Start with the environment
A public application, an internal tool, and a community platform have different users, dependencies, and risks. An initial discussion establishes what you operate, what you are authorised to change, and which outcomes matter most. Bring an overview of your environment, your main concerns, and any immediate deadlines. A high-level description is enough for first contact.
Define the work
Application security, infrastructure, identity, security automation, and risk priorities are starting points for a scoping conversation. These topics are discussion areas rather than a fixed package. The final proposal should identify systems in scope, activities, constraints, exclusions, and the people who can authorise work. Availability and delivery are confirmed directly.
Authorisation and practical arrangements
Before work begins, agree objectives, written authorisation, access arrangements, and any testing window. Establish how unexpected findings will be handled. Production changes need an owner and a rollback plan. Discuss the minimum access needed and how it will be removed at the end of the engagement.
Deliverables and next steps
Agree the format of findings, their business context, prioritised recommendations, and any review meeting. Implementation, retesting, maintenance, and ongoing monitoring should be explicitly included if required. Do not assume an initial assessment automatically includes remediation or a continuing service.
What to prepare
Identify critical services, a technical contact, and a business decision-maker. Summarise known concerns and recent changes. Do not send credentials, private keys, customer records, or complete logs in an introductory email. Agree a sharing method first.