Environment overview
A record of systems, devices and responsible parties included in the review.
Know your gaps
Know what comes first
A baseline security review helps you understand current controls and prioritise practical improvements across your network, devices, accounts and recovery arrangements.
For businesses planning an IT handover, checking current protection, or starting a structured review of security responsibilities.
SCOPE
What we can take care of
Each item is confirmed in the engagement scope.
Control checks
Review of agreed access permissions, multi-factor authentication, update status and remote access.
Recovery readiness
Examination of available backup records and recovery arrangements. Restoration testing is scoped separately.
Prioritised findings
Identified gaps, their business relevance and recommended next steps.
DELIVERABLES
Know what you receive
Frequency, responsibilities, service hours and any separately charged work are agreed before the engagement.
- Scope and evidence limitations
- Environment and responsibility summary
- Findings and improvement list
- Prioritised recommended actions
SECURITY PRODUCTS
Security technology with local service
WebRAY (盛邦安全) security products are provided by distributor AL-TOUCH SOLUTIONS LIMITED 一大方案有限公司. Businesses can discuss vulnerability assessment and application security requirements, with equipment, licensing and deliverables specified in each proposal.
WebRAY (盛邦安全) provides vulnerability management, Web application protection, API security and network security products. GDMME discusses product selection, deployment and management around business requirements, identifying selected products and licences in the proposal.
WebRAY RayScan / VULNERABILITY ASSESSMENT
Find vulnerabilities. Prioritise improvements.
Scope agreed in the proposal
For assessments using RayScan technology from WebRAY (盛邦安全), GDMME can scope scanning, findings review, remediation advice and retesting around authorised assets and business requirements.
Checks that can be scoped
System vulnerabilities
Check operating systems, software and devices for known vulnerabilities and patch gaps.
Web application vulnerabilities
Check Web applications for injection, cross-site scripting and file upload risks.
Weak passwords
Assess authorised password risks, with rate and account lockout limits agreed beforehand.
Security baselines
Compare security settings with selected baselines and identify configuration gaps.
Database vulnerabilities
Review database configuration, authentication, permissions and known vulnerabilities.
Container images
Check container images for vulnerabilities and configuration issues before deployment.
When is an assessment useful?
- Before launch: agree exposed assets and checks, then review findings requiring remediation.
- After major changes or handover: review included systems and security configuration again.
- During periodic reviews: track new findings, remediation progress and retest results at an agreed frequency.
Agree authorisation and scope
Identify included IP addresses, websites, systems, access methods, test windows and stop conditions.
Scan and review findings
Scan as agreed, review findings and evidence limitations, and validate items requiring follow-up.
Provide a remediation list
Prioritise findings by risk and business impact, with affected assets, recommended actions and owners.
Arrange retesting
Retest remediated items within the agreed follow-up scope and record results and outstanding actions.
Reports and deliverables
The following deliverables can be included in the proposal. Evidence, depth and retest rounds depend on the agreed scope.
| Deliverable | What it can include |
|---|---|
| Scope and asset summary | Authorised assets, assessment dates, methods, exclusions and items still to be confirmed. |
| Findings and evidence | Affected assets, vulnerability identifiers and references, available evidence, and validated or pending status. |
| Risk and remediation list | Priorities based on severity, exposure and business impact, with actions, owners and target dates. |
| Retest and outstanding actions | Remediated, outstanding or unverified items, retest dates and remaining follow-up limitations. |
Before choosing a scanning proposal
Does every proposal include all six checks?
Coverage depends on edition, licence, access and business assets. The proposal identifies included modules, asset scope and exclusions so you can assess actual coverage.
Are findings fixed automatically?
The responsible team assesses remediation impact and schedules changes. GDMME can provide follow-up and retesting under a separately agreed engagement, or your existing IT team can act on the findings.
Available modules and functions depend on the selected edition, licence and deployment. Findings require review; penetration testing and red and blue team exercises can be scoped separately.
RED / BLUE / PURPLE TEAM
Validate defences through exercises
Exercise offering planned
GDMME is planning red and blue team exercises as an extension to security assessments. Agreed scenarios will help review attack paths, detection and response, followed by joint improvement planning and retesting.
Red team: emulate attack paths
Emulate agreed adversary behaviours within authorised assets and scope, documenting security gaps with verifiable evidence.
Blue team: validate detection and response
Review logs, alerts and escalation, and validate agreed containment, response and recovery arrangements.
Purple team: review and improve together
Use shared evidence to review detection coverage and gaps, then agree rule changes, process improvements and retesting.
Example exercise scenarios
These planning examples are selected around objectives, authorisation and staffing. Live system tests and tabletop exercises are scoped separately.
- Unusual account activity and access changes
- Use controlled scenarios to review logs, alerts, identity checks and escalation.
- Unusual Web requests
- Use agreed test requests to review logging, detection coverage and deployed controls.
- Incident reporting and recovery coordination
- Use a tabletop exercise to review contacts, responsibilities, containment decisions and recovery priorities.
Reviewing exercise results
Within scope, record scenarios executed, detection coverage, reporting and response times, improvement actions and retest results. Metrics and measurement methods are agreed in the proposal.
The proposal may include an exercise plan, test evidence, a detection coverage summary, improvement actions and retest records, subject to the agreed scope.
Before execution, agree written authorisation, assets, permitted and excluded activities, timing, stop conditions and data handling. Staffing, exercise depth and deliverables are confirmed for each engagement.
RESPONSIBILITIES & LIMITS
Agree the details before work starts
Clear boundaries make proposals easier to compare and day-to-day follow-up easier to manage.
Confirm separately
- A baseline review is not a penetration test, audit certification or legal compliance opinion.
- Testing that may affect systems needs separate authority and a maintenance window.
- Findings reflect agreed checks and the evidence available during the review.
What remains our responsibility?
Your company identifies the authorised decision-maker, business priorities and owners of systems and data. Approvals, safe access, current supplier coordination and agreed internal actions remain necessary.
Will systems discovered during the review also be checked?
Agree scope, authority, timing and fees before adding systems, tests or evidence gathering. Items outside the review must remain clearly identified and must not be treated as having passed.
BEFORE YOU DECIDE
Your questions answered
Is this a penetration test?
This is a baseline review of agreed controls and available evidence. Penetration testing requires separate scope, authorisation and scheduling.
Will it interrupt our business?
We agree access and timing beforehand. Any activity that may affect operations requires specific coordination and approval.
Do we have to subscribe afterwards?
The review can be a standalone engagement. Use the findings with your existing IT team or request a separate implementation or management proposal.
Does a review prove we are fully secure or compliant?
It reflects the agreed scope, time and available evidence. It does not guarantee that future incidents will not occur or provide compliance certification. Specific regulatory, audit or legal requirements need separate confirmation.
Can we start without a complete equipment list?
Start with the systems, locations, staff numbers and concerns you know about. Confirm access and evidence limitations before the review. Missing evidence must be recorded as a limitation, not treated as a passed check.
BEFORE WE START
How we define your service
- Your environment
- People, devices, locations and existing systems
- Included work
- Agreed tasks, licences and separately priced items
- Service arrangements
- Coverage hours, review frequency and handover timing
Public guidance and further reading
These independent educational resources support general preparation. They do not imply a partnership, accreditation or endorsement of GDMME. Check the original guidance for its scope and publication date.
Tell us what you need
Share your company size and a brief description. We will confirm the possible next steps.