Published September 13, 2026. Reading estimate uses 200 words per minute; completing the worksheet takes additional time.
Use this after deciding the platform category fits
This checklist is for evaluating a candidate against your requirements. If you are still deciding whether an appliance-based model is appropriate, begin with the operating-model guide. Here the output is a review record, not a broad comparison of product categories.
Before a demonstration, identify the requirements that would block adoption if unresolved. A minor convenience should not offset a missing authorization control or an unowned recovery path. Classify those requirements explicitly instead of hiding them in an average feature score.
Define the evidence level for each answer
Record whether the answer comes from a statement, a document, a demonstration, or a controlled exercise in your environment. Each is useful, but they do not establish the same thing. Include a reference that an authorized reviewer can actually inspect.
For a critical requirement, write the acceptance criterion before the exercise. “Approvals work” is ambiguous. “The agreed approver can authorize the scoped action, and an operator cannot treat an unrelated approval as permission” describes a question that can be examined without publishing sensitive implementation details.
Keep the disposition separate from the observation
Use Pass, Fail, Not reviewed, or Not applicable in your working copy. A pass requires supporting evidence against the agreed criterion. A not-applicable item requires a reason and a reviewer; it is not a convenient way to remove an awkward question.
If the result has a limitation, record it even when the item passes within scope. An acceptance owner may choose a constrained use case while declining a broader one. Preserve that boundary in the final decision so later teams do not inherit an unrestricted approval.
Close the review with owned next actions
The matrix below supplies example criteria to adapt, not claims that RookHaven or another product has passed them. Add columns for evidence reference, observed result, disposition, reviewer, and due date in the downloaded worksheet.
At closeout, identify who will resolve each blocking item and what new evidence would change the decision. Record a decision to proceed, defer, reject, or request remediation. A completed meeting is not a completed evaluation if its unresolved items have no owner.
Your working record
Adapt these criteria to the engagement. The CSV includes blank evidence, status, owner, and review-date fields. Nothing is pre-marked as passed. Scroll the table horizontally on small screens.
| Review area | Evidence to request | Example acceptance criterion | Suggested owner |
|---|---|---|---|
| Identity and roles | Role map and authorized/unauthorized-action observations. | Named roles have agreed permissions; prohibited actions are not treated as approved. | Security reviewer |
| Approval scope | Approval record linked to the action reviewed. | The record identifies who approved what and under which scope. | Customer approver |
| Workspace boundary | Workspace scope, data handling, and closeout observations. | Assessment work and artifacts remain within the agreed boundaries. | Technical evaluator |
| Appliance placement | Exact baseline and customer placement constraints. | Hardware, connectivity, and custody requirements are accepted by the environment owner. | Environment owner |
| Recovery | Exercise record and return-to-service decision. | Agreed recovery criteria have evidence; deviations have a disposition. | Operations owner |
| Evidence access | Sample record and authorized retrieval process. | Reviewer can inspect the required records without inappropriate data exposure. | Evidence custodian |
| Lifecycle | Update, reassessment, and retirement responsibilities. | Material changes and end-of-use actions have named owners. | Operations owner |
| Commercial scope | Written deliverables, equipment, fees, and support assumptions. | No critical operational dependency relies on an unagreed service commitment. | Procurement / sponsor |
Worked example: one unresolved critical row
Illustrative scenario: seven review areas have inspectable evidence, while the recovery row has only a verbal assurance. The team should not report an overall “87.5% ready” score. That percentage would conceal a potentially blocking requirement.
Record recovery as Not reviewed, identify the exercise evidence required, and assign an operations owner. The decision may be to continue a limited evaluation while withholding production acceptance. The matrix is useful because it preserves the unresolved condition, not because it produces a flattering aggregate score.
Source context & further reading
Background on planning technical assessments, understanding technique limitations, analyzing findings, and mitigation. The worksheet here is an original planning aid, not a NIST checklist.
NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment
Use this planning aid alongside an approved engagement scope and qualified review. Illustrative examples are not customer results or product test evidence. The actual agreement determines permission, responsibilities, and acceptance.