The short answer
Start with the business decision the assessment must support, then identify the services and systems that affect it. Record exclusions and permitted review methods before any testing. The output is a conversation brief, not authorization to access or test systems.
How to use it
- Choose a specific business question, such as whether administrative work can continue during an email outage. Avoid starting with a list of scanning tools.
- List systems by role without entering addresses, credentials, or sensitive records. Distinguish business applications from operational technology and supplier-owned environments.
- Bring the brief to the scoping conversation. Agree methods, timing, evidence exchange, and escalation separately before work begins.
A worked example
Fictional example: a California professional services business wants to understand account access across email and billing. The proposed review includes interviews and administrative configuration evidence for those systems. Payment testing, supplier infrastructure, and penetration testing are excluded. The expected output is an access cleanup plan with owners and a list of unresolved evidence gaps.
Your worksheet
Use roles and high-level descriptions only. Do not enter passwords, personal information, confidential links, or client data. Notes stay in this open page and are lost on reload. Downloads are saved on your device.
What this does and does not establish
Completing this worksheet does not assess security, authorize technical testing, or produce a risk score. The agreed engagement determines the actual scope.
Sources
Worksheet design and fictional example: CyberWiz. The sources explain the underlying framework; they do not endorse this template.