# Demonic Binary — Security Assessment Scope & Authorization Worksheet

**Template status: DRAFT / NOT AUTHORIZATION / NO ENGAGEMENT CREATED**

This editable worksheet helps prepare a scoping discussion. It is not a signed contract,
rules of engagement, testing permission, security certification, or guarantee of staffing.
Do not begin testing until the relevant parties approve the actual scope and rules in writing.
Do not send credentials, private source or customer data in an initial inquiry.

## 1. Engagement details
- Client legal entity and authorized owner: [to be confirmed]
- Client technical point of contact: [to be confirmed through an approved channel]
- Client emergency stop contact: [to be confirmed]
- Supplier contact and delivery owner: [to be confirmed]
- Intended outcome / decision deadline: [to be confirmed]
- Testing scope or follow-up implementation scope: [separately agreed]

## 2. Assets and authorization
| Asset / environment | Owner and written authority | Included? | Allowed hours |
| --- | --- | --- | --- |
| [Owned application / API] | [Legal owner / written proof] | [Yes/No] | [Window] |
| [Mobile application / staging] | [Legal owner / written proof] | [Yes/No] | [Window] |
| [Cloud tenancy / identity system] | [Legal owner / written proof] | [Yes/No] | [Window] |

Document third-party approvals independently, including cloud providers, customer tenants,
vendors, and any shared infrastructure. A client request alone is not proof of ownership.

## 3. Permitted testing and exclusions
- Permitted techniques and explicit constraints: [document]
- Test accounts and role/tenant separation: [document]
- Test environments, IP allowlists and connectivity: [document]
- Rate, load, traffic and data-handling limits: [document]
- Production traffic, destructive actions and social engineering: [excluded unless specifically authorized]
- Physical testing, credentials from third parties, persistence: [excluded unless specifically authorized]
- Vulnerability disclosure and external notification process: [document]
- Test pause and immediate stop triggers: [document]

## 4. Evidence and information handling
- Authorized evidence storage, encryption and access: [document]
- Capture minimization and pseudonymization: [document]
- Sensitive-data discovery escalation process: [document]
- Retention period, deletion process and legal holds: [document]
- Approved communication channels: [document]
- No credentials or regulated customer data by ordinary email: [acknowledge]

## 5. Outcomes and separate decisions
- Assessment deliverables: [findings, reproduction, risk, recommended fix, affected assets]
- Optional implementation: [separate proposal and change approval]
- Optional retest: [separate targets, criteria and permitted timeframe]
- Client sign-off and release/change management owner: [identify]
- Scope extensions and additional charges: [require written authorization]

## 6. Written approval checklist
- [ ] Client authority and third-party permissions have been verified
- [ ] In-scope targets, excluded assets and test identities are explicit
- [ ] Allowed techniques, windows, safety controls and stop conditions agreed
- [ ] Contacts and reporting channels agreed
- [ ] Evidence retention and confidentiality terms agreed
- [ ] Signed engagement terms and rules of engagement are in place
- [ ] Delivery staffing and start date confirmed separately

**STOP: This worksheet is informational only. Do not use it as permission to test.**
Related: https://demonicbinary.com/security/find-fix-verify