01 — Discover
Understand business drivers, stakeholders, assets, architecture, threat concerns, dependencies, and success criteria.
02 — Define
Document objectives, in-scope assets, exclusions, testing windows, rules of engagement, communication channels, escalation paths, and authorization.
03 — Assess
Perform the agreed technical assessment, control review, analysis, or advisory work using suitable methods and evidence collection.
04 — Analyze
Validate findings, remove unsupported observations, assess exploitability and impact, and relate technical weaknesses to business context.
05 — Prioritize
Rank issues using severity, likelihood, exposure, asset criticality, threat context, and remediation feasibility.
06 — Recommend
Provide actionable remediation guidance, compensating controls where appropriate, and a practical improvement roadmap.
07 — Validate & Improve
Where contracted, retest remediated issues, verify control changes, and capture lessons for ongoing security improvement.
Reporting principles
- Executive reporting communicates material risk, business impact, and recommended decisions.
- Technical reporting includes reproducible evidence, affected assets, severity rationale, and remediation detail.
- Confirmed findings, potential risks, assumptions, and limitations are clearly separated.
- Recommendations consider operational impact and implementation dependencies.
Security testing is conducted only with appropriate written authorization, agreed scope, rules of engagement, communication paths, and safeguards.
