Scope and authorization document
Written agreement on targets, timing, methods and exclusions, signed before any testing begins.
Other Services
IT Audits and Vulnerability Assessment
A structured review of IT controls and a technical vulnerability assessment of your external and internal footprint, with findings ranked by real risk.
What it is
This combines an IT controls review with a technical vulnerability assessment. The controls review looks at access management, change control, backup and recovery, asset management, logging and vendor oversight. The technical assessment scans your external and internal footprint for known vulnerabilities, weak configuration and exposed services.
Findings are ranked by exploitability and business impact together, not by scanner severity alone. A critical-rated finding on an isolated test box matters less than a medium-rated one on an internet-facing system holding customer data, and the report should say so.
To be clear about scope: this is a vulnerability assessment, not a penetration test. We identify and verify weaknesses; we do not attempt to exploit them to establish a foothold. If you need a penetration test or a formal certification audit, we will tell you and point you toward a specialist.
Who it is for
- Small and mid-sized organizations without an internal security function
- Companies responding to customer or insurer security questionnaires
- Leaders who have never had an independent view of their IT risk
- Organizations preparing for a formal audit who want to find issues first
What is included
The deliverables below are the default scope. We adjust them to your situation during scoping and confirm the final list in writing.
Asset and exposure inventory
What exists and what is reachable, including assets nobody had on a list.
Vulnerability findings register
Each finding with evidence, affected assets, exploitability, business impact and remediation guidance.
IT controls assessment
Access management, change control, backup and recovery, asset management, logging and vendor oversight.
Prioritized remediation plan
Immediate actions, near-term fixes and structural improvements, with effort indications.
Executive summary
A non-technical summary suitable for a leadership team or board.
Process and timeline
Indicative timings for a typical engagement of this type. Your scope, environment and availability of stakeholders will move them.
-
Scope and authorize
Define targets and rules of engagement in writing. Nothing is tested without written authorization.
-
Discovery
External and internal asset discovery to establish what is actually exposed.
-
Assessment
Authenticated and unauthenticated scanning, configuration review, and manual validation to remove false positives.
-
Controls review
Interviews and document review against the control areas in scope.
-
Report and readout
Findings register, remediation plan and sessions for technical and executive audiences.
Outcomes we aim for
These are the goals we design the engagement around. They are objectives, not guarantees, and the result depends on decisions and effort on your side as much as ours.
- An evidence-based view of your current exposure
- Findings ranked by real risk rather than scanner severity
- A remediation plan sequenced by impact and effort
- Better-prepared answers to customer and insurer security questions
Questions
About it audits and vulnerability assessment
Is this a penetration test?
No. A vulnerability assessment identifies and verifies weaknesses; a penetration test attempts to exploit them and chain access. If you need the latter, say so and we will tell you honestly whether we are the right firm for it.
Will the assessment disrupt our systems?
We scope to avoid it: scanning is scheduled, intrusive checks are agreed in advance, and production-sensitive systems can be tested in a window you choose. All of this goes into the written rules of engagement.
Do you help fix what you find?
We can, and we will also be clear when your existing provider is better placed to do the remediation. The report is written to be actionable by whoever does the work.
Is it audits and vulnerability assessment the right next step?
Tell us the symptom rather than the solution. If a different service fits better — or none of ours does — we will say so.