TenguProtect · Cyber-defence Library
Part 1 · assessment and mitigation recommendations · published v1.0 · 14 October 2026

Engagement and Target Management

G01 · reusable assessment method · Create the controlled record every service uses.

Approval is specific, never inherited from the guide. Check the client, campaign, individual person/asset, method, channel, time window and risk ceiling. Deny overrides allow; absent, expired or withdrawn permission blocks the action. LOW/MED/HIGH describe proposed test impact, not permission or finding severity. Read the approval rules.

1. Define the business outcome

Record the question, service playbook/version, customer owner, reviewer and deliverable. Start with a synthetic example until the real client authorises scope.

Output: engagement-brief.json

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

2. Separate customer, engagement and target

Use distinct IDs for the customer, engagement, assets, people/roles and individual runs. Record domains, tenants, devices, contact channels and prohibited assets explicitly. A free-text mission subject is not a target registry.

Output: target-register.csv

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

3. Agree the operating boundary

Record approved methods, time window, data handling, spend ceiling, stop contact and dependencies. Distinguish passive review, active testing and human simulation; approval for one does not imply the others.

Output: engagement-brief.json

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

4. Assign work with acceptance criteria

Link every assessment task to the target ID, vector version, step, named operator and expected evidence. Missing approval or essential capability blocks the assessment task; implementation work is not allocated in this phase.

Output: test-case.json

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

5. Handoff without losing context

Until integration is implemented, put the same engagement ID in CRM, HILLY, Mission Control and native records and retain reciprocal URLs in the restricted engagement record. Do not paste credentials into a brief.

Output: engagement-brief.json

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.