Application take-over checklist: what to check before you inherit software
A printable checklist of what to check before taking over software another team built: access, code, infrastructure, security and documentation, with the cost.
National Digital designs, builds, hosts and supports the platforms it delivers, with no reseller or integrator between the client and its engineers.
Written by Cameron Young, CEO · Reviewed by Tara Buckley, COO on
- Software support and modernisation
- Application support
Quick answer:A checklist of what to check before taking over software another team built: access and ownership, code, infrastructure, security and documentation, with the Platform Health Check and take-over costs.
Quick answer
What should you check before taking over an application another team built?
Check who owns the accounts and hosting, what the code is made of, where and how it runs, how it handles security, and whether the documentation lets a new engineer operate it.
Additional Context
A Platform Health Check reports on these areas for a fixed fee and ends in one recommendation: support the platform, rebuild it in stages, or leave it as it is.
Sources
- OAIC – Australian Privacy Principle 11: Security of personal information
APP 11 requires reasonable steps to protect personal information for as long as it is held, and to destroy or de-identify it once it is no longer needed.
Take-over checklist
How to use this checklist
This checklist covers what to find out before you take over software that another team built. It follows the areas the Platform Health Check reports on, with the access handover that comes before any work. Print the page and mark each box against the system. A box you cannot tick is a question for the previous owner, or for a health check.
Access and ownership
- [ ] Who owns the hosting account, the domain and the code repositories, and are they named people or a supplier who has left?
- [ ] Which third-party services are wired in, and who holds the login for each?
- [ ] Where is each site or service hosted?
- [ ] Can the previous owner or provider hand over the accounts, the hosting and the repositories?
Access handover brings the accounts, hosting, repositories and third-party services under the client's ownership. We start work on an inherited platform by building a register of the external services wired into it, with a recorded login owner for each. We establish where each site is hosted before any work begins.
The code
- [ ] What is the platform made of, and how is it put together?
- [ ] Which dependencies are no longer maintained?
- [ ] How much of the code is covered by tests?
The infrastructure
- [ ] Where does it run, and what does it cost to run?
- [ ] How is it deployed?
- [ ] What would happen if the account holding it were lost?
Security and documentation
The security posture
These are the checks that most often change the picture on an application nobody has opened for a while. Each is a question about the application, and the answer comes from reading the code.
- [ ] Does every endpoint require a login?
- [ ] Does the authorisation layer run at all?
- [ ] How does user input reach the database?
- [ ] What decides a user's level of access?
- [ ] Are identifiers doing the work of permissions?
- [ ] What does the application trust the browser to tell it?
- [ ] What happens on repeated failed logins?
- [ ] Are uploads and generated documents private?
- [ ] What are the dependencies and the runtime running?
- [ ] Where do the credentials and secrets live?
- [ ] Who and what can reach the server?
The documentation
- [ ] Could an engineer who has never seen the platform operate it from what exists?
- [ ] Are the findings ranked by exposure, in the order they would be fixed?
Next step and cost
What the answers lead to
The Platform Health Check ends in one recommendation with the reasoning written down: support the platform as it stands, rebuild it in stages, or leave it with whoever runs it today.
What does a take-over cost?
The Platform Health Check costs $3,950 (Platform Health Check). Taking the system over after it costs $6,600 – $22,880 (Taking over a system (per month, first quarter)) a month for each of the three months of the first quarter. The project estimator has a take-over option that prints the same band. Every price National Digital publishes is in Australian dollars and excludes GST. A price range from National Digital is an indication and is not a quote.
Find out what you own
Start with a Platform Health Check. It reports on the code, infrastructure, security and documentation of the system you are taking over.
Take-over questions
What should I check before taking over an application?
Check who owns the accounts, the hosting and the repositories, what the code is made of, where it runs, how it handles security and whether an engineer who has never seen it could operate it from the documentation. The checklist on this page lists each question.
How much does it cost to take over an application?
A take-over starts with the Platform Health Check, a fixed-fee review of the code, infrastructure, security and documentation. It costs $3,950 (Platform Health Check). Taking the system over afterwards costs $6,600 – $22,880 (Taking over a system (per month, first quarter)) a month for the first quarter, ex GST.
What does the Platform Health Check recommend?
One of three outcomes, with the reasoning written down: support the platform as it stands, rebuild it in stages, or leave it with whoever runs it today. The report is the client's to keep.