Skip to tutorial content
Rate module Not yet rated

Getting Security Approval

4 min read
On this page

In this lesson, you will learn:

  • What security needs to approve
  • Typical conditions
  • How to record approval

🔁 Quick look back: Last time: Building the Service Account and Privilege Matrix. You learned how to list the exact rights each Discovery account needs.

1 The Problem: No Scan Runs Without Farah’s Approval

Everything is designed. But Farah hasn’t signed. Without her approval:

  • Ravi won’t open the firewall rules.
  • Priya won’t create the accounts.
  • No scan can run.

🎯 The problem: No scan can run without Farah’s approval.

👉 The fix: Give Farah one clear pack, answer her questions, and record her conditions.

Cards: what Farah reviewed and her conditions.
Figure 1. Farah’s security approval for Clear View.

2 What security needs

  • What will be scanned, and what won’t.
  • Which accounts and rights.
  • Which ports and directions.
  • When scans run.
  • How MID Servers are protected.

3 Conditions

Security often approves with conditions. Treat each one as a requirement, and check it in testing.

⭐ Remember: Get the approval in writing, with the date and the conditions.

4 Project Clear View: How We Implemented It

📍 Situation: Farah must approve before firewall rules and accounts are created.

🧭 Decision: Send one approval pack and meet her to walk through it.

🛠️ Steps we took:

  1. Sent the port matrix, privilege matrix, hardening checklist, schedules and exclusions.
  2. Met Farah for 45 minutes.
  3. She approved with four conditions.
  4. Added each condition to the requirements and test plan.

✅ What we verified:

  • Approval is in writing, dated week 3.
  • Each condition has a test.

📁 Evidence: Farah’s written approval (PR-10) and four new test cases.

5 Quick recap

  • Security needs scope, accounts, ports, timing and MID protection.
  • Approval often comes with conditions.
  • Treat conditions as requirements.
  • Get approval in writing.

6 Check yourself

Think of your answer first. Then tap to check.

1 Why does nothing move until security approves? Show answer

Firewall rules and accounts depend on that approval.

2 What do you do with a security condition? Show answer

Treat it as a requirement and test it.

3 Name one of Farah’s conditions. Show answer

Any of: London after 22:00 UK time, no DMZ scans in business hours, Finance by agents only, 90-day rotation.

Nice work! Clear View has security approval. 🎉
Next up: Tracking Prerequisites and Chasing Blockers

Was this lesson helpful?

Have a question or doubt?

Ask here and get help from instructors and fellow learners.

0 / 300

Only logged-in learners can post.