Penetration Testing Scope and Rules of Engagement: A Client Checklist
A penetration test is only as reliable as its scope. Written rules of engagement protect the client, tester, users, and third-party providers by establishing what is allowed, what is excluded, and how unexpected events will be handled.
Identify the authorized owner and assets
Record the organization authorizing the work and the person empowered to approve changes or stop testing. List domains, IP ranges, applications, APIs, cloud accounts, mobile builds, and environments precisely. Confirm ownership and dependencies. Do not assume a vendor, shared host, or customer-connected system is included because it is reachable.
Define permitted and prohibited techniques
State whether the engagement includes authenticated workflows, social engineering, wireless assessment, denial-of-service simulations, physical security, or exploitation beyond safe validation. Explicitly consider prohibiting destructive testing, persistence, malware deployment, data exfiltration, and access to unrelated users' data. Boundaries should match the written authorization and risk tolerance.
Set operational safeguards
Choose testing windows, source IP addresses, rate limits, approved test accounts, monitoring contacts, and escalation channels. Agree how to handle service degradation, suspected real compromise, accidental exposure of sensitive information, and third-party notifications. Ensure the tester can pause work promptly.
Specify evidence and reporting
Agree on evidence formats, secure transfer, encryption, report distribution, storage, retention, and deletion. Findings should identify affected assets, reproducible observations, business impact, severity rationale, remediation guidance, and limitations. Avoid collecting more data than needed to demonstrate risk.
Close with retesting and sign-off
Set the remediation review process and define retesting scope. Record outstanding risks, accepted exceptions, and assets that could not be tested. Both parties should retain the approved scope and final report according to their security and legal requirements.