Device Authorization Review Worksheet
How device-code phishing sends tokens to an attacker-controlled client, when device registration is possible, and what evidence establishes each outcome.
Worksheets
Download editable worksheets, evidence checklists, and tabletop exercises. Each comes with an article explaining when and how to use it.
23 worksheets
Clear searchHandoff card
Route urgent requests for customer information to the authorized response team without turning the first support conversation into an unreviewed disclosure.
Federation review packet
After an administrator account is compromised, check whether it changed which identity providers your organization trusts. Restoring the account does not undo configuration changes.
Fictional join ledger
Connect an employee report, authentication attempts, and a VPN session without turning nearby timestamps into proof of the same interaction.
Onboarding decision record
A believable onboarding story does not authorize access. Check the approved worker record, who is asking, and who can approve the specific change.
Payroll evidence worksheet
Did the payroll destination change, and did a payment reach it? Work through mailbox and payroll records in a fictional investigation, with an optional worksheet.
RDP connection review card
An outbound Remote Desktop connection can make local files available to the remote host. Check the destination, Windows warning and selected resources before connecting.
Fictional evidence CSV
Use a fictional evidence packet to test human reporting and sensor alerts separately, identify delivery delays, and assign a focused detection or response retest.
Review instructions
Use a fictional evidence packet to test human reporting and sensor alerts separately, identify delivery delays, and assign a focused detection or response retest.
Supplier-change review sheet
Use two fictional supplier records to separate contact verification, supplier-data changes, and payment approval without changing production records or moving money.
Technical handoff contract
Before extending a social-engineering exercise, agree what access you start with, which operation you may test, and how you will end the test access.
Assessment-design worksheet
Decide what to count in a help-desk assessment, work through a fictional dataset, and compare the same participants in a retest.