Outcome-oriented Scoping

Abstract

Scope identification by the CAPTR team is a multipart process that focuses on identifying those items that pose a lethal or critical impact if compromised. The scope in a CAPTR team assessment allows assessment resources to home in on a limited and prioritized subset of an overall organization. Scoping the assessment this way is necessary if the selected initial assessment assets are to enable the CAPTR team engagement to be successful. The scope of a CAPTR team engagement is more outcome oriented than a traditional red team assessment, because productivity and the cost benefit are tied directly to appropriate identification of critical or lethal compromise items that meet the threshold for inclusion. Identification of these assets is done by using appropriate personnel to perform worst-case scenario risk assessment, centrality analysis, and prioritization of potential targets.