# Technical follow-on handoff contract
Proposed planning worksheet. Not a substitute for the organization's authorization procedure.

## Before execution
- Objective and expected result:
- Starting state: demonstrated / assumed:
- Evidence of starting state, or provider of assumed access:
- Acting identity, client and session reference (no secret values):
- Target environment and harmless record:
- Exact initial permitted operation:
- Separately authorized cleanup verification operation and target:
- Excluded identities, systems and actions:
- Time window and participating owners:
- Required authorizations, including any third-party authorization:
- Data handling and restricted evidence location:
- Available event/request correlation:
- Defender notification, allowlisting or suppression affecting the test:
- Stop criteria and abort contact:
- Authority and conditions for resuming:

## Execution and response
- Fresh request and result reference:
- Matching application observation:
- Expected versus actual result:
- What remains untested or unresolved:
- Detection system/window, collection, alert and analyst response:
- Scope deviation and disposition:

## Closure
- Test objects, grants and session cleanup actions:
- Fresh access-restriction check, if authorized:
- Evidence retention and destruction owner/date:
- Unfinished cleanup, exception owner and next checkpoint:
- Retest conditions:

Conclusion: Starting from [demonstrated/assumed] access, [identity/context] attempted [operation] and observed [result]. Earlier stages [were/were not] demonstrated. Cleanup [status]. Remaining questions [owner].