Methodology
How we assess, test, report, and retest.
Running the same process on every engagement is what lets you compare this year’s findings with last year’s. This is how every Sidechain engagement runs, from a two-week Health Check to a multi-application penetration test.
Standards we draw on
- Testing
- PTES, OWASP Testing Guide, OWASP API Top 10
- AI
- OWASP LLM Top 10, NIST AI RMF
- Risk
- NIST CSF, NIST SP 800-30
- Scoring
- CVSS with environmental context
- Healthcare
- HHS Security Risk Assessment guidance
Lifecycle
Five stages, every engagement.
Scope and rules of engagement
Authorized targets, access levels, testing windows, exclusions, communication contacts, and escalation arrangements are agreed in writing before work begins.
Discovery
Automated tooling supports discovery and coverage. Engineers review results in context rather than copying scanner output into a report.
Validation
Findings are investigated and, where authorized and safe, exploitation or impact is validated. Evidence is captured for every finding.
Reporting and debrief
Executive summary, technical findings with severity ratings and evidence, testing limitations, and prioritized remediation. Walked through live with your team.
Retest and follow-through
Remediated findings are retested under the agreed scope. For managed clients, outstanding items move into the monthly work plan.
Reporting
What a Sidechain report contains.
Our reports are written for two audiences at once. Leadership needs to understand exposure and priorities without reading exploit details. Engineers need enough evidence and context to reproduce and fix each issue. Both get what they need from one document.
- Written to satisfy auditors, insurers, and customer security teams
- Sanitized sample available on request
- Debriefed live by the engineers who did the work
- Executive summary
- Scope, approach, overall risk posture, and the handful of things leadership should know.
- Findings
- Each with severity, CVSS score, affected assets, evidence, business impact, and remediation guidance.
- Limitations
- What was out of scope, what could not be tested, and what that means for the conclusions.
- Roadmap
- Remediation ordered by severity and effort, with dependencies noted.
- Retest record
- Status of each finding after remediation and validation.
Managed program
For managed clients: the monthly cycle.
Security work does not end when tools are installed. Our managed program runs on a monthly cadence with a shared work plan.
Initial review
Environment, tools, responsibilities, access, and priorities, documented before onboarding.
Work plan
Remediation, access and changes, incident coordination, and implementation, with clear owners.
Monthly review
Completed work, outstanding risks, remediation progress, and decisions that need management attention.
Annual reassessment
Risk assessment refreshed, testing repeated, and the program adjusted as the business changes.
See a sanitized sample report.
We are happy to share a Sidechain security report with you. Ask for one on the call.
(503) 389-3174 · info@sidechainsecurity.com · Portland, Oregon