Define the right work
Agree the systems, permissions and type of review before any testing. We distinguish a website configuration review from a broader security assessment, privacy review or accessibility audit. The scope should identify the standards and checks involved, what evidence is available and which areas require a separate qualified adviser.


