01 / Scope
What we consider
- Authentication, sessions and authorisation.
- Web interfaces, APIs and agreed data flows.
- Software dependencies and release configuration.
- Boundaries between applications, external services and infrastructure.
Area in development
Applications & APIs
An application is a combination of interfaces, services and access decisions. This area focuses on the points where data and permissions change context.
02 / Outputs
How to document the work
- A map of components and trust boundaries.
- Documented observations and remediation priorities.
- Verification guidance for agreed changes.
In development
Scope is tied to identified versions and environments. Active testing requires explicit authorisation and agreed conditions.
Start with the scope
Which part of your system do you want to understand better?
Start with the context, objectives and scope.