VULNERABILITY ASSESSMENT REPORT

TEMPLATE

VULNERABILITY
ASSESSMENT REPORT
COMPANY NAME
Street Address
City, State and Zip

webaddress.com

VERSION 0.0.0

00/00/0000

VERSION HISTORY

VERSION APPROVED BY REVISION DATE DESCRIPTION OF CHANGE AUTHOR

PREPARED BY TITLE DATE

APPROVED BY TITLE DATE

1
TABLE OF CONTENTS
TABLE OF CONTENTS .............................................................................................................................................................. 2
1. INTRODUCTION .............................................................................................................................................................. 4
2. PROJECT SCOPE ............................................................................................................................................................ 4
A. IN SCOPE ..................................................................................................................................................................... 4
B. OUT OF SCOPE ............................................................................................................................................................ 4
3. ACTIVITIES SCHEDULE .................................................................................................................................................... 5
A. FIRST DAY ..................................................................................................................................................................... 5
B. SECOND DAY .............................................................................................................................................................. 5
C. THIRD DAY ................................................................................................................................................................... 5
4. BACKGROUND INFORMATION ..................................................................................................................................... 6
5. CLIENT ORGANIZATION ................................................................................................................................................. 6
6. ASSET IDENTIFICATION ................................................................................................................................................... 7
A. ASSET IDENTIFICATION PROCESS ............................................................................................................................... 7
B. TANGIBLE ASSETS......................................................................................................................................................... 7
C. INTANGIBLE ASSETS ..................................................................................................................................................... 8
7. THREAT ASSESSMENT ...................................................................................................................................................... 8
A. THREAT ASSESSMENT PROCESS .................................................................................................................................. 8
B. THREATS TO THE CLIENT ORGANIZATION .................................................................................................................. 8
B1. NATURAL THREATS ......................................................................................................................................................... 9
B2. INTENTIONAL THREATS ................................................................................................................................................... 9
B3. UNINTENTIONAL THREATS .............................................................................................................................................. 9
8. LAWS, REGULATIONS, AND POLICY ............................................................................................................................. 9
9. FEDERAL LAW AND REGULATION............................................................................................................................... 10
10. CLIENT ORGANIZATION POLICY ................................................................................................................................. 10
A. VULNERABILITIES: CLIENT ORGANIZATION POLICY ................................................................................................ 11
11. PERSONNEL .................................................................................................................................................................. 12
A. MANAGEMENT .......................................................................................................................................................... 12
B. OPERATIONS .............................................................................................................................................................. 12
C. DEVELOPMENT .......................................................................................................................................................... 12
D. VULNERABILITIES: PERSONNEL .................................................................................................................................. 13
12. NETWORK SECURITY ..................................................................................................................................................... 14
A. PUBLIC NETWORK RESOURCES AND SITES .............................................................................................................. 14
B. PARTNER CONNECTIONS AND EXTRANETS ............................................................................................................ 14
C. VULNERABILITIES: NETWORK SECURITY .................................................................................................................... 15

2
13. SYSTEM SECURITY ......................................................................................................................................................... 16
A. VULNERABILITIES: SYSTEM SECURITY ......................................................................................................................... 16
14. APPLICATION SECURITY............................................................................................................................................... 17
A. VULNERABILITIES: APPLICATION SECURITY .............................................................................................................. 17
15. OPERATIONAL SECURITY ............................................................................................................................................. 18
A. VULNERABILITIES: OPERATIONAL SECURITY............................................................................................................. 18
16. PHYSICAL SECURITY ..................................................................................................................................................... 19
A. VULNERABILITIES: PHYSICAL SECURITY..................................................................................................................... 19
B. VULNERABILITIES: BUILDING ...................................................................................................................................... 20
C. VULNERABILITIES: PERIMETER SECURITY ................................................................................................................... 21
D. VULNERABILITIES: SERVER AREA ............................................................................................................................... 22
17. SUMMARY ..................................................................................................................................................................... 23
18. ACTION PLAN............................................................................................................................................................... 23
19. REFERENCES ................................................................................................................................................................. 24

3
1. INTRODUCTION

2. PROJECT SCOPE
A. IN SCOPE

B. OUT OF SCOPE

4
3. ACTIVITIES SCHEDULE
A. FIRST DAY

B. SECOND DAY

C. THIRD DAY

5
4. BACKGROUND INFORMATION

5. CLIENT ORGANIZATION

6
6. ASSET IDENTIFICATION
A. ASSET IDENTIFICATION PROCESS

B. TANGIBLE ASSETS

7
 C. INTANGIBLE ASSETS

7. THREAT ASSESSMENT
A. THREAT ASSESSMENT PROCESS

B. THREATS TO THE CLIENT ORGANIZATION

8
 B1. NATURAL THREATS

B2. INTENTIONAL THREATS

B3. UNINTENTIONAL THREATS

8. LAWS, REGULATIONS, AND POLICY

9
9. FEDERAL LAW AND REGULATION

10. CLIENT ORGANIZATION POLICY

10
A. VULNERABILITIES: CLIENT ORGANIZATION POLICY

VULNERABILITY EXPLANATION RISK RECOMMENDATION

11
11. PERSONNEL

A. MANAGEMENT

B. OPERATIONS

C. DEVELOPMENT

12
D. VULNERABILITIES: PERSONNEL

VULNERABILITY EXPLANATION RISK RECOMMENDATION

13
12. NETWORK SECURITY

A. PUBLIC NETWORK RESOURCES AND SITES

B. PARTNER CONNECTIONS AND EXTRANETS

14
C. VULNERABILITIES: NETWORK SECURITY

VULNERABILITY EXPLANATION RISK RECOMMENDATION

15
13. SYSTEM SECURITY

A. VULNERABILITIES: SYSTEM SECURITY

VULNERABILITY EXPLANATION RISK RECOMMENDATION

16
14. APPLICATION SECURITY

A. VULNERABILITIES: APPLICATION SECURITY

VULNERABILITY EXPLANATION RISK RECOMMENDATION

17
15. OPERATIONAL SECURITY

A. VULNERABILITIES: OPERATIONAL SECURITY

VULNERABILITY EXPLANATION RISK RECOMMENDATION

18
16. PHYSICAL SECURITY

A. VULNERABILITIES: PHYSICAL SECURITY

VULNERABILITY EXPLANATION RISK RECOMMENDATION

19
B. VULNERABILITIES: BUILDING

VULNERABILITY EXPLANATION RISK RECOMMENDATION

20
C. VULNERABILITIES: PERIMETER SECURITY

VULNERABILITY EXPLANATION RISK RECOMMENDATION

21
D. VULNERABILITIES: SERVER AREA

VULNERABILITY EXPLANATION RISK RECOMMENDATION

22
17. SUMMARY

18. ACTION PLAN

23
19. REFERENCES

24
 DISCLAIMER

Any articles, templates, or information provided by Smartsheet on the website are for reference
only. While we strive to keep the information up to date and correct, we make no representations
or warranties of any kind, express or implied, about the completeness, accuracy, reliability,
suitability, or availability with respect to the website or the information, articles, templates, or
related graphics contained on the website. Any reliance you place on such information is therefore
strictly at your own risk.

25