Set scope and authorization
Name the legal owner of the assets, define domains and network ranges, agree on assessment methods and identify exclusions. Obtain written approval for active checks.
Build and validate the inventory
Gather known assets, then investigate related hostnames and services. Verify ownership before including discovered systems in active assessment.
Review and report
Examine relevant exposure indicators, validate important findings, assign owners and recommend next actions. Retain evidence and plan a follow-up review.
Put the guidance into practice
ASWEEP helps frame an authorized external assessment around asset visibility, exposure review and actionable reporting. Discuss your scope and goals before deciding which methods are appropriate.
Request a Security AssessmentFurther reading
For technical guidance, see the OWASP Web Security Testing Guide and CISA security resources. These external resources are provided for context.