Method and measurement
External assessment methodology: scope, evidence and limits
A defensible assessment method: define scope, pick a vantage point, attach evidence, separate absence of evidence from evidence of absence, and write down the limits.
Start with scope, not with tools
A methodology begins with what is in scope, who authorised it, and what the output is for. Tools are interchangeable; scope and authorisation are not.
Write the scope down: domains, IP ranges, exclusions, vantage points, time window, and the person who can authorise stopping. An assessment without those is a scan.
Define how a finding is stated before you collect any
An evidence-first method defines its output vocabulary first. SMB Scanner Lite uses four statuses: pass, warning, fail and inconclusive. Each finding quotes the observation that produced it.
The critical decision is the fourth status. Without it, every timeout becomes a judgement call, and judgement calls drift towards whichever conclusion is more convenient.
Record the vantage point
External observations depend on where they are made. A record can resolve differently for different resolvers; a firewall can answer one source and drop another.
Recording the vantage point is what makes a finding reproducible. Without it, "we observed X" is an anecdote.
Score only what completed
If a score is produced, it should be arithmetic over completed controls with published weights, and inconclusive results should be excluded rather than counted as failures.
Publish the weights and the grade bands. A scoring model that cannot be inspected cannot be trusted, and a model that changes per engagement cannot be compared over time.
Write the limitations in the report
Every method has a boundary: what it cannot see, what it cannot prove, how it can be wrong. Stating that boundary in the report is not weakness; it is what makes the rest of the report usable.
A reader who understands the boundary can decide which findings to act on. A reader who does not will over-trust the rest.
Compare runs, not snapshots
A single assessment is a snapshot. Two assessments of the same scope, compared, are a measurement of change — and change is what an organisation can act on.
Record the date, the version of the tool and the scope with every report, or you will find yourself comparing incomparable things six months later.
How this project applies it
The full method is documented on the methodology page, with the control catalog on the capabilities page and a genuine output in the recorded assessment. The validation record shows the reproducible tests behind the restrictions.
See how this is measured. SMB Scanner Lite evaluates these controls from outside and attaches the observation behind every conclusive finding. Browse the 22-control catalog or inspect the recorded assessment.
The practical version
This article explains the mechanism. The blog covers the sequence: what to check, in what order, and what to do with the answer.