Do you know this situation: You have are sitting on your desk when your boss asks you to “just have a look at an old software-system” at its current status? Since he doesn’t know much about your job (IT), you have to use a system that
a) he understands and
b) allows you to make an informed assessment relatively quickly.
Or a customer asks whether you could change this or that thing in a system you don’t know – or even take over the maintenance for it. And just like your boss, he is not an IT specialist!
There is a similar situation in the emergency services, namely when patients with impaired consciousness need to be assessed. The Glasgow Coma Scale https://en.wikipedia.org/wiki/Glasgow_Coma_Scale has proven its worth here. In this procedure, questions are used to test verbal and motor reactions as well as behavior in response to stimuli. Points are awarded depending on the results. If you add up the points, you get an indication of how critical the patient’s condition is or whether, for example, an emergency doctor should be called. So why not simply transfer this process to IT?
As I have had to carry out many assessments of this kind over the years, the following questions have proven to be useful. Simply answer them one after the other and then take a look at the results. You will be amazed at how quickly you can archive at an initial, well-founded assessment.

It would certainly be desirable if a productive system always received 12 points – unfortunately, my experience shows a completely different picture. I have not only seen one customer who operates a business-critical system that receives just 4! points.
Some Tips:
If you have the source code, that doesn’t mean it can be translated. I have already evaluated systems where individual files were missing or inconsistent.
Do you think access to the production system should be a matter of course? Particularly with customers whose business is not IT-related, it often happens that systems run for years without anyone taking care of them. And it is precisely with these systems that it is often difficult to find someone who is familiar with the system from an IT perspective.
Have a look around the social networks – sometimes you can still find one or two!
The remaining questions relate to how “secure” the system is currently being operated or whether an attempt should be made to find a replacement in the short term.
Let’s look at the questions and select what best applies to your system:
Current sources are fully available and translatable | 2 |
Sources are incomplete or not translatable | 1 |
Sources are not available | 0 |
Administrator has access to the server | 2 |
Users have access to the server | 1 |
No access to the server | 0 |
Development team is with the project | 2 |
Development team is accessible | 1 |
Developers can no longer be found | 0 |
Server has current hardware/operating system | 2 |
Server/operating system not up to date, but can be procured | 1 |
Server/operating system not up to date, new procurement not possible | 0 |
Third-party software running in the current version on a current operating system | 2 |
Third-party software running on a current operating system | 1 |
Third-party software not running on a current operating system | 0 |
Backup available – restore tested | 2 |
Third-party software running on a current operating system | 1 |
Third-party software not running on a current operating system | 0 |
Backup available – restore tested | 2 |
Backup available – restore not tested | 1 |
No backup available | 0 |
Evaluation
Points | Action |
12 | Everything ok! |
6-11 | Need to be prepared in the event of an error. |
0-5 | Immediate need for action. In an event of an error there is a chance, that the problem cannot be rectified Extensive preparatory work must be carried out. The system stability is acutely compromised. |
Just a little anecdote from practice
I once asked a customer whether he had ever tested the recovery for his backup. The answer came promptly: No – fortunately that has never been necessary! 🙂