Use this worksheet to define the boundaries of an account-security review before anyone tests a live workflow. It is designed to reveal gaps between enrollment, recovery, and sensitive actions—not to collect customer identities or automate checks against real accounts.
Scope and permission
Agree on the environment and the authority to test. A completed worksheet is not authorization by itself.
- System, environment, release, and accountable owner
- Written authorization reference and permitted dates
- Approved test identities and data-handling restrictions
- Request limits, prohibited actions, and stop conditions
Enrollment and identity boundaries
Distinguish finding a record from establishing the applicant’s right to claim it.
- Evidence required before digital access is issued
- Information disclosed before identity verification
- Expected outcomes for existing, unregistered, and unsupported test records
- Owner of each handoff between record matching, verification, and access issuance
Recovery and sensitive changes
Review the routes around the initial sign-in decision, including support-assisted exceptions.
- Evidence required for account recovery
- Controls for changing contact details or adding devices
- Independent authorization for sensitive account actions
- Support exceptions and the approvals governing them
Observation and legitimate use
A blocked action is only part of the outcome. Check whether the customer and the investigator can still complete their work.
- Expected and observed result for each approved test
- Events and timestamps visible to the investigating team
- Legitimate customer paths, accessibility needs, and failure handling
- Sensitive data excluded from logs and shared evidence
Remediation and closure
Tie closure to a result observed in an identified release, not merely to a configuration change.
- Finding, proposed mitigation, and change owner
- Retest release, configuration, and evidence references
- Result: verified / partial / not reproduced / not assessed
- Residual risk, acceptance owner, and follow-up review date
Keep the working copy in your environment
This page does not collect your answers. Complete the template within your organization’s approved systems, with access and retention appropriate to the material. Do not use it to store credentials or unnecessary customer data.
A worksheet can help prepare an engagement; it does not replace written authorization or the final commercial agreement. Tervaq’s investigations, assessments, and validation work are paid services.