Start with a question, an inventory, and an operating plan

Begin with the decision the assessment must support: identifying exposed services, checking patch coverage, or measuring configuration against an approved baseline. An IP range alone is a weak scope because addresses change and a single address can represent several services. Record stable asset identifiers, owners, business functions, network locations, and the reason each asset belongs in the assessment.

Reconcile the inventory with discovery results, cloud account records, and management platforms. An unrecognised device needs investigation; an expected device missing from a report needs explanation. Tag data sensitivity, service criticality, and dependencies separately. A low-data-sensitivity name server can still support many critical applications, so confidentiality labels alone cannot determine how cautiously it should be assessed.

Agree the assessment window with service owners, including batch processing, backups, peak demand, and maintenance restrictions. Define acceptable request rates, resource thresholds, exclusions, a contact who can stop the work, and the evidence needed to resume. A quiet period is useful only if the target is actually available then; remote endpoints that disconnect overnight require another collection approach.

Map where the scanner will sit relative to firewalls, network segments, and application gateways. A scanner on an employee network cannot automatically assess a restricted server segment. Use approved assessment points and documented access paths. Treat lost reachability as a coverage issue, rather than weakening segmentation just to produce a larger report. Pilot the plan on representative systems first.

Agree the scanner profile, sensitivity, and permitted checks before starting. More intrusive checks may increase confidence but also cause account lockouts, service strain, or unwanted state changes. Record expected assets, successful checks, failed authentication, skipped tests, and assessment time. Report completion against the expected population, rather than treating a finished scanner job as proof that every target was assessed.

Map internal policy and applicable contractual or regulatory requirements to assessment activities with the relevant governance or compliance adviser. Requirements may affect scope, frequency, evidence, and who performs a review; do not infer them from a generic template. Keep approvals and exclusions with the results so another analyst can distinguish an intentional limitation from an unnoticed failure.