How to define the scope of a penetration test

A well-written scope says what may be touched, by whom, when, and what must not be done. It is the first document of every test.

five elements

What it should contain.

Every host included, written out in full. A domain not listed is out of scope.

The accounts to use, the role of each one and who manages them.

Dates and hours in which the test may run.

What must not be done: denial of service, social engineering, real data.

Who to call for a serious vulnerability, and through which channel.

Template. We send the authorisation declaration template together with the proposal.