01 — Customer and service boundary
Complete for every assessment or service. Use exact counts and owner-confirmed boundaries.
Download fillable worksheet (PDF)Customer scoping packet
A clearer scope. A more useful assessment.
Use short worksheets to define the environment, required work and decisions before an assessment or quote. Complete the Core worksheet, add the modules for your service and agree the alert priorities and onboarding steps.
The challenge
Unknown scope creates avoidable surprises.
Missing assets, unclear access and undefined response responsibilities change both the work and its cost. The worksheets make those questions visible early, with room to record what still needs discovery.
Choose the relevant worksheets
02 — Resonance monitoring and alert scoping
Identify precisely what is observed, what becomes an incident, and who acts.
Download fillable worksheet (PDF)03 — Phantom assessment authorization and evidence
Bound the assessment question, assets, methods and output before pricing or collection.
Download fillable worksheet (PDF)04 — Managed and co-managed IT boundary
Price the supported units and operating work; prevent tools or labor from being counted twice.
Download fillable worksheet (PDF)05 — Controlled-data and governance boundary
Determine actual obligations, eligible people/platforms and evidence scope before selecting tools.
Download fillable worksheet (PDF)06 — Identity, network admission and certificate scope
Keep application SSO, network AAA, enforcement and PKI lifecycle distinct.
Download fillable worksheet (PDF)07 — Backup and usable recovery scope
Scope a recoverable workload from business objectives, dependencies and a safe rehearsal.
Download fillable worksheet (PDF)Record UNKNOWN explicitly. Use an approved private route for sensitive inventory or completed forms. Worksheets never request passwords, tokens or private keys.
Five priorities, with a defined clock
Critical’s proposed 15-minute target is human acknowledgment and initial triage within the contracted staffed coverage window. Automated receipt is not acknowledgment. Restoration and resolution require their own scoped objectives.
| Priority | Trigger | Proposed target | Clock |
|---|---|---|---|
| Critical / P1 | An agreed critical service is unavailable, or an authorized security owner identifies an active incident with immediate material impact. | 15 elapsed minutes | Only inside the explicitly contracted staffed coverage window; 24/7 requires commissioned staffing. |
| High / P2 | A major degradation affects an important service or multiple users, with limited workaround; a security finding needs urgent owner review. | 60 elapsed minutes | Inside the contracted staffed coverage window. |
| Medium / P3 | Limited service degradation, a bounded control gap or a user-impacting issue with a viable workaround. | 4 business hours | Published business-hours calendar and customer time zone. |
| Low / P4 | Minor defect, nonurgent maintenance request or improvement with minimal present business impact. | 1 business day | Published business-hours calendar; holiday rules defined in the schedule. |
| Informational / P5 | Expected event or advisory with no current required incident action; retain it for context, trends or evidence. | Review within 5 business days | Scheduled review cadence; no incident-response promise. |
- All targets are proposed for discussion. The signed service schedule selects the priority rules, supported assets, calendar, authorized actions and validated capacity.
- Acknowledgment means a human records ownership and begins the agreed impact/triage check. An automated alert receipt or ticket creation does not count. Acknowledgment is not restoration or resolution.
- Clock starts when a qualifying alert/ticket reaches the designated monitored queue during coverage. Measure detection and ingestion delay separately; retain event, ingestion, queue, acknowledgment and action timestamps.
- For elapsed targets outside coverage, route according to the agreed out-of-hours procedure; no staffed response is implied. Business-hour targets accumulate only within the agreed time-zone and holiday calendar.
- Do not pause an acknowledgment clock because work is awaiting the customer. Track customer/supplier wait separately for investigation and resolution. Priority reassignment requires reason, approver and original timestamp.
- Agree how often you receive updates, how urgent issues are passed on and who provides backup support. Recovery targets depend on the systems involved, the approvals needed and results from recovery tests.
- Maintenance suppression requires an owner, assets, reason, start and expiry. Preserve suppressed-event evidence where required; test expiry and exceptions. Deduplication links related events to one accountable incident.
- Test clock boundaries, duplicate alerts, disconnected collectors, holiday/weekend arrival, primary-owner absence, escalation and unresolved shift handoff before coverage starts.
Exactly how onboarding proceeds
1. Select the service and assign owners
Customer names sponsor, technical owner and backup; completes Core plus the relevant worksheets using approved private records.
2. Reconcile inventory and unknowns
L8DT compares counts with the approved inventory, logs unresolved scope and identifies evidence needed. Unknown requirements cannot silently become zero-cost assumptions.
3. Confirm authorization and data handling
Validate owner/third-party permission, methods, support personnel and data boundary. Active testing and restricted access need their actual approvals.
4. Produce the scoped assessment or proposal
Define objectives, sampled assets, methods, outputs, operating units, full price lines, exclusions, priority clocks, capacity and acceptance. Owner approves the final scope.
5. Provision through the approved route
Customer or authorized operator creates only the agreed access; record role, expiry, custody and removal. Worksheets never request passwords or private keys.
6. Pilot and rehearse
Exercise the selected workflow, negative cases, collector failure, routing, primary/backup escalation, recovery and rollback within the authorized window.
7. Accept the service and start coverage
Customer approves commissioning evidence and unresolved exceptions. Confirm actual staffing and contact reachability before any target clock or 24/7 coverage starts.
8. Operate, review and exit predictably
Review the service on the agreed schedule, record incidents and changes, and approve any changes to the work included. If the service ends, follow the agreed steps to return records, hand over responsibilities and remove access.
What makes an assessment scope usable
Reconcile counts to an owner-approved inventory. Confirm targets and permissions, selected methods, evidence availability, data/personnel eligibility, expected outputs and acceptance. Missing values are unresolved questions, not zero-cost assumptions.
Vulnerability severity and CVSS are assessment evidence; operational alert priority also considers business impact, urgency and service criticality. A scan finding is not automatically a Critical incident.
Completed worksheets enable a reviewed scope and quote. They do not authorize collection, establish a compliance result or start coverage.
The intended result
Give the assessment an explicit boundary.
Focused worksheets define who owns the facts, what work is permitted and which checks make the service ready.
Bring an approved scope.
Complete the Core worksheet and the relevant modules, then agree a private intake route. Keep secrets and restricted content out of ordinary inquiries.