Lines of questioning — Live technical

Point 8 — Iterate and improve frequently

Ask:

• How does an ordinary change reach production, and are users offline while it happens?
• What was the last user-facing release, and was it automated?
• What is the lead time from a merged change to live?
• Show a rollback you have done on the live service, or the reason you have not needed one and how you know it works.

Evidence to request: deployment pipeline, release log, evidence of zero-downtime or an honest description of the outage window.

Answers that indicate Met: automated releases that do not take the service down for routine changes.

Answers that indicate Not Met: manual deploys, or a standing maintenance window for ordinary work.

Point 9 — Create a secure service which protects users' privacy

Ask:

• When was the DPIA last updated, and what live processing does it miss?
• Who has production access this month, and who reviewed that list?
• What security scanning still runs on the pipeline?
• When did you last restore from backup, what did you restore, and how long did it take?

Evidence to request: current DPIA, access review, the disaster-recovery test log.

Answers that indicate Met: the test log exists and the DPIA matches live. A painful drill result with an owner is acceptable.

Answers that indicate Not Met: no restore has been attempted. Red line L2. Or the DPIA is the Beta document and the data has changed.

Point 14 — Operate a reliable service

Ask:

• What user-facing service level do you monitor, and who is paged?
• Walk through the incident runbook. When was it last used or rehearsed, and what did you change afterwards?
• What is the contract exit strategy? Can the department take the code, the data, and the ability to deploy?
• What vendor cannot be replaced inside the notice period, and is that on a risk register?

Evidence to request: monitoring view, on-call rota, runbook, rehearsal or incident record, exit plan, data-export test.

Answers that indicate Met: a person responds to a user-facing alert, the runbook has been exercised (L1 clear), the drill has a result (L2 clear), and exit is a plan the team has read (L3 clear).

Answers that indicate Not Met:

• the runbook has never been opened (L1)
• disaster recovery is a vendor brochure (L2)
• only the supplier can deploy, or the data cannot leave (L3)

Reopen points 11 and 12 only if something changed

If the stack or the contract is the same as at Beta, say "not reassessed" in the narrative and do not emit a decision. If the supplier, the hosting, or the repository visibility changed, score 11 and 12 against the Beta technical questions and record why.