Controlled from confidential scoping to verified retest.

1. 01

   1. Scope and authorize

   Define objectives, systems, environments, roles, exclusions, testing windows, contacts, evidence handling, and written permission.

2. 02

   2. Assess and verify

   Combine appropriate tools with manual review while respecting rate, availability, data, and production constraints.

3. 03

   3. Report and explain

   Deliver prioritized findings, sanitized evidence, business impact, remediation guidance, and a walkthrough for responsible stakeholders.

4. 04

   4. Remediate and retest

   Implement agreed work or support the responsible team, then verify the affected behavior and update the finding status.

• Do not send passwords, private keys, source archives, or backup files in an initial inquiry.
• Create a named temporary account after the scope and exchange method are agreed.
• Grant only the privileges needed for the approved work.
• Set an expiry where the platform supports it.
• Remove the account and rotate affected secrets after completion.

Production constraints, prohibited actions, rate expectations, maintenance windows, monitoring, and emergency contacts are documented before active testing. Destructive testing is not implied by an assessment request.

If a critical issue is confirmed during the engagement, the agreed escalation contact receives the minimum necessary information to begin containment rather than waiting for the final report.

• Open and resolved findings are clearly distinguished.
• Provider or client dependencies remain visible.
• Retesting is limited to the agreed remediation unless a wider reassessment is requested.
• Temporary access is removed and evidence retention follows the agreement.
• Ongoing monitoring is a separate decision, not an assumed subscription.