Network Segmentation Assessment -- Scope Document

Engagement Overview

Client: Maskan Properties Contact: Fatima Al-Sulaiti, Chief Operating Officer IT Contact: Ahmed Khalil, Director of IT Assessment Type: Network segmentation assessment and hardening recommendation Duration: Up to 2 months (insurance compliance deadline: 3 months from engagement start)

Client Information

Maskan Properties operates 12 residential and commercial buildings across Doha and Al Wakra, Qatar. Each building has its own local network supporting tenant Wi-Fi, building management systems (HVAC, fire suppression, elevators), CCTV surveillance, and electronic access control. The buildings range from new residential towers to an older mixed-use complex in Al Wakra. Building networks were deployed incrementally as each property was added to the portfolio.

Scope

In-Scope Systems

• All building network infrastructure across 12 properties
• Tenant Wi-Fi networks and access points
• Building management systems (BMS) including HVAC, fire suppression, elevator controls
• CCTV surveillance network and management interfaces
• Electronic access control systems (door locks, readers, controllers)
• Inter-building network connectivity
• Remote access arrangements (VPN, third-party vendor access)
• Network segmentation between system types within each building
• Network segmentation between buildings

Out-of-Scope

• Individual tenant devices and personal networks
• Cloud-hosted services and SaaS applications
• Mobile applications
• Physical security assessments (locks, cameras as physical devices)
• Social engineering and phishing assessments
• Wireless signal analysis and RF testing
• Endpoint security on workstations and servers

Rules of Engagement

1. Operational continuity is mandatory. Buildings must remain fully operational throughout the assessment. No service disruption to tenants, building systems, or access control.
2. Testing during off-peak hours preferred. Active scanning and lateral movement testing should be conducted during off-peak hours (22:00-06:00 local time) where possible to minimize any risk of service impact.
3. Coordinate with IT. All active testing must be coordinated with Ahmed Khalil (Director of IT) in advance. Ahmed will provide technical access and documentation as needed.
4. No modifications to production systems without approval. Any configuration changes (segmentation, firewall rules) must be documented and approved before implementation. Changes to the lab/test environment are unrestricted.
5. Findings reported within 48 hours of discovery. Critical findings (life-safety system exposure) must be reported to Fatima Al-Sulaiti and Ahmed Khalil within 48 hours.
6. Data handling. Any data encountered during assessment must be treated as confidential. Assessment logs and findings stored securely. No tenant data to be extracted or stored outside the assessment environment.

Timeline

Points of Contact