, separately scoped decision. This avoids sending equipment before the people who will approve, operate, and recover it have agreed their responsibilities.
Source context & further reading
Background on planning technical assessments, understanding technique limitations, analyzing findings, and mitigation. The worksheet here is an original planning aid, not a NIST checklist.
NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment
Use this planning aid alongside an approved engagement scope and qualified review. Illustrative examples are not customer results or product test evidence. The actual agreement determines permission, responsibilities, and acceptance.