Identify the authorised targets
List the applications, domains, addresses and environments included in the engagement. Confirm ownership and written permission, including any hosting or third-party conditions.
Agree the rules of engagement
Record testing windows, exclusions, incident contacts and escalation arrangements. State how the team will handle an unexpected impact or sensitive finding.
Specify the reporting
Agree both technical and management outputs. Findings should explain the affected asset, evidence, impact, practical corrective action and any limitations of the assessment.
Plan what happens afterwards
An assessment creates work to prioritise. Assign remediation owners and decide whether follow-up validation or a retest is required.
This guide is a planning aid. The scope and design for your environment should be agreed after discovery.