Planning notebook and a structured scope form on a meeting table.

Build a scope brief

Start with the decision you need to make.

Describe the decision you need to make, the environment involved and the constraints that matter. This planning tool creates a scope brief you can download and review with your team. It does not send an enquiry or start any security activity.

RIFT / STARTDEFINED SCOPE · USEFUL EVIDENCE

What decision should the assessment support?State one question that evidence could help answer.

Which kind of question is closest?

Which environment and owners are involved?Use general descriptions. Do not enter passwords, tokens, customer records or sensitive infrastructure details.

What is excluded, uncertain or operationally sensitive?

Where are you in the planning process?

Your answers remain in this browser tab. Nothing is submitted, scanned or booked. Download or copy the result before leaving if you want to keep it.

Your scope brief.

Prepared locally. Ready for discussion.

Discuss your brief: [email protected] ↗

A better starting point

Write the question.
Keep the uncertainty.

Describe the decision. “Can an analyst investigate this event with the available context?” is more useful than “test the SOC.” The question helps identify the evidence and participants you need.
Name the environment and owners. A general description is enough to start the conversation. In a real scope discussion, distinguish the people who operate a system from those able to authorise assessment activity.
Make exclusions visible. If a supplier, shared service or production dependency cannot be included, say so. The limit affects what the eventual result can establish.
Leave unknowns as unknowns. An unresolved asset list or unavailable test account is a planning issue to address. Do not turn it into a confident assumption just to complete the document.

After downloading, ask the business owner what decision the result would change. Ask the technical owner whether the described boundary matches the real environment. Ask the defensive team what observations would be available. If those answers point to different objectives, separate them before trying to combine the work.

A scope brief is preparation for an agreement, not permission to test. Any real engagement would need the relevant owners to confirm authority, scope, operating controls and evidence handling. Email [email protected] to discuss an assessment and agree the next steps.

The output also includes questions to discuss about the selected evidence chain. Review those suggestions in your own context and edit them as needed. Keep the document with your planning notes rather than treating it as a fixed template that overrides how your organisation operates.

Read the complete scoping guide ↗

The next useful question

What do you need
the evidence to tell you?

Start with the decision, the environment and the constraints. Create a scope brief you can download, review with your team and refine before any engagement is considered.

Build your scope brief ↗

Start with the decision you need to make.

Your scope brief.

What do you needthe evidence to tell you?

What do you need
the evidence to tell you?