Start with the business purpose
Explain why the assessment is needed and which applications, data, or workflows matter most. A launch review and an assessment of an established environment may need different coverage.
Define the environment
List the applications, APIs, infrastructure, or cloud environments to be discussed. Identify owners, third-party dependencies, and any environments that cannot be included.
Agree access and boundaries
Discuss available documentation, test accounts, permitted activities, testing windows, and escalation contacts before testing begins.
Plan for the findings
Identify who will review the report, who can make changes, and how remediation and any retest will be coordinated.