Set the boundary

Which critical service are you assessing?

Choose an archetype. OSAF assesses one bounded service—not the organization as a whole.

Payroll ServiceSaaS · identity · HRIS · banking Identity ServiceAuthentication · privilege · application access AI AssistantModel API · data · safeguards · workflow Custom ServiceApply the demonstration to your own boundary

Required outcomes

Why does operational control matter?

Select every outcome that would be materially affected by loss of provider cooperation.

Privacy & ComplianceLawful, governed access and protection Continuity & ResilienceEssential outcomes remain available Supplier Choice & CompetitionCredible substitution and exit Strategic FlexibilityAbility to adapt as conditions change

Capability test

What remains demonstrably possible?

Answer four sample questions. A real assessment applies scenario-specific critical gates and reviews supporting evidence.

Evidence strength

What is the strongest evidence available?

Choose the strongest level that applies across the critical controls you just considered.

Illustrative result · Payroll Service

From evidence to a management decision.

Current postureOS-1

Formal Protection

Illustrative targetOS-3 · Operational Autonomy

Strongest area

Critical dependency

Evidence gap

Suggested next action

Illustrative demonstration—not a completed OSAF assessment. This result explains the method. It is not a mathematically authoritative score, certification or assurance conclusion.

Understand the framework