Scoping a penetration test: what is in, what is out

The scope is the written agreement on what may be tested. Most problems on test day come from a vague one.

What to write down

• Targets: the applications, APIs, addresses and environments in scope, by name.
• Exclusions: systems owned by others, fragile systems, anything you cannot risk.
• Window: dates, hours and the source addresses the testers will use.
• Rules: whether denial-of-service, social engineering or physical access are allowed. The default is no.
• Contacts: who can say "stop", and who answers during the test.

Third parties

If your system runs on a provider's platform or calls a supplier's service, check their testing rules. Authorisation from you does not cover what you do not own.

Keep it a living document

If the tester finds something outside the scope, they should ask before touching it. A short written change to the scope takes minutes and avoids doubt later.