Foundations for thoughtful defenders

Write the lab boundary before the exercise

A scope sheet makes an authorized learning exercise easier to stop, repeat and review.

By Todd Michael Gori · 2026-10-23

Begin with the boundary

Before any practical security exercise, write down the environment you own or are explicitly authorized to use. Name the systems included, the purpose of the exercise and the person who can approve a change in scope. A public address or an interesting service is not permission to test it.

For a personal study session, use a dedicated training environment you control. Keep real customer data and production credentials out of the exercise. If the boundaries are unclear, resolve them before choosing a tool or running a test.

Write a stopping rule

A stopping rule answers a simple question: what observation means the exercise should pause? Your worksheet can include unexpected access to another environment, unfamiliar data, instability or uncertainty about authorization. It should also name how to contact the responsible owner.

Keep a rollback or cleanup plan proportionate to the exercise. Record what you intend to change and how you will check the final state. These are planning prompts, not instructions to perform intrusive testing. The original lab-plan worksheet helps organize the conversation.

Keep the report within its scope

Afterward, write what was attempted, what was observed and what the exercise did not cover. A small successful exercise cannot establish that an entire system is secure. Keep screenshots and logs private unless you have permission to share the information they contain.

For a formal reference on planning and conducting technical assessments, consult NIST Special Publication 800-115. It is a guide to assessment work, not permission to assess a third party. This article's worksheet is our own educational planning aid and is not a NIST certification or endorsement.