PART 1 — SCENARIO-LED CYBER DEFENCE ASSESSMENT
1. Real incident: source, date, documented facts and evidence limits.
2. Client relevance: systems, people, dependencies and business impact.
3. Plausible attack paths: linked reusable vector IDs and versions; separate from confirmed incident facts.
4. Approved scope: client/campaign/person/asset rules, channels, LOW/MED/HIGH test impact, explicit exclusions and unknowns.
5. Per-step results: output, evidence, numerator/denominator or qualitative rubric, expected versus observed result and confidence.
6. Business findings: what an attacker could and could not achieve, and what was not tested.
7. Mitigation recommendations: changes that would reduce likelihood and changes that would reduce impact, with the evidence needed to verify them later.
STOP HERE. Implementation tasks, allocation of delivery work, scheduling, commercial mitigation packages and pricing belong to Part 2.
Assessment completion is separate from control effectiveness. No risk-reduction percentage is inferred from a pass rate. Where no client testing has occurred, report NOT ASSESSED, not zero risk.