A penetration test is only as useful as its scope. Define objectives, boundaries, safety constraints and evidence requirements before commissioning a test, so results answer the questions you actually have.
A well-defined scope produces findings you can act on and makes quotes easier to compare.
Start with what you need to know, such as whether an outside attacker could reach customer data, rather than a list of IP addresses. Objectives shape everything else.
Questions to ask
List the systems, applications, networks, cloud accounts and user roles in scope, and anything explicitly excluded.
Questions to ask
Rules of engagement set timing, permitted techniques, communication channels, escalation contacts and what happens if testers find evidence of a real compromise.
Questions to ask
You can only authorize testing of systems you control. Cloud providers publish testing policies, and hosted or managed services may need the provider's permission.
Questions to ask
Production and operational technology need extra care. Agree which systems must not be disrupted, which techniques are excluded and the stop conditions.
Questions to ask
A test is not finished when the report arrives. Build in retesting to confirm fixes worked, and ask for reproducible findings that developers and administrators can act on.
Questions to ask
Last reviewed September 24, 2026. This guide is general information, not legal advice. Print or save this page to use it as a workshop handout or pre-engagement checklist.
C3SA can help validate the current state, identify material gaps, define the target state and support implementation, testing and readiness.
