The pháp lý của khách hàng cũng có ý định để hạn chế tác động vào khách hàng càng nhiều càng mức độ tác động chấp nhận được cần phải được giải quyết như một phần của nỗ lực Phạm vi. Thiết lập và chi tiết ranh giới hợp lý và thể chất cho dự án Đôi khi được gọi là "quy tắc tham gia" | Laying the Foundation for Your Assessment Chapter 1 13 Establishes and details the logical and physical boundaries for the project Sometimes called rules of engagement Scope is the mutual understanding between the assessment team and the customer as to the actions that will take place during the assessment. An effective scope requires an agreement between the customer and the assessment team. In many cases the scope will require a legal review by the customer s legal department. The scope is also intended to limit the impact on the customer as much as level of acceptable impact needs to be addressed as part of the scoping effort. Source of Scope Information Scope information can come from multiple sources. One of the obvious sources for scoping is the SOW or RFP that the customer issued to obtain the assessment services. Generally this information is truncated and requires additional details to properly determine the scope. Additional sources of scoping information can include the customer representative assigned to the project. That person will generally provide additional nonproprietary information that is specifically requested. If it is a competitive bid the customer representative will generally be required to provide this information to all potential bidders. Additionally customer documentation is an excellent source of information about the organization and any related security programs if the information is available. Useful documentation can include acceptable-use policies security policies network architecture diagrams and results of previous assessments. Another excellent way to get scoping information is to ask the right questions on a scoping questionnaire. We discuss this procedure in the next section. Collecting Scope Information Obtaining the information you need to properly scope an effort can be a challenge for the proposal or assessment team. More often than not we have found that customer SOWs or RFPs are poorly scoped when they .
