Connections

• Testing tools. Decide how observations and supporting files from the team’s tools become evidence on the relevant security finding.
• Client communication. Decide how the person responsible for the engagement shares scope changes and finding outcomes with the client.
• Issue tracking. If remediation is managed elsewhere, agree how the owner will reconcile the external issue with the finding’s asset, evidence and status.
• Document storage. Agree which authorization and controlled-document files belong in the app and which source remains in a separate repository.

Name an owner for each connection and review the information it transfers. The engagement scope defines the targets and dates that the team works against. A change in another system should be checked against the recorded authorization before it affects testing. Reconcile a sample issue and a sample document through the whole handoff before the first live cycle.