The engagement record

An engagement record gives a reviewer enough context to understand what was assessed, what was observed and how the evidence supports the report. This guide explains the workflow Kallistra is designed around.

Define scope and identify assets

Use the agreed scope to distinguish assets included in the assessment from anything encountered incidentally. Record asset identifiers consistently so a finding can be traced to the right system or service. Keep scope exceptions and changes alongside the original agreement for review.

Connect findings to evidence

Give each finding a specific observation and explain its effect in the context of the engagement. Record the affected assets and retain enough evidence for another reviewer to understand the basis of the conclusion. Clearly identify any assumptions or gaps in verification.

Prepare the report

Use the engagement record to check that the report’s affected assets, findings and supporting details agree. Include only the evidence the audience needs and review exported material for sensitive information before sharing it.

For guidance on handling the underlying records, see Local data and offline operation.