How dimensions become an assessment
The six dimensions structure the view of the environment. Scope turns that map into concrete work: included systems, questions, tests, access, owners and deliverables.
Define boundaries
The company and assessment owner agree on assets, authorizations and observation criteria.
Collect and verify
Information, configurations and evidence are collected. Technical tests defined in the scope are performed by authorized professionals.
Connect and prioritize
Results are linked to business context and improvement actions. Corrections and new checks remain traceable.
Technology and data inventory
Where is the information?
What is reviewed
- Company systems, ERPs, CRMs and cloud services
- Databases, files, spreadsheets and repositories
- APIs, integrations, webhooks and third-party sharing
- Personal data categories involved in each flow
Information and evidence
Existing inventories, diagrams, service contracts, integration lists and owner records.
A map of systems and information flows within the assessment, including gaps requiring confirmation.
Identity and access control
Who can reach the information?
What is reviewed
- Roles, permissions and administrative access
- Multifactor authentication and shared accounts
- Inactive users, third parties and access termination
- Separation of duties and privilege review
Information and evidence
Role and permission lists, onboarding and offboarding rules, review records and authorized settings.
Relationships between access, owners and items needing adjustment or validation.
Applications and APIs
How do systems connect?
What is reviewed
- Authentication and authorization in included applications
- Object, route and integration permissions
- Data exposure in responses, logs and configurations
- Input handling and other tests defined in the scope
Information and evidence
Application and endpoint lists, documentation, test accounts, environments and authorization for agreed tests.
Technical findings with context, evidence and recommendations for the assets actually assessed.
Storage and lifecycle
What happens to the data afterward?
What is reviewed
- Encryption and protection of storage environments
- Backups, recovery and continuity
- Retention, disposal and propagation of deletions
- Copies, logs and sharing relevant to the process
Information and evidence
Retention policies, settings, backup records and demonstrations of recovery or deletion within the work's scope.
A view of storage controls and checks performed, including dependencies and next steps.
Governance and responsibilities
Who tracks decisions?
What is reviewed
- Owners of systems, data and suppliers
- Policies, maintenance and control reviews
- Incident handling and internal communication
- Continuity and action tracking
Information and evidence
Policies, contracts, approval flows, incident records, decisions and owners for each area.
Clearer accountability and a follow-up plan for prioritized measures.
Personal data protection
What supports each conclusion?
What is reviewed
- Purposes, data categories and sharing
- Transparency and responses to data subject requests
- Records of measures and relevant impact assessments
- Connections between technical findings and the personal data involved
Information and evidence
Operational records, privacy information, request handling processes, contracts and control evidence.
An evidence matrix and questions supporting specialist data protection analysis.
What the company receives to support decisions
Depending on the agreed scope, the work may include an inventory, flow map, technical findings, evidence matrix, executive report and action plan. Each conclusion must link to observations.
When a correction and retest occur, the new observation is recorded with evidence and context. This tracks changes without erasing the previous assessment.