A list of technical findings needs to become a list of decisions someone owns. A warning on an unused device has a different consequence from a weakness in the system taking customer payments.
Start with the equipment and services you control, including the provider responsible for each. We agree on what can be checked and what the results will cover.
Know which assets are being reviewed
We establish the devices, software and exposed services within the brief. Systems owned by a hosting provider or another supplier may need their involvement and permission.
An inventory helps explain coverage gaps. A laptop that has not connected, an unknown domain service or equipment outside the scope should be recorded rather than silently counted as reviewed.
Agree on access before any scanning
A scan needs permission, an identified target and an appropriate method. Some checks need an installed agent or authenticated access, while others observe an exposed service. Those approaches can find different things.
We discuss timing and operational sensitivity before checks run. Vulnerability scanning is a separate scope from penetration testing or attempting to exploit a weakness.
Prioritise findings in their business context
The affected service, internet exposure and consequences of failure matter alongside the technical severity. CISA's Known Exploited Vulnerabilities Catalog is one source of evidence that a weakness has been used in attacks.
We use that context to propose priorities. A numeric score should not be the only explanation for why your business needs to act.
Assign a treatment to each accepted finding
A finding may need an update, configuration change, restricted access or replacement of unsupported software. The action register records the proposed response and who can approve it.
Remediation can be scoped separately or included where agreed. A recommendation requiring a vendor or another provider should identify that dependency and the person responsible for following it up.
Check closure and keep exceptions visible
A completed change should be followed by the agreed check. The record needs to distinguish a confirmed fix from a temporary workaround or a finding that could not be validated.
If the business accepts a remaining risk, the reason, owner and review point should be documented. An open finding should not vanish because the reporting period has ended.
Make recurring reviews fit the environment
New devices and software changes can introduce new findings. A recurring arrangement needs to define its coverage, review frequency and treatment responsibilities, including what happens when a device is unavailable.
Suitable checks can be delivered remotely across Australia. Perth physical access and any specialist review of unusual systems are discussed separately during scoping.
