Security Proposal

Risk context and objectives

[Threat context, business impact, compliance driver, and risk appetite]

Assessment or control scope

[Systems, environments, control families, exclusions, and test window]

Methods, evidence, and deliverables

[Method, evidence artifact, severity model, report format, and owner]

Access, confidentiality, and rules of engagement

[Accounts, approvals, data handling, safe testing limits, and contacts]

Remediation roadmap and reporting

[Finding, risk rating, remediation owner, target date, and retest criterion]

Fees, assumptions, and acceptance

[Fee, prerequisites, assumptions, acceptance authority, and sign-off]

Measurement and Ownership