Write a scope outline for a penetration test I commission
Drafts a scope and rules-of-engagement outline you can send to a security firm you hire to test a system you own.
Task:
Draft a scope and rules-of-engagement outline for a penetration test that I commission from a security firm.
Context:
My organization is [organization description]. The systems to be tested are [systems and addresses], all owned by us. We want the test between [start date] and [end date], and our main concern is [main concern]. The reader is the security firm's project lead.
Rules:
- Use these headings: objective, in scope, out of scope, testing windows, contacts and escalation, data handling, reporting, and authorization.
- Under authorization, leave a clear placeholder for the written permission and the name of the person who signs it.
- List third-party hosted systems under out of scope until their provider's permission is confirmed.
- Mark each item I did not supply as "to be confirmed" and do not invent addresses, names or legal terms.
- Add one line that the firm and our legal advisor should review the document before it is signed.
Result:
An outline of at most 350 words with the headings above, each holding two to four bullet points.