Executive assessment
A concise account of the scope, material risks, sovereignty dependencies, priorities and limitations.
ASSESSMENT / SECURITY / SOVEREIGNTY
Understand your exposure. Validate your controls.
Technical assessments of infrastructure, identity, applications and AI systems. Define the scope, examine the evidence, test agreed boundaries, and prioritize remediation around operational risk.
THE ASSESSMENT PATHFollow the decisions
Within this scope
Scope
Agree the systems, methods and boundaries.
Within this scope
Examine
Review configurations and test authorized controls.
Within this scope
Prioritize
Connect findings to operational risk.
Within this scope
Verify
Retest agreed remediation and record remaining limits.
TECHNICAL CYBERSECURITY / SOVEREIGNTY
Examine the controls. Understand the dependencies.
Select the assessment scope around your critical systems, data and operating requirements. Not every engagement includes every test.
Examine the controls. Understand the dependencies.Explore the perimeter
Within this scope
Infrastructure & networks
Review segmentation, exposed services, server and container configurations, and the boundaries between environments.
Within this scope
Identity & privileged access
Examine authentication, service accounts, permissions, administrative access and the process for granting or revoking authority.
Within this scope
Applications & APIs
Assess authentication and authorization paths, input handling and exposed interfaces. Include source-code review where agreed and available.
Within this scope
Data & recovery
Review secrets, key-management responsibilities, data flows, logging and retention. Validate selected backup and restoration procedures.
Within this scope
AI systems & agents
Evaluate document permissions, prompt-injection exposure, tool access and output handling. Test whether downstream services enforce authorization independently of the model.
Within this scope
External dependencies
Map providers, administration rights, software licenses and outbound connections. Examine replacement paths and the knowledge needed to operate without a single supplier.
A DEFINED ENGAGEMENT
From agreed boundaries to actionable findings.
Technical testing is useful when its coverage, evidence and limitations are clear to both decision-makers and engineers.
From agreed boundaries to actionable findings.Follow the decisions
Within this scope
Authorize & prepare
Document assets, owners, exclusions, testing windows, permitted techniques, data handling, escalation contacts and stop conditions before testing.
Within this scope
Review & test
Combine architecture and configuration review with agreed technical tests. Distinguish verified findings from assumptions and untested areas.
Within this scope
Report & prioritize
Explain the evidence, affected controls and operational impact. Assign remediation priorities with your stakeholders rather than relying on a score alone.
Within this scope
Retest & hand over
Verify selected fixes against the original findings. Record remaining risks, responsibilities and recommendations for ongoing assessment.
EVIDENCE YOUR TEAMS CAN USE
A decision brief. A technical record.
Agree the deliverables before the assessment begins. Each should support a decision, a remediation task or an operational responsibility.
Technical findings
Evidence and reproducible descriptions appropriate to the agreed audience, with affected assets, impact and remediation guidance.
Remediation roadmap
An ordered set of actions, accountable owners and dependencies, including compensating controls where relevant.
Retest record
The status of the fixes actually retested, the evidence reviewed and the residual issues that remain open.
SCOPE / AUTHORIZATION / LIMITS
Clear boundaries are part of the work.
An assessment is evidence within an agreed perimeter and period. It is not a guarantee that a system is free of vulnerabilities.
Testing requires authorization
Intrusive tests and penetration testing are included only when explicitly agreed and authorized. Third-party systems and disruptive techniques are excluded unless separately approved.
Assessment is not certification
An audit report does not itself grant regulatory compliance, certification or a qualified-provider status. Applicable assurance requirements are established for each engagement.
Independence must be explicit
Where SDEN has designed or integrated the system, disclose that role. A delivery validation is not represented as an independent third-party audit.
Sensitive evidence stays controlled
Agree how evidence is collected, accessed, transferred, retained and deleted. Public examples use synthetic information, not confidential findings.
METHODOLOGICAL REFERENCES
- NIST SP 800-115: technical security testing
- OWASP: Web Security Testing Guide
- OWASP: GenAI Security Project
References inform the assessment approach. They do not imply endorsement, certification or an assessment performed by these organizations.
START WITH YOUR REQUIREMENTS
Define what your organization needs to control.
Start with your workloads, data constraints, and existing architecture. Establish the scope before selecting the tools.