Define the decision
Business objective, critical assets, threat context, stakeholders, assumptions and success criteria are documented before testing.
Methodology · Evidence · Assurance01 · DISCOVER 02 · AUTHORISE 03 · ASSESS 04 · PRIORITISE 05 · COMMUNICATE 06 · VALIDATE
A security finding should survive scrutiny.
Our assessment method connects authorised testing, reproducible evidence and business context to remediation that teams can verify.
Method status. This is HAPSA's standard assessment framework. The signed statement of work and rules of engagement always control the actual engagement.
Set safe boundaries
Written authorisation, scope, exclusions, testing windows, rate limits, emergency contacts and stop-work conditions are agreed.
Collect reproducible evidence
Manual-led testing combines standards-based checks with context-specific abuse cases. Observed, inferred and untested conditions are separated.
Connect risk to action
Findings are ranked using exploitability, exposure, business impact, control strength and compensating safeguards—not severity labels alone.
Report for two audiences
Executives receive decisions and risk themes; technical teams receive evidence, affected assets, reproduction guidance and remediation.
Retest what changed
Agreed fixes are retested against the original evidence. Residual risk, partial fixes and accepted exceptions remain visible.
Evidence and data handling
A defensible result depends on how evidence is collected and controlled.
- Minimum necessary: capture only the evidence needed to substantiate a finding.
- Secure transfer: agree encrypted channels and authorised recipients before sensitive reporting.
- Retention: define the engagement-specific retention period and deletion responsibility in writing.
- No surprise testing: social engineering, denial-of-service, destructive actions and third-party assets are excluded unless explicitly authorised.
- Quality gate: high-impact findings receive technical review before final release.
| Deliverable | Purpose | Minimum contents |
|---|---|---|
| Rules of engagement | Protect both parties | Scope, authority, windows, contacts, prohibited actions and stop conditions |
| Executive summary | Support decisions | Objectives, material risks, themes, limitations and prioritised next steps |
| Technical findings | Enable remediation | Evidence, affected assets, risk rationale, references, remediation and verification |
| Coverage record | Show what was tested | In scope, sampled, excluded, unavailable and not tested |
| Retest record | Close the loop | Original finding, change observed, result and residual risk |
Turn the next security decision into a clear scope.
Tell us what you need to protect, prove or improve. We will define the evidence, boundaries and next action before work begins.