Intermediate level · Module 6: Small Organisation Security Assessment · Lesson 1 of 3
Scoping and Permission
Agree exactly what will be assessed and get written permission.
In this lesson you will
- Write an assessment scope
- Obtain written permission
Key concepts
scopepermission letterconfidentialityrules of engagement
The lesson
An assessment begins with a written scope: which systems, locations and people are included, what methods will be used (interviews, observation, configuration review) and when.
Get written permission from someone with authority. Without it, even well-meant checks can be illegal and damaging.
Agree confidentiality: findings describe weaknesses and must be protected and shared only with the organisation.
Step by step
- Meet the organisation's contact.
- Draft the scope.
- Agree methods and dates.
- Obtain a signed permission letter.
Practice activity
Prepare the scope and permission letter for the project.
Expected result: A signed scope with methods, dates and confidentiality terms.
Check your understanding
-
Why is written permission essential?
Show answer
Unauthorised checks can be illegal and harmful.
-
Name two things a scope defines.
Show answer
Systems and locations included, methods used and dates.
Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.