This page serves as gfxtm’s Assessment Spreadsheet walkthrough.
It explains how to enter data, how the sheets are structured, and how results are interpreted.
For our testing logic, and the transparency of our results; see our gfxtm’s Methodology & Assessment Terms.
Before a full assessment begins, I provide a Readiness Checklist to ensure your team is prepared. You can View the Checklist Template here to see the baseline requirements for a secure HIT environment.
This guide explains how to correctly enter data, understand sheet structure, and prepare your environment before submitting the assessment.
I. Infrastructure Inventory (User Input)
VAPT-DRP Sheet Architecture
Client Responsibility : Columns A through M are designated for the user to populate with asset data.
Engineer Analysis: Columns N through AW are reserved for the assessor’s technical findings and risk scoring.
HA (Home Assistant) Sheet Architecture
Client Responsibility: Columns A through L for user input.
Engineer Analysis: Columns M through U for assessment results.
Systematic Data Entry
Visual Legend: Columns are color-coded by service type: Red (VAPT), Green (DRP), and Blue (Home Assistant).
Validation Logic: Automated calculations are omitted by design to prevent misleading metrics. Every entry undergoes at least five manual validation checks (data cleanup, correction, and log verification) before a final score is determined. All scoring is manual by design to avoid misleading metrics and ensure human‑verified accuracy.
Guidance: Refer to the footer of each field for boundary definitions and expected value formats.
Note: Before filling out the spreadsheet, you must identify all active assets in your environment.
Tools: If you do not have an up-to-date asset list, use the IP scanners and OS verification commands found on our Resources & Tools page.
Required Data: You will need the IP Address, MAC Address, and exact OS Build (e.g., Windows 10 Pro 22H2) for every device.
II. Data Input Standards
Before you begin:
Ensure you have administrative access to all devices.
Gather network diagrams or IP lists if available.
Confirm consent for VAPT and password testing.
Prepare to provide accurate OS, version, and hardware details.
Use the following schema to ensure data quality. For specific field boundaries, refer to the “expected value” notes in the footer of the spreadsheet cells.
| Column Name | Data Expected | Technical Note |
|---|---|---|
| Machine Name | Hostname / Local DNS name | Primary unique identifier. |
| Machine Type | Workstation, Router, Server, IoT | Define primary duty; list all if multi-role. |
| ID | Asset Tag / Barcode / QR | Physical hardware identifier. |
| IP Addr | IPv4 and/or IPv6 Address | List all active interfaces and virtual IPs. |
| Network Profile | Network Metadata | DNS, Gateway, Subnet, DHCP/Static status. |
| Hardware ID | MAC / UUID / EUI-64 | Unique hardware identifier for all interfaces. |
| Protocols (HA) | Bluetooth, Zigbee, BLE, etc. | Communication standards for IoT devices. |
| Org | Domain / Identity Context | Active Directory, Workgroup, or Domain. |
| OS / Version | OS Type & Build Detail | Distro (Linux), Build # (Win/Mac), or Firmware. |
| Services | Critical Software Stack | List services/builds affecting backup or security. |
| Port Scan Test | Boolean (Yes/No) | Explicit consent for aggressive port scanning. |
| Password Test | Boolean (Yes/No) | Explicit consent for password abuse/brute-force testing. |
| Last Backup Date | YYYY-MM-DD | Required for DRP validation and RPO analysis. |
III. Submission Protocol
Once the inventory is complete, please notify gfxtm via your established secure communication channel Signal, or Telegram or as listed on our Professional Inquiries section. Do not send unencrypted spreadsheets containing IP architecture via standard email.