How we work

Permission first. Evidence always.

The rules below govern every engagement. They are also what makes a report of ours worth reading: you can see what was authorized, what was tested, how it was rated, and what we did with your data.

01 · Authorization

Only with written permission, only within it.

We assess only systems the client owns or is authorized to control. Before any work that touches a system, you sign a scope statement and an authorization naming each asset — domains, sites, mail domains, devices, accounts — and the intensity you allow:

  • Passive — public records only: no probing traffic, no changes.
  • Active — scanning or probing traffic to the listed assets, in an agreed window.
  • Hardening — configuration changes to the listed devices and accounts, made with you present.

"The client asked me to look" is not authorization; a signed scope is. If scope is ever ambiguous, we stop and re-confirm in writing. We never pivot to a system, account or vendor that isn't listed — even if we could, even if it looks helpful.

We do not test a vendor's systems. Vendor risk is assessed from documents and your own records.

02 · Standards

Mapped to standards you can look up.

So a client, an auditor or an insurer can see we aren't improvising, every finding traces to a recognized control:

  • NIST CSF 2.0 — the spine: Govern, Identify, Protect, Detect, Respond, Recover.
  • CIS Controls v8.1, Implementation Group 1 — essential cyber hygiene for families and small businesses, reaching into IG2 where the data warrants it.
  • OWASP Top 10:2025 and ASVS 5.0 — websites and web applications.
  • NIST SP 800-63B-4 — sign-in and authentication: phishing-resistant MFA; text-message and email codes treated as deprecated.
  • CIS Apple macOS Benchmark — Mac baselines.

03 · The seven steps

  1. Scope — what's in, what's out, and what "done" looks like.
  2. Authorize — you sign. We agree the window, the no-go items and an emergency contact.
  3. Assess — we run the relevant procedure, passive first, collecting evidence as we go and verifying each fact before building on it.
  4. Analyze — raw findings become rated findings, likelihood × impact, with real risk separated from noise. We record strengths too.
  5. Report — a plain-language summary, strengths, findings in severity order, a prioritized plan, and the scope and method behind it.
  6. Remediate — we fix it with you, or walk you through it.
  7. Verify — we re-test what was fixed and mark it resolved. A fix isn't done until the finding is closed.

04 · How findings are rated

Severity Meaning When to act
Critical Funds, identity, or full system/account compromise at direct risk. Now.
High Significant data exposure or partial compromise; realistic path. This week.
Medium Limited exposure or a meaningful weakening of defenses. This month.
Low Minor disclosure or a defense-in-depth gap. This quarter.
Info No direct risk; hygiene or good-to-know. At your convenience.
Effort Meaning
Quick Minutes; the client can self-serve, or we do it on the spot.
Moderate About an hour or a guided session.
Project Ongoing, or needs a vendor / larger change.

Severity is honest in both directions: nothing inflated to sell a project, nothing softened to be polite. We lead with the high-impact, low-effort fixes.

05 · Your data

The least we need, kept encrypted, destroyed on schedule.

  • We capture the proof, not the payload. A redacted screenshot showing "DMARC: none" is evidence; a copy of your mailbox is not.
  • Account numbers, addresses, tokens and personal details are redacted the moment evidence is saved.
  • Evidence lives in an encrypted, access-controlled store for this engagement only — never in our methodology library, never in a public repository.
  • Credentials, keys and recovery phrases are never written into notes, reports or chat. We refer to them by name.
  • The retention period is stated in your authorization. When it ends, the evidence is destroyed.
  • Nothing of yours is uploaded to a third-party service — a scanner, a sandbox, an AI tool — without your written consent, and never in bulk.
  • A report of ours is confidential and prepared for you alone.

06 · When we stop

We stop and tell you — and, where the law requires it, the appropriate authorities — if we find signs of an active intrusion, data belonging to someone outside the scope, material involving the safety of a child, or anything suggesting the system isn't the client's to authorize. We document; we don't dig.

If an assessment of a third-party product turns up a real vulnerability, it goes to that vendor through responsible disclosure — never published, never used.

07 · Honesty about limits

"No critical findings in the tested scope" is never "you are secure". Our reports say what was not tested and what a finding does and doesn't prove. A point-in-time assessment is a picture, not a guarantee.

08 · The tools

The toolset is free or standard, so a finding can always be reproduced: native operating-system tools, dig and whois, public certificate logs, and reputable web checkers such as SSL Labs, Security Headers and Mozilla's HTTP Observatory. Scanners that send traffic to a target — nmap, testssl.sh and their kind — run only inside a signed active scope.

We use Anthropic's Claude as a working tool — for drafting, analysis and the code behind our own checks — the way a careful lawyer uses a gifted associate: it drafts, we decide, and nothing leaves the building unverified. The Clauditor is an independent practice. It is not affiliated with, endorsed by or in partnership with Anthropic.

The written methodology behind this page — the engagement framework, the six procedures, the forms and the report templates — is the practice's own and is kept private. A curated copy can be opened to a reviewer or an insurer on request.