OpenCyber AcademyLesson map
Lesson 19. Map, example, EX065.
flowchart TD
A["A scope can name dates"] --> B["This scope names systems and data"]
B --> C["No calendar date is printed"]
C --> D{"Does a finished checklist widen the scope?"}
D -->|No| E["Exclusions stay excluded"]
Completing a checklist is not a new permission.
Logical drawing
inside
vendor's test environment
read-only configuration and documentation
synthetic customer data
outside
live ledger
real customer data
vendor's other clients
signature
Elena and the vendor
no printed dates
Learning outcomes
After this chapter, you should be able to:
- Repeat what the scope includes and excludes.
- Leave the calendar dates unprinted.
- Keep a finished checklist from widening the note.
19.1 The lists are full enough without a calendar.
A written scope can name systems, activities, dates, data, and a contact. Copperleaf's note uses the parts the manuscript actually gives. Inside: the vendor's test environment, read-only configuration and documentation, and synthetic customer data. Outside: the live ledger, real customer data, and the vendor's other clients. The vendor signs alongside Elena because the vendor owns the test environment. The contractor who meets something outside that list stops and reports it. He does not investigate. Testing without permission can be unlawful even when the motive is good. What the note does not give is a calendar. No start day and no end day are printed. "Dates" as an element of a good scope does not invent dates for this one. Finishing the loyalty checklist, or finishing these lessons, does not move the live ledger to the inside list. The exclusions were chosen so the review cannot touch customers or the vendor's other work. A completed exercise is not a new signature from the vendor. The co-signature stays as chapter 2 described it, and the stop-and-report rule stays with it.
19.2 Worked example
Change the inside list only with a sentence the file already contains.
Lesson table; scroll horizontally to read all columns →
| Proposal | In the scope? | Decision |
|---|---|---|
| Test environment, read-only configuration, synthetic data | Inside | Keep them inside |
| Live ledger, real customers, other clients | Outside | Keep them outside |
| Calendar dates | Not printed | Do not add them |
| "The checklist is finished, so the live ledger is in." | No such permission | Refuse |
Synthetic case. The permission note has no weekday and no month. The vendor remains unnamed.
Errors and limits
An undated scope can still bind. Missing dates do not make the excluded systems allowed.
Apply
- EX065 — What do you add? Elena and the vendor have signed. The checklist task is finished. Which dates do you write, and does the live ledger, real customer data, or another client move inside?
Show marking criteria
Rubric: 3 = no dates are printed; the vendor stays the co-signer; the test environment and synthetic data stay in; the live ledger, real customer data, and other clients stay out; finishing the checklist does not widen the note;; 2 = no dates and no wider scope;; 1 = one list;; 0 = none.