Scoping Assessments

Name: Cyber Alchemy
Address: Unit G1, Advanced Manufacturing Park Technology Centre, Brunel Way, Catcliffe, Rotherham, S60 5WG, GB
Telephone: 0114 4000377

This cloud assessment scoping form given below will helps us understand your requirements and tailor our assessment to your needs. Complete the form below or click ‘Download’ to save a copy and fill it in at your convenience. Once completed, please send it to sales@cyberalchemy.co.uk.

Read more or share

Download Word Document

Provide company name, your name, email and job title.

First name*

Last name*

Job Title

Email Address*

Which cloud service provider(s) do you use?*
For example, AWS, Azure, Google Cloud Platform, Oracle Cloud

How many tenants/subscriptions (Azure) or availability zones (AWS) do you have?*
For example, We have two Azure subscriptions, one for production and one for development, and three AWS availability zones within the eu-west-1 region.

List the name and number of resources and services you use.*
For example, 3 x S3 Buckets and 2 x EC2 instances

Is there anything that must not be tested?*
For example, AWS Lambda functions and S3 buckets containing customer data must not be tested.

Are there specific cloud-related compliance standards you need to adhere to?*
For example, CIS benchmark

What are the primary business objectives driving this test? (e.g. compliance, yearly security assessment)*

Is there a date on which the testing must be completed? If yes, provide the date.

Is there anything else you would like us to know?

This external penetration testing scoping form given below will helps us understand your requirements and tailor our assessment to your needs. Complete the form below or click ‘Download’ to save a copy and fill it in at your convenience. Once completed, please send it to sales@cyberalchemy.co.uk.

Read more or share

Download Word Document

Provide company name, your name, email and job title.

First name*

Last name*

Job Title

Email Address*

Please provide a list of all IP addresses, domains, subdomains, and network ranges that need to be tested.*
For example IP Addresses: 192.168.1.10 – Domains: example.com – Subdomains: api.example.com – Network Ranges: 192.168.1.0/24.

Are there any specific IP addresses, domains, or subdomains that must not be tested?
For example IP Addresses: 192.168.1.10 – Domains: example.com – Subdomains: api.example.com – Network Ranges: 192.168.1.0/24.

What are the primary business objectives driving this test? (e.g. compliance, yearly security assessment)

Is there a date on which the testing must be completed? If yes, provide the date.

Is there anything else you would like us to know?

This internal penetration testing scoping form given below will helps us understand your requirements and tailor our assessment to your needs. Complete the form below or click ‘Download’ to save a copy and fill it in at your convenience. Once completed, please send it to sales@cyberalchemy.co.uk.

Read more or share

Download Word Document

Provide company name, your name, email and job title.

First name*

Last name*

Job Title

Email Address*

Please provide a list of all IP addresses, domains, subdomains, and network ranges that need to be tested.*
For example IP Addresses: 192.168.1.10 – Domains: example.com – Subdomains: api.example.com – Network Ranges: 192.168.1.0/24.

Are there any specific IP addresses, domains, or subdomains that must not be tested?*
For example IP Addresses: 192.168.1.10 – Domains: example.com – Subdomains: api.example.com – Network Ranges: 192.168.1.0/24.

Are authenticated patch scans required? If yes, what percentage would be enough to meet your requirements?*
For example, 10% is required as a minimum for PSN

What are the primary business objectives driving this test? (e.g. compliance, yearly security assessment)
For example, AWS Lambda functions and S3 buckets containing customer data must not be tested.

Is there a date on which the testing must be completed? If yes, provide the date.

Is there anything else you would like us to know?

This mobile application scoping form given below will helps us understand your requirements and tailor our assessment to your needs. Complete the form below or click ‘Download’ to save a copy and fill it in at your convenience. Once completed, please send it to sales@cyberalchemy.co.uk.

Read more or share

Download Word Document

Provide company name, your name, email and job title.

First name*

Last name*

Job Title

Email Address*

Describe the application functionality and the type of data handled by the application.*
For example, it is a mobile banking app that allows users to transfer funds, view account balances, and pay bills while handling sensitive financial and personal data.

What platform(s) require testing?*
For example, iOS or Android

Is there a minimum OS version supported by the application? If yes, provide the version number.*
For example, iOS 17 or Android 15

Is it available in the App Store, Play Store, etc? (Please provide links to the store if so)*
For example, App Store: https://apps.apple.com/app/example or Play Store: https://play.google.com/store/apps/details?id=example

How many different user types/roles are there?*
For example, Admin, User etc

Does the application support multiple tenants, where different organisations have separate, self-contained client areas (e.g., Organisation A and Organisation B each have their own distinct client portals)*
In addition, if the application has multiple tenants, include details about any shared functionality between the different tenants.

Does the application have an API? If yes, how many API endpoints?*
Provide the total number of API end points in the scope of the assessment.

What are the primary business objectives driving this test? (e.g. compliance, yearly security assessment)

Is there a date on which the testing must be completed? If yes, provide the date.

Is there anything else you would like us to know?

This web application scoping form given below will helps us understand your requirements and tailor our assessment to your needs. Complete the form below or click ‘Download’ to save a copy and fill it in at your convenience. Once completed, please send it to sales@cyberalchemy.co.uk.

Read more or share

Download Word Document

Provide company name, your name, email and job title.

First name*

Last name*

Job Title

Email Address*

What is the name of the application, and what is its purpose?*
Provide a brief description of the application.

Provide all the URLs in the scope of the assessment.*
All URLs provided here will be included in the scope of the assessment.

How many different user roles exist in the application? Which of these roles need to be tested, all roles or specific ones (please list)*
The user roles could be Admin, User, HR etc. Provide all the user roles and the roles you would like us to test.

Does the application support multiple tenants, where different organisations have separate, self-contained client areas (e.g., Organisation A and Organisation B each have their own distinct client portals)*
In addition, if the application has multiple tenants, include details about any shared functionality between the different tenants.

How many static and dynamic pages does the application have?*
A static web page displays fixed content that remains the same for all users, while a dynamic web page generates content dynamically based on user interactions, databases, or server-side processing.

Describe key aspects of the functionality of the application (e.g., file uploads and payment integrations).*
Provide a list of key aspects of the application like, user registration, file uploads and payment integrations.

Does the application have an API? If yes, how many API endpoints?*
Provide the total number of API end points in the scope of the assessment.

What are the primary business objectives driving this test? (e.g. compliance, yearly security assessment)

Is there a date on which the testing must be completed? If yes, provide the date.

Is there anything else you would like us to know?

AI and Large Language Model (LLM) assessments are conducted to evaluate the security posture of the AI model, its hosting environment, and the application layer that wraps the model. The assessment aims to identify vulnerabilities that could lead to prompt injection, data leakage, model theft, or the generation of harmful content.

Complete the form below or click ‘Download’ to save a copy and fill it in at your convenience. Once completed, please send it to sales@cyberalchemy.co.uk.

Read more or share

Download Word Document

Provide company name, your name, email and job title.

First name*

Last name*

Job Title

Email Address*

What is the name of the AI, and what is its primary job?

AI Name*

AI Purpose*
For example: CustomerSupportBot that handles returns and FAQs

What type of AI model is used?
For example: LLM, computer vision, reinforcement learning, etc.

Where does the AI model live? Please specify if you are using a third-party service or hosting the model on your own servers.
For example, third-party (OpenAI, Anthropic, etc), Cloud Platform (Azure OpenAI, AWS Bedrock, etc) or self-hosted (Llama 3)

Does the model utilise complex system instructions or “personas” to govern its behaviour?
Note: We do not need the actual prompts yet, just an estimation of their length and complexity. For example, a distinct 5-page rule set or a simple instruction to be helpful.

Does the AI have access to a knowledge base or internal documents to answer questions?
Please also describe the sensitivity of this data. For example: Public documentation or PII/Financial records.

Can the AI “do” things? Does it have access to external tools, plugins, or APIs?
For example: Can it send emails, query an SQL database, search the live internet, or execute code?

How will our testers interact with the AI?
For example: Web Chat UI, REST API, Mobile App, or file upload portal

Are there existing security layers in place?
For example: Admin, Basic User, etc.

Is the AI publicly accessible, or does it require a login to access? If behind a login, are there different user roles that need to be tested?

What sensitive data (if any) does the model have access to? And how should access to this data be restricted? E.g Via user accounts, etc
For example, the model has access to personal data for each organisation. Organisation A should not be able to access organisation B’s data

Is there a human review process (human-in-the-loop – HITL) before the AI’s output is shown to the user, or is the generation fully automated?

What are the primary business objectives driving this test?

Is there a deadline for completing the testing? If yes, provide the date.

Is there anything else you would like us to know?

Got a question?

Speak to an expert about AI Assessment Scoping.

Assess

Protect

enable

Assess

Protect

enable

Scoping Assessments

Got a question?

Services

Essential Guide to Cyber Threats (Free Guide)

Assess

Protect

enable

Scoping Assessments

Got a question?

Services

Follow Cyber Alchemy:

Essential Guide to Cyber Threats (Free Guide)