The 12 readiness questions explained: what evidence to collect

How the worksheet scores

The IT/OT readiness assessment asks twelve questions. For each one you choose Unknown / absent (0 points), Partly in place (1 point) or Verified (2 points), for a maximum of 24. All questions weigh the same. The score is a conversation starter for the kickoff meeting, not a benchmark and not a certification.

The one rule that matters: choose Verified only when you can point at current evidence. “We think so” is Partly in place. This article explains what evidence to look for in each question, grouped by theme.

Outcome and ownership (questions 1 and 2)

• 1. Is the production goal and success measure defined? Verified looks like one written production goal, a measured baseline and an acceptance criterion that someone outside the project would accept. “Improve OEE” is a wish; “raise measured OEE on line 2 from the current baseline to an agreed target over a defined period” is a goal.
• 2. Is there an OT asset inventory with owners? Evidence is a list of controllers, drives, switches and gateways with firmware versions, locations and a named owner for each, built passively. See building an inventory without disrupting production.

Data (questions 3, 4, 8 and 9)

• 3. Are data sources and access permissions verified? For each device: the protocol, connection limits and a confirmed read-only access path that has actually been tested.
• 4. Are tag meanings, units and timestamps defined? A data contract with units, time source, quality code and scaling for each signal. The data contract template provides the structure.
• 8. Is data behavior during a disconnect defined? A written policy for buffering, timestamps, replay and duplicate handling, ideally with a test where the link was deliberately cut. See the MQTT disconnect recovery test plan.
• 9. Is data quality measured? A recurring measurement of missing data, stale values, clock drift and unit errors, with a number attached rather than an impression.

Network and access (questions 5 and 6)

• 5. Are network zones and data flows documented? A diagram and a table of permitted flows agreed with the network team, so that every new connection is a deliberate decision. See OT subnet planning.
• 6. Is remote access approved and time limited? Named accounts, multifactor authentication and a record of each session, with access that expires. The vendor remote access session checklist turns this into a procedure.

Resilience and change (questions 7 and 10)

• 7. Has a restore from backup been tested? A backup that has never been restored is a hypothesis. Evidence is a dated record of restoring a controller program or configuration in an authorized test environment, with the outcome. The PLC backup and restore drill worksheet gives you the steps.
• 10. Is there a change and rollback plan? An owner, a maintenance window, a fresh backup and a stated trigger for rolling back.

Adoption (questions 11 and 12)

• 11. Can the operations team use the result? One real decision scenario tested end to end with an operator, who found the information readable and actionable at the point where they need it.
• 12. Are pilot acceptance and rollout criteria defined? Acceptance stated in terms of evidence, timing, owners and cost assumptions, agreed before the pilot starts. The OEE pilot acceptance guide shows what this looks like for one common pilot.

Turning the result into a plan

The tool sorts the questions you did not mark as verified, weakest first, and turns each into an action. Resist the urge to fix everything at once. Pick the two or three lowest-scoring items that block your goal in question 1, assign owners and dates, and re-run the worksheet at the next review. If you want to discuss the plan with ASP Dijital, the tool can open the contact form with a summary you can edit before sending. The wider sequence for the first month is in the first 30 days of an IT/OT project.