# Restricted Release Readiness Checklist for Software Vendors

Use this checklist before sending software into restricted, offline, air-gapped, defence, aviation, maritime, government or critical infrastructure environments.

## Release Identity

- Product name, version and release date are clear.
- Build source, CI run and commit SHA are recorded.
- Release owner and security contact are named.
- Previous release version is identified for update comparison.

## Local Evidence Generation

- Evidence generation ran locally or in CI controlled by the vendor.
- Source code was not uploaded to a SaaS tool by default.
- Release pack output was stored in a controlled location.
- Checksums were generated for release evidence artefacts.

## SBOM and Vulnerabilities

- SBOM summary is available for buyer review.
- Vulnerability summary includes severity counts.
- Critical findings are remediated or explicitly rejected.
- High findings are reviewed with fixed-version notes where available.
- Known scan limitations are disclosed.

## Deployment Metadata

- Services and container images are listed.
- Exposed ports are listed.
- Environment variable names are listed without secret values.
- External endpoints and licence/auth/telemetry references are reviewed.
- Install prerequisites are documented.

## Operational Readiness

- Install guide has been tested.
- Rollback guide names the previous release pack and restore steps.
- Health verification steps are defined.
- Update diff identifies changed services, ports, env vars, endpoints, components and vulnerabilities.

## Buyer Review

- Approval status is clear.
- Blockers and warnings are documented.
- Evidence PDF/HTML is suitable for procurement and security stakeholders.
- No classified, export-controlled or customer-sensitive source material is included.

## SaaS Upload Boundary

- Metadata upload is explicit.
- CLI token scopes are limited.
- Raw source files, raw SBOMs, raw vulnerability reports and full file inventories are excluded.
- Optional evidence PDF upload is approved by the organisation.

## Final Sign-Off

- Product owner approved the release.
- Security reviewer approved or rejected exceptions.
- Audit trail contains release upload and approval decisions.
- Buyer-facing pack is ready to send.