Saint field guide / Planning
Before your first security
assessment
A little preparation can turn an assessment from a broad conversation into a useful decision tool.
Saint Media Group / Planning / 4 minute read
Start with the decision
Write down the business question behind the review. Are you prioritizing investment, changing platforms, answering customer questions, or preparing to launch? The answer shapes the scope and the evidence that will be useful.
Describe what matters
List the operations and information that would cause the greatest disruption if unavailable, altered, or disclosed. Add the people and suppliers that support them. A high-level dependency picture is more useful than a long unprioritized product list.
Bring what already exists
Locate relevant policies, prior reports, system inventories, access processes, and response plans. Identify the people who can explain how the work actually happens. Keep original evidence in your control until a sharing process is agreed.
Agree the boundaries
Ask which systems and controls are included, whether technical testing is involved, what permissions are required, and what the final report will contain. Record exclusions and assumptions so the result can be interpreted accurately.
Plan for the findings
Identify who will review recommendations and how decisions will be made. A report needs an owner, a sequence of priorities, and a practical route to improvement.
Further reading: NIST Cybersecurity Framework ↗. The checklist and examples above are Saint’s editorial guidance; the reference is not an endorsement or certification.