Readiness Reviews (Go-Live Gate)

Review a system across the nine domains before it goes live, record findings as roadmap items, give one go, conditional go or no-go verdict with its rationale, have the client's signatories sign it, and take a PDF to the go/no-go meeting.

A readiness review is the go-live gate for one system: a migration, a new integration, a model about to be used on real data. You work the nine domains of the nine-domain baseline, record what you find, and give one verdict. The gate is the cheapest place to say no.

The Readiness tab lists a client's reviews with their verdict, open findings, signatures and go-live date. New review starts one.

The system

Field	Notes
System	What goes live, for example "PHI data warehouse, on-premises to SaaS".
Data classification	For example "Restricted: HIPAA PHI".
Go-live	The date. Until a verdict is given, it comes due on Monitoring.
Scope	What is in and out of this review.
Rollback tested	Tested in the production configuration. A go needs it.
Assets it covers	The client's assets in scope. Crown jewels and critical assets are marked, and signatories see them.
Vendors it relies on	The client's vendors. A vendor whose last review is past its cycle, or that was never reviewed, is flagged: a clean report that predates the vendor's last change is a red flag.

The nine domains

For each domain, choose an outcome and write down what you saw:

Verified: with the evidence, seen in the production configuration and not taken from a design document.
Finding: a gap. Record it under Findings.
Not applicable: with the reason, for example D9 for a system with no AI or machine learning.

What to verify under each domain lists that domain's baseline practices.

Findings

A finding is a roadmap item tagged with the review and the domain it was found in. Add finding opens the roadmap form with the review filled in. Give each one:

the missing control in one sentence;
one named owner;
a date;
how it will be verified;
the compensating control in place today.

Severity is the item's priority. Findings also appear on the roadmap as "Finding of RR-001 · D5", and they stay there if the review is deleted.

The verdict

The Verdict card says, for each verdict, what stops it being given now:

Verdict	Can be given when
Go	Every domain is verified or not applicable, with evidence; no open critical or high finding; rollback is tested.
Conditional go	Every domain is reviewed, and every open finding is a plan: it passes the plan check (one named owner, a date inside 30 days or an accepted risk, how it is verified) and has a compensating control. There must be at least one open finding.
No-go	Any time, with a re-review date. The re-review comes due on Monitoring.

The Verdict card on a sample review: a conditional go with its rationale, Go blocked because D5 has a finding and RM-001 is an open high finding, Conditional go and No-go can be given now, and the rationale and re-review fields

Every verdict needs its rationale: the reasoning you would defend. Changing the system or the domains afterwards clears the verdict and withdraws any signature links still waiting, so a verdict always matches what it describes. You can also give the verdict again; earlier signatures stay recorded against the earlier verdict.

Signatures

Once a verdict is given, Ask someone to sign sends one of the client's contacts a personal link, by email or to copy when email is off. The contacts are the client's named signatories, such as the CISO, compliance, the business owner or counsel. The link works once and expires in 14 days.

The page behind the link shows, frozen when the verdict was given:

the verdict and its rationale;
the system, its data, the go-live date, the assets it covers and whether rollback was tested;
the conditions with their owners, dates, verification and compensating controls;
the nine domains with their outcomes, folded under The nine domains reviewed for anyone who wants them.

The signatory types their full name and chooses Sign the verdict or Decline, with an optional comment. The review shows how many have signed; it reads Signed when everyone asked has signed.

The PDF for the meeting

PDF for the meeting produces the record for the go/no-go meeting:

the verdict, its rationale, and a summary line with the date, domains, conditions, rollback and signatures;
the nine domains;
the conditions as What, Who and when, Verified by, and Meanwhile;
the signatures.

It uses the practice's branding.