Engagement scopes

An engagement begins with a named client and a clear list of authorized targets. The security lead records the agreed start and end dates and attaches the authorization document to the same scope. A tester opening that record should be able to answer which assets are in scope and when testing is permitted. If the dates are reversed or the document is absent, the team should resolve the scope before relying on it for work.

• Record the boundary. Security Lead enters the client, authorized targets and testing dates on the engagement.
• Keep authorization nearby. Attach the authorization document to the same scope so Tester can check it before work begins.
• Trace a finding home. Open the engagement reference from a finding to compare its asset with the authorized targets.

Treat the authorized targets as the boundary for the engagement. Agree how precise the target identifiers need to be: a host, an application, or another asset identifier that the client recognizes. The dates represent the approved testing window. Changes to either should go through the person responsible for client authorization so testers do not work from an outdated instruction.

Security Lead should compare the authorization document with the target text and dates before a tester uses the scope. If an asset name in a finding is hard to match, clarify the target wording with the person responsible for authorization. Keep the attachment on the engagement so that a later reviewer can make the same comparison.

Use a sample engagement for a client with a short list of authorized assets and a short testing window. The security lead checks the client name, target text, start and end dates, and attached authorization. The tester then opens the engagement and compares the asset in a new finding to the approved targets. A finding links back to the engagement so its context can be traced after the test.

Ask the person receiving the work to open the record without extra explanation. They should be able to tell what the current state means, which evidence supports it, and what decision they are expected to make. If they cannot, revise the entry and repeat the handoff with the same case.

• Engagement windows — The client scope and testing dates are visible before work begins.
• Open security findings — Tester can follow unresolved findings back to their engagements.

See the related process for the handoff, decision and rehearsal. Review roles before granting access and the data model when preparing records.