Skip to main content
For AI agents: a documentation index is available at https://docs.coverbase.com/llms.txt. This page is also available in markdown by appending .md to the URL.
This guide is part of the User Guides collection. It covers a vendor’s Internal Context tab, the Scoping view on a control, and an assessment’s Scoping tab. It sits between creating the assessment and collecting the evidence.
The same control library often goes to very different vendors. A payments network and an outside law firm can get the same questions, but the secure development questions matter far less for the law firm. Engagement scoping lets you decide, for one assessment, which questions to emphasize, which to ask as written, which are lower priority and which are out of scope. Coverbase recommends the scope from what your team knows about the relationship, and every reason points to the row, page or intelligence section it relied on. Your Coverbase representative turns on engagement scoping for your organization. Then turn it on for each assessment plan that should use it: open Configuration → Assessment Settings, edit the plan, and switch on Scope Assessments Before They Start. It is off by default. An assessment from a plan with it on is scoped first, and it starts when someone approves the scope or skips scoping. An assessment from any other plan starts as usual, with no Scoping tab or step.
The Edit assessment plan dialog with the Scope Assessments Before They Start switch turned on, between Draft Follow-Ups After Evaluation and Recheck Unresolved Controls.

The plan option. Off by default.

The mistake people make most often is waiting for evidence collection on an assessment whose scope nobody has approved. The status card shows Scoping · ready for review until you click Approve scope.

​
Step 1: Add internal context to the vendor

Internal context is what your own team knows about the relationship: inherent risk questionnaire (IRQ) answers, application inventory records, architecture documents, notes. The vendor never sees it, and Coverbase never uses it as evidence that the vendor has a control.
  1. Open the vendor and choose Internal Context.
  2. Click New context.
  3. Choose how to add it:
    • Upload files: drop one or more PDF, Word, Excel, CSV or text files, up to 25 MB each. Before you save, each file shows what Coverbase read from it, for example Coverbase read 19 records from 1 sheet.
    • From vendor documents: pick a document already on the vendor.
    • Write a note: type the facts in plain text.
  4. Pick what the context Applies To: the whole relationship or one service, and its Source.
  5. Save.
The New Context dialog on the Upload files tab. Applies To is Whole Relationship and Source is CMDB. Two staged files, northwind-app-inventory.xlsx reading Coverbase read 5 records from 1 sheet and northwind-irq.docx reading Coverbase read 1 section, each with a green check. Below, a note says files are also kept in the vendor's Documents marked Internal context, and the button reads Add 2 files.

New context with two files read. Each file says what Coverbase read before you save.

The New Context dialog on the Write a note tab with Source set to Description, the title Payout timing and a body saying merchant payouts run once each business day at 6 PM Eastern.

A note written by hand. It needs a title and the facts.

Coverbase reads a spreadsheet one record per row, including a sheet that holds a title and more than one table. A PDF is read page by page and a Word file section by section. Click a file’s title to see the records it read and where each one sits, for example Row 8.
The Internal Context tab for Northwind Pay with three items under Whole Relationship. northwind-app-inventory.xlsx is expanded, listing Row 4 Card Vault API through Row 8 Support Portal, Showing 5 of 5 and an Open file link. Below it northwind-irq.docx and a note titled Payout timing.

The Internal Context tab. A file opens to the records Coverbase read and where each one sits.

An uploaded file also appears on the vendor’s Documents tab with an Internal context badge. Evidence collection and evaluation never use it.
The vendor's Documents tab listing northwind-irq.docx and northwind-app-inventory.xlsx, each with a gray Internal context badge beside its name.

Context files on the Documents tab carry an Internal context badge.

​
Step 2: Set criteria on a question (optional)

A question can carry its own rules for when it matters more or less. Criteria are kept on the control, so they apply to every assessment that asks it.
  1. Open Configuration → Controls, open the control set, and open the control.
  2. Choose the Scoping tab.
  3. Click Add criterion and pick one:
    • When conditions hold: choose a relevance and add conditions. Choose whether all of these hold or any of these holds.
    • When Coverbase judges a sentence true: choose a relevance and write what must be true, for example “The vendor runs AI models that make or support decisions about our customers.”
  4. Click Save criteria.
A condition can check one of four things:
The Scoping tab of control DP 3 in the control drawer. Criterion 1 is Lower priority when all of these hold, with a context field condition Stores Card Numbers? is No in every record and a second condition whose Condition on menu is open, listing Context field, Vendor tag, Service tag and Service attribute.

Each condition starts with what it checks.

Two saved criteria on DP 3. Criterion 1 is Lower priority when all of these hold: Stores Card Numbers? is No in every record, and Vendor tag has Tier: Critical. Criterion 2 is Emphasize when Coverbase judges that the vendor stores full card numbers for us or on our behalf.

Saved criteria. Conditions are checked first, then sentences, each in the order listed.

Coverbase checks conditions first and then sentences, in the order listed, and the first that holds decides. A condition on a context field holds only when at least one record has that column. Questions that no criterion decides get Coverbase’s own recommendation. A relevance set by an assessment plan, or picked by an analyst, still wins over a criterion.

​
Step 3: Create the assessment and watch the scope run

Create the assessment as usual. Coverbase opens it on the Scoping tab and starts the recommendation at once. A progress bar shows how many questions are scoped. You can leave the page while it runs.
A new assessment on its Scoping tab. The status card reads Scoping 33% above Collecting Documents, Analyzing Controls and Review Results. The tab shows Recommending a scope for 15 questions with a progress bar at 5 of 15 questions scoped and four stages, two of them done.

A scope being recommended. The status card shows the Scoping step ahead of Collecting Documents.

The status card shows a Scoping step ahead of Collecting Documents. While the scope waits for approval, the assessment stays at Created and you cannot move it to another status, except to cancel it. Coverbase reads:
  • the vendor’s internal context, notes and files
  • the services in the assessment and their tags
  • the vendor’s intelligence: security posture, financial health, compliance and legal, and radar alerts from the last year
  • each question’s criteria and your assessment plan’s rules
The line under the summary says what was read. Click Sources for the list.
The Scoping tab in Draft after run 1. The summary describes Northwind Pay, the line under it reads Read 2 files and 1 note with a Sources link, and a strip counts 15 questions: 10 Emphasize, 3 Standard, 2 Lower priority and 0 Out of scope. The status card reads Scoping, ready for review.

A recommended scope ready for review.

The Sources popover open under the summary, listing the two files, the note and the vendor intelligence sections the recommendation read.

Sources lists every context item and intelligence section the run read.

​
Step 4: Review the recommendation

Each question shows its relevance and why. Under each reason are the sources it cites. Click a source to see the quoted words and where they sit, for example Row 5 of a workbook, and click Open file to see the file.
A citation popover on IAM 1 for northwind-app-inventory.xlsx, Row 6, marked Internal context, never shown to the vendor, quoting Moves settled funds to merchant bank accounts each business day, with an Open file link.

A citation opens to the quoted words and where they sit.

Under each question, the decision source says who decided it: Coverbase, a plan rule, the question’s criteria, or an analyst. To change a question, pick another relevance and add a note. Your decision survives a Regenerate.
The relevance picker open on GOV 1 with Lower priority selected and the note Governance is covered by the annual SOC 2 we already review.

Changing a question's relevance. The note is for second line reviewers.

The Lower priority filter showing GOV 1 decided by Analyst, Clarence Chio, with the analyst's note, and DP 3 decided by Question criteria, Stores Card Numbers? is No in every record and Vendor has tag Tier: Critical.

Filtered to Lower priority. Each question says who decided it.

​
Step 5: Add context through the chat

Use the box above the questions to tell Coverbase something about the engagement, or to ask why a question landed where it did. For example: “The wallet app never stores full card numbers. Cards are tokenized before they reach the vendor.” When the answer would change the scope, Coverbase shows a proposal: the note it would save as internal context, and each question it would move, with the reason and its sources. Nothing changes until you click Apply. Dismiss changes nothing.
The Scoping Chat. The message says the fraud model only flags payments for a person to review. The answer proposes saving that as a note and moving AI 2 from Emphasize to Standard, with its reason and two cited sources, above Dismiss and Apply buttons.

A proposal from the chat. Nothing changes until you apply it.

After applying the proposal, the question Why is DP 3 lower priority? and an answer explaining that a rule on the question decides it, citing the questionnaire and the application inventory.

Ask why a question landed where it did.

When you apply a proposal, the note is saved on the vendor’s Internal Context tab, marked as from the scoping chat. A question you or a workbook already decided is never moved.

​
Step 6: Approve the scope

Click Approve scope. The dialog lists how many questions are in each relevance and what each one means for the evaluation. Click Approve and start. The assessment starts and Coverbase begins collecting evidence.
The Approve Scope and Start the Assessment dialog: 9 Emphasize held to a higher bar, 3 Standard evaluated as written, 3 Lower priority where a gap is recorded as an observation, and 0 Out of scope left out of the evaluation, with Cancel and Approve and start.

Approving starts the assessment.

To change an approved scope, click Reopen. The assessment keeps running. Your changes apply from the next evaluation run once you approve the scope again.

​
Skip scoping

To run an assessment without a scope, click Skip scoping, next to Approve scope or under a recommendation that is still running, and confirm. The assessment starts at once as if scoping were off: every question is asked and evaluated as written. The status card shows Scoping skipped, and the Scoping tab says who skipped it and when. To scope it after all, click Scope this assessment. The assessment keeps running, and an approved scope applies from the next evaluation run.
The Skip Scoping dialog saying the assessment starts now as if scoping were off and every question is asked and evaluated as written, with Cancel and Skip and start buttons.

Skipping starts the assessment as if scoping were off.

An assessment whose status card reads Scoping skipped above Collecting Documents. The Scoping tab reads Scoping skipped, Skipped by Clarence Chio on Oct 30, 2026, with a Scope this assessment button.

A skipped scope. The status card and the Scoping tab both say so.

​
Step 7: See what the scope changed

Once results are evaluated under the approved scope, the Scoping tab shows Effect on Findings: how many issues the results raised, how many gaps on lower priority questions were kept as observations, how many out of scope questions were left out, and how many issues the same results would have raised without the scope.
The approved Scoping tab with the line Approved by Clarence Chio, The assessment started on approval. Effect on Findings reads 6 results evaluated under this scope raised 2 issues and kept 2 gaps on lower priority questions as observations. No question was left out. Without the scope, the same results would have raised 4 issues. 2 of the issues are on emphasized questions.

An approved scope and its effect on the results evaluated under it.

Each issue, and each finding raised from one, shows Engagement Relevance: the question’s relevance and why it matters for this vendor. A gap on a lower priority question is marked Observation and does not raise a finding.
An issue drawer titled No MFA evidence for privileged access. Engagement Relevance shows Emphasize and the reason that privileged access to the Payout Engine and Card Vault API could redirect merchant funds, from the scope this result was evaluated under.

An issue on an emphasized question says why it matters here.

A result titled Laptop patching runs on a 30 day cycle with No issue found. Engagement Relevance shows Lower priority and an Observation badge, set by the plan rule matching laptops and desktops, with the note that the gap is kept on the result and does not raise a finding.

A gap on a lower priority question is kept as an observation.

A finding titled Privileged access to the Payout Engine has no second factor. The Why It Matters for This Engagement section lists IAM 1 as Emphasize with its reason, from the scope this result was evaluated under.

A finding carries the relevance of each question it came from.

​
Troubleshooting

How to run an assessment

The full lifecycle, from creating the assessment to the export.

Admin setup

Assessment plans and the rules that set question relevance.

The vendor record

Vendors, services and their documents.

Evidence quality and source credibility

How the evidence itself is graded.