Free · Ungated · Practical

Software Project Handover Checklist

Changing the team should not mean losing control. Use this checklist to make sure the next people can understand, build, protect and operate the software your organisation depends on.

Start the checklist Project rescue support

Illustrated preview of a software handover checklist, with sections for ownership, code, cloud accounts, data, operations and team knowledge. — A preview of the areas covered. The interactive, printable checklist follows.

View source guidance

1. Scope, ownership and decision rights

Agree what is transferring, who can make decisions and where contractual or ownership questions need separate advice.

List the applications, environments, modules and business-critical journeys included in the handover.
Name the business owner, technical contact, outgoing supplier and incoming team.
Locate contracts, licences and written agreements covering source code, designs, data and third-party components.
Record what is owned, licensed, excluded, disputed or still awaiting confirmation.
Agree who approves access, production changes, spending and incident decisions.

2. Repositories and engineering history

Give the organisation administrative control and enough context to reproduce the current software.

Transfer organisation-owned administration of code repositories, issue trackers and package registries.
Identify the production branch, release tags, important commits, open pull requests and known work in progress.
Document how to clone, configure and build each application from a clean environment.
List required runtimes, package versions, private registries, licences and external build dependencies.
Record known defects, fragile components, unsupported versions and decisions that constrain future changes.

3. Build, release and rollback

Make release steps repeatable and clarify which changes need review or approval.

Map development, test, staging and production environments and how configuration differs between them.
Document build pipelines, deployment permissions, approval gates and release ownership.
Identify database migrations, feature flags, scheduled jobs and manual production steps.
Prove the latest release can be built and deployed through a controlled non-production path.
Document rollback or recovery steps and the point at which a release should be stopped.

4. Cloud, domains and infrastructure

Keep core accounts under the organisation's control and retain a clear record of the live environment.

List cloud, hosting, DNS, domain, certificates, email and observability providers.
Confirm the organisation controls billing, recovery methods and administrator identities.
Record regions, production resources, network boundaries and infrastructure-as-code locations.
Inventory third-party services, API integrations, service accounts and renewal dates.
Confirm who controls mobile app-store listings, signing credentials, payment-provider accounts and other customer-facing vendor relationships.
Identify supplier-managed infrastructure and agree when its access will end.

5. Data, backups and recovery

Understand what the system stores and demonstrate that important data can be recovered.

Map databases, object storage, data exports, retention rules and important data flows.
Record which data is personal, commercially sensitive or subject to special handling.
Locate backup schedules, retention periods, encryption and the people responsible for recovery.
Verify a restore in an appropriate non-production environment before relying on the backup.
Agree secure transfer, deletion and retention steps for copies held by outgoing suppliers.

6. Identities, secrets and access

Transfer access deliberately. Do not send passwords, private keys or production secrets in ordinary email or this checklist.

Inventory user accounts, service identities, privileged roles, MFA and recovery contacts.
Grant named people only the access needed for their role and remove unused permissions.
Locate secrets in approved vaults and document how authorised people request them.
Plan credential and signing-key rotation after the new owner has secure access.
Review audit logs and agree how security events and access changes will be monitored.

7. Integrations, incidents and support

Make the live service understandable before accepting ongoing operational responsibility.

Map inbound and outbound integrations, webhooks, certificates, API limits and failure behaviour.
Collect open incidents, recurring problems, known workarounds and current operational risks.
Locate dashboards, alerts, application logs, infrastructure events and incident contacts.
Document support intake, business hours, escalation, responsibilities and out-of-hours boundaries.
Identify the important user journeys and how the team can tell when they are failing.

8. Runbooks, people and supplier exit

Transfer the knowledge that currently lives in individuals' heads and agree when the old access ends.

Collect architecture notes, service maps, runbooks, operational decisions and known limitations.
Schedule walkthroughs with people who understand key workflows, releases and support history.
List mobile app stores, payment accounts, analytics, messaging providers and publisher permissions where relevant.
Agree a handover owner, open-question log, acceptance criteria and the date responsibilities transfer.
After acceptance, remove outgoing access and confirm receipt, retention or deletion of organisation data.

9. First-week checks for the incoming team

Use evidence to choose a safe first step; do not promise a rewrite before the application is understood.

Reproduce the current build and note any missing access, undocumented dependency or manual step.
Trace a critical user journey through the application, integrations, data and operational signals.
Check the latest backup and rehearse a suitable restore or recovery path.
Agree a prioritised list of urgent risks, open questions and reversible improvements.
Confirm support boundaries and the approval path before changing production.

Use with care. This checklist is an operational prompt, not legal, data-protection or security advice. Contractual ownership and personal-data responsibilities depend on the specific arrangement. For personal-data processing changes, confirm the controller/processor roles, contract and secure transfer with the responsible parties.

Guidance: NCSC guidance on using cloud platforms securely and ICO guidance on processor contracts and data sharing. The checklist turns general guidance into questions to discuss; it does not replace the organisations' own risk assessment or professional advice.

Need a safe next step?

If delivery is stalled or production is unstable, start with a recovery assessment. If the system is broadly stable, discuss a support takeover.

Discuss the handoverinfo@duniaops.com