Checklist / Assessment scoping checklist
A useful assessment starts with a clear agreement.
The scope connects your question to the work that can answer it. Bring this checklist to an assessment conversation to identify what belongs in the engagement, who can authorize it, and how your team will receive and use the findings.
Agree the important boundaries
Business question
The decision the assessment should support
Included assets
Known properties, owners, and exclusions
Operating agreement
Permissions, contacts, and stop conditions
Expected handoff
Deliverables, readout, and follow-up scope
A clear scope connects the question, asset boundary, operating conditions, and output.
01 / Checklist
Define the question and the asset boundary
Begin with the outcome you want, then establish the organizational perimeter. Names that appear related may belong to a partner, former subsidiary, or shared provider. Treat those connections as ownership questions until confirmed. Document the starting inventory and explain how newly discovered assets will be reviewed, so discovery can expand understanding without silently expanding testing permission.
FIELD NOTES
- State the primary question and the decisions the report should inform.
- Identify included domains, applications, brands, and environments.
- List exclusions and the process for approving scope changes.
02 / Checklist
Agree on operating conditions
People and permissions are part of the scope. Name the person who owns the engagement and the people who can approve testing or resolve asset questions. Establish permitted techniques, operating windows, and stop conditions before activity begins. Include an escalation route for urgent observations and an agreed approach to sharing evidence that could reveal sensitive details.
FIELD NOTES
- Confirm authorization and any separate provider permissions.
- Name primary, backup, and urgent escalation contacts.
- Agree how to pause work and handle sensitive evidence.
03 / Checklist
Make the output and follow-up explicit
The proposal should connect each deliverable to a useful decision or workflow. Agree on the report format, technical audience, leadership readout, schedule, and fee. Clarify whether remediation discussion or retesting is included, and what additional work would need a new agreement. This gives both teams a shared definition of completion before the assessment starts.
FIELD NOTES
- Specify the exposure inventory, finding records, and action plan.
- Confirm the readout audience and the required handoff format.
- Record retest coverage, responsibilities, and acceptance conditions.