Set the boundary

Which critical service are you assessing?

Choose an archetype. OSAF assesses one bounded service, not the organization as a whole.

Required outcomes

Why does operational control matter?

Select every outcome that would be materially affected by loss of provider cooperation.

Capability test

What remains demonstrably possible?

Answer four sample questions. A real assessment applies scenario-specific critical gates and reviews supporting evidence.

Evidence strength

What is the strongest evidence available?

Choose the strongest level that applies across the critical controls you just considered.

Illustrative result · Payroll Service

From evidence to a management decision.