Clear expectations for work on important systems.
Trust starts with knowing who may do what, how decisions are made and what happens to the information involved. These topics are covered when an engagement is scoped.
Authorization and access
Identify the authorized owner, the systems covered, permitted methods and the people performing the work. Agree how access will be granted and removed. Contacting us through the website does not authorize security testing.
Information handling
Agree what information is needed, how it will be exchanged, who may receive it and the applicable retention or deletion arrangements. Use an agreed exchange method for sensitive reports and technical evidence.
Operating changes
Set approval responsibilities and identify possible interruptions. Where applicable, agree validation, backup and rollback provisions before implementation.
Findings and escalation
Define how urgent observations are raised and how technical findings are reviewed. Distinguish verified issues, recommendations and open questions in the reporting.
Ownership and handover
Agree the deliverables, account ownership and handover information. Record who will maintain changes and address remaining actions.
Questions about a proposed engagement?
Ask for the relevant scope, delivery qualifications and working arrangements before deciding to proceed.