What to have ready before we start

Engagements slip for administrative reasons far more often than technical ones. Access requests sit in a queue, the estate boundary turns out to be contested, or the one person who knows the payment HSM hierarchy is on leave. This page lists what to prepare so that week one is discovery rather than paperwork.

None of it is exotic. Most organisations can assemble the whole list in a fortnight if somebody owns it. Nothing on the list requires a decision about post-quantum cryptography, which is deliberate — the preparation is inventory hygiene, and it retains its value even if you never run an assessment.

#The short list

A named engagement owner

One person on your side who can settle scope disputes and chase access.

A written estate boundary

Which business units, environments and regions are in and out.

Read-only access

Repositories, configuration sources, endpoint metadata, certificate inventories.

Existing inventories

CMDB export, certificate register, HSM and key inventory, any SBOMs you already produce.

Four to six subject-matter experts

People who can answer questions about specific systems within a day.

A change-control contact

Somebody who can tell you what a change to a given service actually takes.

An output destination

Where the inventory, CBOM and evidence records need to land for your auditors.

#Decide the estate boundary first

Scope is the single most common source of delay, and it is a business decision rather than a technical one. Discovery will happily read whatever you point it at, so the question is what you intend to be accountable for at the end.

Write the boundary down before kickoff. A boundary held in three people's heads produces a report that each of them disputes. The shape we ask for is short and prosaic.

Estate boundary — Baseline Assessment

IN SCOPE
  Business units:      Retail Banking, Payments
  Environments:        production, pre-production
  Regions:             IN, SG
  Repositories:        all repos under the two org-level GitHub groups listed in Annex A
  Endpoints:           externally reachable TLS endpoints on the two payment domains
  Appliances:          load balancers and API gateways in the payments path

OUT OF SCOPE
  Business units:      Wealth (separate programme), Insurance (divesting)
  Environments:        developer laptops, ephemeral test environments
  Systems:             the mainframe (assessed separately in Q4)

OPEN QUESTIONS
  The acquired card-processing platform — owner to confirm by kickoff.

Open questions are fine. Unstated assumptions are not. Anything left open at kickoff gets recorded as a scope exclusion in the report so that a reader in twelve months knows what was never looked at. The asset model behind these boundaries is described in What counts as an asset.

#Access, and the least of it that works

Discovery reads declarations and configuration. It does not need production credentials, administrative rights, or the ability to change anything. Ask your security team to provision the narrowest version of each item below.

Which detector consumes which input is set out in The detector catalogue. Access requests that will not be approved are worth identifying early, because each one becomes a documented blind spot in the final report rather than a silent omission.

#What never to send us

The same applies to production data. We do not need a copy of an encrypted database to tell you which algorithm encrypted it. The parameter tells us; the payload adds only risk. Retention and deletion of what we do hold is documented in Retention and deletion, and how it is protected in transit and at rest is in Encryption and key handling.

It is worth telling your security team this explicitly when you raise the access requests. Reviewers who assume a cryptographic assessment needs key material will hold the request, reasonably, until somebody explains that it does not. A one-line statement that the engagement reads metadata and configuration only will usually clear the queue faster than an escalation.

#The people, and the hour of their time you will need

Discovery produces questions. A finding that reads as critical in configuration is sometimes a decommissioned path, and only a human knows that. Line up the following before kickoff and give them warning that a question is coming.

• PKI or certificate authority owner — issuance policy, key hierarchy, what is automated and what is manual.
• Network or edge owner — where TLS terminates, and how many hops sit behind each public endpoint.
• Key management or HSM owner — key hierarchy, algorithm constraints, firmware version, upgrade path.
• Two or three application architects — for the services carrying the highest-value data.
• Change management — realistic lead times for a cryptographic change in each environment.
• Internal audit — the evidence format and retention their assessors expect.

#Getting the platform side ready

1. 1

   Decide the workspace structure

   One workspace per assessment, with projects reflecting how you want findings grouped — usually business unit or platform. Changing this after discovery means re-cutting the report. See Workspaces, teams and projects.

2. 2

   Agree who sees what

   Cryptographic inventories are sensitive. Decide before kickoff which roles can see the whole estate and which are scoped to their own systems. See Roles and permissions.

3. 3

   Connect identity

   Single sign-on against your existing provider avoids a standing set of local accounts. Configure it during setup week rather than after the first report circulates. See Single sign-on.

4. 4

   Route notifications deliberately

   Findings landing in a channel nobody owns is the most common cause of a stalled programme. Decide where scoring changes and new findings go, and who acknowledges them. See Where alerts land.

5. 5

   Confirm the evidence destination

   If audit needs records in a specific system, agree the export format at kickoff. Retrofitting an evidence trail is far more work than producing it as you go.

With that in place, week one is spent on discovery instead of provisioning. What the first thirty days look like describes what happens next.