Understand the need
Agree the assets, objectives, assessment method, permissions and limits.
Find and address security weaknesses.
Define the assessment you need, examine weaknesses and connect findings to prioritized remediation and retesting.
Vulnerability assessment & security testingSpecialist execution: confirmed per engagement.
WHEN THIS IS USEFUL
The situation
You need a clear view of the current position, accountable ownership and an agreed next step in this area.
The intended change
A scoped plan, reviewable evidence and practical actions proportionate to the business need.
Specialist service scope. Penetration testing is specialist execution. Tester capability, tools, written authorization and rules of engagement are confirmed before scheduling or delivery.
What the service covers.
Define the work
Plan or coordinate vulnerability assessment and, where separately authorized, penetration testing.
Review and improve
Review findings, assign remediation and agree verification or retesting evidence.
What an agreed engagement can produce.
| Deliverable | What it makes clear |
|---|---|
| Assessment and authorization brief | Assets, methods, exclusions, timing and rules of engagement. |
| Prioritized findings and remediation plan | Evidence, business implications, owners and dependencies. |
| Verification or retest record | Agreed checks, results and remaining limitations. |
Select and tailor the deliverables to the agreed scope, access, responsibilities and acceptance criteria.
What acceptance should establish
- The scope, authorization and accountable roles are explicit.
- Findings and completion decisions are supported by the agreed evidence.
- Limitations, unresolved actions and operating responsibilities are recorded.
Make the work concrete.
A situation to examine
An organization needs assurance about a business application before a change. Define the exact assessment question and authorization before choosing scanning, review or penetration testing.
What to measure
Track the agreed findings, unresolved actions, review evidence and demonstrated readiness against the scoped baseline.
Methods that support the work.
The service scope determines which methods, artifacts and review points are needed.
Questions about this service.
What is included in this area?
Define the assessment you need, examine weaknesses and connect findings to prioritized remediation and retesting.
How is delivery scoped?
Penetration testing is specialist execution. Tester capability, tools, written authorization and rules of engagement are confirmed before scheduling or delivery.
Define the next useful decision.
What business concern should this work address, and what evidence would justify the next decision?