TenguProtect · Cyber-defence Library
Part 1 · assessment and mitigation recommendations · published v1.0 · 14 October 2026

Execution, evidence and honest task completion

G05 · reusable assessment method · A standard for proving what happened without losing failures or manual work.

Approval is specific, never inherited from the guide. Check the client, campaign, individual person/asset, method, channel, time window and risk ceiling. Deny overrides allow; absent, expired or withdrawn permission blocks the action. LOW/MED/HIGH describe proposed test impact, not permission or finding severity. Read the approval rules.

1. Preflight the step

Check the pinned playbook, target, approval, operator, resources, dependency status and spend allowance. Record unavailable tests as blocked or not tested.

Output: test-case.json

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

2. Run within the boundary

Execute only the approved step. Record run ID, start/end, actual parameters, events and interruptions. An assumed-compromise stage gets a separate label and test identity.

Output: evidence-register.csv

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

3. Preserve enough proof

Store raw output privately, hash important artifacts, redact report copies and attach minimal reproducible evidence. Record clean/denied controls and collection limitations.

Output: evidence-register.csv

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

4. Handle manual and uncertain outcomes

A manual handoff stays awaiting execution until the operator supplies evidence. On timeout or budget stop, reconcile native state before retrying; do not duplicate calls, messages or account creation.

Output: channel-results.csv

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.

5. Review before completion

Move through planned → ready → running → awaiting review → accepted, with blocked/failed/cancelled as separate outcomes. Completion means the agreed deliverable is accepted; it does not mean every client defence passed.

Output: findings.csv

Measure: required applicable conditions satisfied / required applicable conditions, with evidence and unresolved items. Report completeness separately from security effectiveness.