Scoping a request before involving a security specialist

In brief

• An initial security brief should describe the context and concern without diagnosing a risk or vulnerability.
• The required outcome, deliverable, timing and authorised recipients should be clear before a specialist is involved.
• Access to premises, systems or information should be limited to what is necessary and granted by authorised persons.

Practical steps

1. 1

   Describe the situation without diagnosing it

   The initial brief sets out the type of context, general location, timing and stated concern. It does not conclude what the risk or vulnerability is, or which technical measure is appropriate.

   For cybersecurity, credentials, detailed configurations and internal data stay out of the initial contact. For physical security, sensitive routes, access details and routines are likewise reserved for an appropriate process.

2. 2

   Define the required outcome

   The request may concern an independent assessment, recommendations, a temporary arrangement or coordination of an authorised intervention. The deliverable, timing and people entitled to receive it should be clear.

   This definition helps identify the relevant kind of professional without anticipating their findings. ORION only scopes and coordinates; it does not provide security or cybersecurity advice.

3. 3

   Check the specialist framework

   Before a proposal, relevant experience, required qualifications or authorisations, insurance and operating location should be considered. The applicable requirements depend on the assignment and its context.

   The independent professional remains responsible for their assessment, methods and obligations. Availability and delivery remain subject to scope, applicable conditions and client approval.

4. 4

   Agree access and reporting

   Access to premises, systems or information is granted only as necessary and by authorised persons. Recipients, communication channels and escalation rules are settled before work begins.

   Reporting separates ORION’s coordination, the specialist’s findings and the client’s decisions. Neither ORION nor the scoping process can promise to eliminate risk, prevent an incident or produce a particular outcome.

Information to prepare

• The type of context, general location, timing and stated concern.
• The intended outcome, deliverable, timing and people entitled to receive it.
• The proposed access arrangements, communication channels, recipients and escalation rules.

Limits to keep in mind

• Credentials, detailed configurations, internal data, sensitive routes, access details and routines should stay out of the initial contact.
• ORION only scopes and coordinates and does not provide security or cybersecurity advice.
• Neither ORION nor the scoping process can promise to eliminate risk, prevent an incident or produce a particular outcome.