Direct answer
Record each meaningful asset or workflow with its owner, test status, method, date and limitation. Discovery shows an item was observed; it does not establish that the relevant controls were tested.
Define useful rows
For a SaaS application, rows might represent the invoice API, administration interface, file export and password reset. Include environment, roles and expected boundaries. A thousand discovered URLs may represent fewer security-relevant workflows and should not be treated as a thousand completed tests.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Use explicit status
Distinguish assessed, excluded by agreement, unavailable, not attempted and pending. Add the reason and date: for example, an administrative route may be unavailable because no test account was supplied, while payment processing may be explicitly excluded.
- Record the method and role used.
- Link findings without exposing secrets.
- Assign an owner for unresolved coverage gaps.
Reconcile with the scope
Before final reporting, compare the ledger with the signed scope and ask owners about unexpected assets. If a new domain is discovered, verify authorization before testing it. Any scope change should be recorded separately from the technical discovery.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Use it for future work
A later retest or release assessment can start with changed components and previous unavailable paths. Record the new version and status rather than overwriting the earlier snapshot, so stakeholders can see which period each conclusion covers.
Assessment limits
A coverage ledger depends on the accuracy of the inventory, tester access and agreed level of detail. It cannot prove that every vulnerability in an assessed workflow was found.
Frequently asked questions
Does a discovered endpoint count as tested?
No. Record the specific checks and roles used, or mark the assessment as pending or unavailable.
Should exclusions appear in the report?
Yes. Explicit exclusions and unavailable areas help readers understand the limits of the assessment.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.