Security assessment scoping and evidence worksheet

How to use this resource

Intended for IT leaders, security teams, assessors, system owners, project managers, and procurement teams. Typical completion time: 60 to 120 minutes for initial scoping, followed by evidence collection.

• Name the decision the assessment must support before collecting evidence.
• Record the source, owner, date, and scope for each item of evidence.
• Sample where full review is impractical, and document the selection method and limitation.
• Distinguish a missing control from missing evidence. They are not the same conclusion.
• Do not collect secrets or personal information unless the scope requires it and an approved handling method exists.
• Record exclusions and unresolved questions in the final deliverable.

1. Assessment charter

• FieldsAssessment title and identifier
• FieldsExecutive sponsor
• FieldsAssessment lead
• FieldsBusiness and technical contacts
• FieldsDecision or question this assessment must support
• FieldsIn-scope business processes, systems, locations, data, identities, networks, cloud services, and third parties
• FieldsExplicit exclusions
• FieldsAssessment period and evidence cut-off date
• FieldsRequired framework, contract, policy, or control reference, if any
• FieldsPermitted methods and prohibited activities
• FieldsEscalation contact for urgent findings
• FieldsDeliverables, audience, and acceptance criteria

2. Environment context

• PromptsWhich services or business processes are most important, and who owns them?
• PromptsWhat data is created, received, stored, transmitted, backed up, and destroyed?
• PromptsWhich identities, providers, sites, networks, and platforms support the scope?
• PromptsWhat major changes occurred during the review period?
• PromptsWhich legal, contractual, insurance, privacy, or records requirements has the organization already identified?
• PromptsWhat previous assessments, incidents, outages, exceptions, or accepted risks are relevant?
• PromptsWhich diagrams and inventories are current, and when were they last validated?

3. Control review domains

• DomainsGovernance and ownershipReview prompts
  • Security responsibilities are assigned and understood.
  • Policies and standards have owners and review dates.
  • Exceptions and risk acceptance have expiry and approval.
  • Material suppliers and service dependencies have accountable owners.
  Example evidence
  • Role descriptions
  • policy register
  • risk register
  • exception records
  • committee records
• DomainsAsset and service inventoryReview prompts
  • In-scope hardware, software, cloud resources, network devices, data stores, and service owners can be identified.
  • Inventory changes are maintained through a defined process.
  • Unsupported or unknown assets are investigated.
  Example evidence
  • Asset inventory
  • cloud inventory export
  • network discovery results
  • software inventory
  • service catalogue
• DomainsIdentity and accessReview prompts
  • Joiner, mover, and leaver access is controlled.
  • Privileged access is separate, limited, and reviewed.
  • Strong authentication is applied according to risk.
  • Service accounts, secrets, and emergency access have owners and lifecycle controls.
  Example evidence
  • Identity configuration
  • access review sample
  • privileged group export
  • MFA policy
  • service-account register
  • offboarding sample
• DomainsEndpoint, server, and platform securityReview prompts
  • Supported configurations and hardening expectations are defined.
  • Security updates are assessed and deployed through an owned process.
  • Endpoint protection coverage and health are monitored.
  • Administrative interfaces are restricted and logged.
  Example evidence
  • Configuration baseline
  • patch reports
  • endpoint coverage report
  • management network rules
  • exception tickets
• DomainsNetwork securityReview prompts
  • Trust boundaries and externally exposed services are known.
  • Firewall and cloud network rules have owners, reasons, logging, and review dates.
  • Administrative access is restricted.
  • Remote access, wireless, DNS, VPN, and segmentation controls match documented requirements.
  Example evidence
  • Current diagrams
  • firewall exports
  • cloud security policies
  • VPN settings
  • wireless configuration
  • network access-control records
• DomainsVulnerability and change managementReview prompts
  • Relevant vulnerabilities are identified, validated, prioritized, assigned, and tracked to closure or acceptance.
  • Changes are tested and approved according to risk.
  • Emergency changes receive review.
  • Rollback and post-change validation are part of production change records.
  Example evidence
  • Scan scope and results
  • remediation tickets
  • risk acceptance
  • change samples
  • emergency-change review
• DomainsLogging, monitoring, and detectionReview prompts
  • Required security and administrative events are logged.
  • Time synchronization, retention, access, and integrity needs are defined.
  • Alerts have owners and tested response paths.
  • Coverage gaps and disabled sources are visible.
  Example evidence
  • Logging standard
  • source inventory
  • retention settings
  • alert sample
  • on-call record
  • detection test evidence
• DomainsData protection and privacy supportReview prompts
  • Sensitive data locations and transfers are understood within scope.
  • Access, retention, disposal, encryption, and backup practices reflect approved requirements.
  • Privacy or legal specialists are involved where interpretation is required.
  Example evidence
  • Data-flow diagram
  • classification standard
  • retention schedule
  • encryption settings
  • disposal records
  • privacy review
• DomainsThird-party and cloud servicesReview prompts
  • Security responsibilities between the organization and provider are understood.
  • Critical providers have current contacts, dependencies, and exit or recovery considerations.
  • Contractual security requirements and evidence are tracked by appropriate owners.
  Example evidence
  • Responsibility matrix
  • contracts or requirement extracts
  • assurance reports
  • provider incident process
  • dependency register
• DomainsIncident responseReview prompts
  • Roles, declaration authority, communications, evidence handling, and external contacts are documented.
  • The plan addresses loss of normal identity, email, or network services.
  • Exercises produce owned actions and plan updates.
  Example evidence
  • Incident plan
  • contact list
  • call tree test
  • exercise record
  • after-action items
  • forensic readiness notes
• DomainsBackup, continuity, and recoveryReview prompts
  • Business owners have defined recovery objectives and acceptable data loss.
  • Backups, credentials, documentation, and recovery infrastructure are protected from common failure modes.
  • Complete service recovery is tested and evidenced, not inferred from backup-job success.
  Example evidence
  • Recovery objectives
  • backup policy
  • job and immutability settings
  • restore-test record
  • dependency map
  • recovery runbook
• DomainsSecurity awareness and operational readinessReview prompts
  • People receive role-appropriate guidance.
  • Reporting channels are easy to find and tested.
  • Administrators and responders rehearse tasks that differ from normal operations.
  Example evidence
  • Training record
  • reporting procedure
  • phishing-report workflow
  • administrator exercise
  • lessons learned

4. Evidence register

• Repeatable columnsEvidence ID
• Repeatable columnsDomain
• Repeatable columnsDescription
• Repeatable columnsSource system or custodian
• Repeatable columnsOwner
• Repeatable columnsCollection date
• Repeatable columnsPeriod covered
• Repeatable columnsIntegrity or export notes
• Repeatable columnsSensitivity
• Repeatable columnsStorage location
• Repeatable columnsReviewer
• Repeatable columnsEvidence status
• Repeatable columnsRelated finding IDs

5. Finding record

• Repeatable fieldsFinding ID and title
• Repeatable fieldsAffected scope
• Repeatable fieldsCondition observed
• Repeatable fieldsEvidence IDs
• Repeatable fieldsExpected control or requirement and source
• Repeatable fieldsThreat or failure scenario
• Repeatable fieldsBusiness and technical consequence
• Repeatable fieldsLikelihood and impact rationale
• Repeatable fieldsExisting and compensating controls
• Repeatable fieldsRisk rating using the approved method
• Repeatable fieldsRecommendation
• Repeatable fieldsAlternative options
• Repeatable fieldsDependencies and change risk
• Repeatable fieldsOwner
• Repeatable fieldsTarget date
• Repeatable fieldsManagement response
• Repeatable fieldsException or acceptance approval and expiry
• Repeatable fieldsClosure evidence
• Repeatable fieldsValidation date and reviewer

6. Quality and closeout checks

• ChecklistEvery conclusion is tied to evidence or clearly labelled as unverified.
• ChecklistThe report states scope, exclusions, dates, methods, sampling, and access limitations.
• ChecklistFactual accuracy was reviewed by appropriate system owners without allowing owners to erase supported findings.
• ChecklistUrgent issues were escalated through the agreed path.
• ChecklistRecommendations include dependencies and operational risk where known.
• ChecklistActions have owners; accepted risks have authority, rationale, and review dates.
• ChecklistSensitive working material is retained or disposed of according to the engagement terms.
• ChecklistThe final report does not claim certification, legal compliance, or complete security unless a qualified and authorized process supports that exact claim.

Important limitations

For general operational use only. These materials are not legal advice, compliance advice, a warranty, or a complete control framework. Using a template does not establish that a change, assessment, incident plan, or recovery capability is adequate. Obtain appropriate technical, legal, privacy, insurance, and regulatory advice for your circumstances.

• This worksheet supports structured review. It is not, by itself, a security standard, audit opinion, certification, or determination of legal compliance.
• Do not place passwords, private keys, recovery codes, sensitive personal information, or unredacted secrets in forms, worksheets, tickets, or email. Use an approved secure channel for confidential material.
• Resource version 1.0. Suggested download filename: hai-security-assessment-worksheet.html.