WORKING TOGETHER
Know the work.
Know the responsibilities.
An engagement starts with the problem, the intended result and a clear account of who will do the work.
Before an engagement
- Clarify the objective. Discuss the business problem, the systems involved and the outcome you need.
- Identify the people and qualifications. Discuss the lead practitioner’s identity, relevant background and role. For penetration testing, this includes the Offensive Security Certified Professional (OSCP) credential. Any partner involvement is identified before delivery.
- Define the deliverables. Agree scope, dependencies, responsibilities, access requirements and acceptance criteria. Any confidentiality arrangements are addressed before sensitive information is exchanged.
- Confirm readiness. Client work begins only after business registration and insurance arrangements are in place.
What a deliverable can look like
These are examples of engagement outputs, not claims about past clients or results:
- An architecture decision record showing options, assumptions, dependencies and a recommended design.
- A prioritized remediation plan with evidence, impact, owners and validation steps.
- A working application or integration with evaluation results, deployment instructions and a documented handoff.
- A network segmentation design with intended traffic paths, access boundaries and an implementation sequence.
Planning IT/OT network and security work
Operational environments have availability, safety and equipment constraints that affect assessment methods. Network access is not blanket authorization to test every connected device.
- Establish ownership and boundaries. Identify approved assets, network connections, responsible operators, dependencies and excluded activities.
- Review before probing. Start with available documentation, configuration review and agreed passive sources. Plan any monitoring deployment with the team responsible for the environment.
- Authorize active methods explicitly. Scanning or penetration testing requires an agreed target list, methods, operating window and escalation contact. Active tests are not run merely because a device is reachable.
- Set stop and recovery conditions. Agree how work stops if unexpected behavior appears, who makes operational decisions and what recovery arrangements are needed.
- Deliver findings and next steps. Separate observed evidence from assumptions, prioritize remediation and agree how changes will be validated.
This page describes the scoping approach. The approved engagement plan determines the actual methods and deliverables for each environment.
Further reading: NIST SP 800-82 Rev. 3, Guide to Operational Technology Security, which addresses OT performance, reliability and safety requirements.
Start the conversation
Email info@cadreinnovations.com with a brief outline of the problem or idea. You can also call (207) 835-1230. The first discussion establishes fit and next steps; it does not require sharing credentials or detailed system information.