Scope and fit
A useful penetration test starts with written permission and a boundary both sides can explain. Clear scope protects production, testers, customers, and evidence quality.
Agree on limits and escalation
Set test windows, prohibited actions, rate limits, social-engineering permissions, safety stop conditions, emergency contacts, and notification rules. Define how a suspected critical exposure is reported immediately.
Specify reporting and retest
Agree on evidence handling, severity discussion, affected versions, remediation guidance, and retest boundaries. NIST SP 800-115 describes planning and testing considerations; written authorization remains essential.
Decisions and tradeoffs
Use this table as a working review record. Replace assumptions with evidence from the target environment.
| Decision area | Working guidance |
|---|---|
| Name the authorized assets | List domains, applications, APIs, IP ranges, accounts, cloud projects, and approved test environments. Identify third-party systems and customer data that are explicitly out of scope. |
| Agree on limits and escalation | Set test windows, prohibited actions, rate limits, social-engineering permissions, safety stop conditions, emergency contacts, and notification rules. Define how a suspected critical exposure is reported immediately. |
| Specify reporting and retest | Agree on evidence handling, severity discussion, affected versions, remediation guidance, and retest boundaries. NIST SP 800-115 describes planning and testing considerations; written authorization remains essential. |
Implementation questions
What should the team decide about name the authorized assets?
List domains, applications, APIs, IP ranges, accounts, cloud projects, and approved test environments. Identify third-party systems and customer data that are explicitly out of scope. Use a named owner and a written acceptance check so this decision can be reviewed after deployment.
What should the team decide about agree on limits and escalation?
Set test windows, prohibited actions, rate limits, social-engineering permissions, safety stop conditions, emergency contacts, and notification rules. Define how a suspected critical exposure is reported immediately. Use a named owner and a written acceptance check so this decision can be reviewed after deployment.
What should the team decide about specify reporting and retest?
Agree on evidence handling, severity discussion, affected versions, remediation guidance, and retest boundaries. NIST SP 800-115 describes planning and testing considerations; written authorization remains essential. Use a named owner and a written acceptance check so this decision can be reviewed after deployment.
Plan, build, verify, operate
Name the authorized assets: List domains, applications, APIs, IP ranges, accounts, cloud projects, and approved test environments. Identify third-party systems and customer data that are explicitly out of scope. Record the result and the next owner before changing the next boundary.
Agree on limits and escalation: Set test windows, prohibited actions, rate limits, social-engineering permissions, safety stop conditions, emergency contacts, and notification rules. Define how a suspected critical exposure is reported immediately. Record the result and the next owner before changing the next boundary.
Specify reporting and retest: Agree on evidence handling, severity discussion, affected versions, remediation guidance, and retest boundaries. NIST SP 800-115 describes planning and testing considerations; written authorization remains essential. Record the result and the next owner before changing the next boundary.
Deployment checks
Turn the page into a reviewable handover by assigning each check to a person and retaining its result.
How to Scope a Penetration Test Safely and Usefully: decision 1
Write down the boundary, owner, dependency, and proof required for how to scope a penetration test safely and usefully before implementation begins.
How to Scope a Penetration Test Safely and Usefully: decision 2
Write down the boundary, owner, dependency, and proof required for how to scope a penetration test safely and usefully before implementation begins.
How to Scope a Penetration Test Safely and Usefully: decision 3
Write down the boundary, owner, dependency, and proof required for how to scope a penetration test safely and usefully before implementation begins.
Handover and ownership
Before handover, name the system owner, support path, access boundary, backup or recovery responsibility, and the condition that pauses a change.
Keep a short record of what was tested, what remains outside scope, and when the review should happen again.
