Inventory what needs support
List devices, applications, cloud accounts, networks and business owners. Record which systems contain sensitive information and which operations depend on them. An accurate inventory helps establish the scope of a review and avoids leaving unmanaged services outside it.
Review access and change ownership
Document how people join, change roles and leave. Identify shared accounts, administrative access and recovery contacts. Agree which changes require approval and how they are recorded. Use approved access methods rather than sharing credentials in a project brief.
Agree the support boundary
Describe covered systems, support hours, severity definitions and escalation contacts. Separate routine maintenance from incident response and project changes. Response targets and service commitments must be agreed in a contract, not inferred from a marketing page.
Turn findings into an owned backlog
For each finding, record the affected system, evidence, impact, proposed action and owner. Prioritize with the business rather than treating every alert equally. Security work reduces specific risks; it is not a promise that incidents cannot happen or evidence of certification.
Bring this to your project brief.
- System inventory with business owners
- Access lifecycle and approved review scope
- Support boundaries and escalation contacts
Use general descriptions or anonymized examples. Do not put credentials, personal records or confidential documents into the brief.
Prepare your project brief