Choose the system and the concern.
Name the application, codebase or infrastructure to be examined. Identify the person who can authorise the work and explain what the review should help you decide.
A focused question makes the result more useful. It might concern access to customer information, the release of a new application or the configuration of an older system.
Agree how the work will happen.
Define the access provided, the actions permitted and the time available. Agree how information is handled and who to contact if testing needs to stop.
The report and any follow-up checks should be clear from the start.
About this note
This describes a proposed review process. Engagement terms are agreed separately.
All field notes