Practitioner resource
Checklist for Preparing for a Penetration Test Scoping Call
November 1, 2026
(212) 561-586024/7: (800) 868-8189
The first scoping call should establish what the business needs to learn and the boundaries within which testing can safely occur. A count of IP addresses or a list of domain names is only the beginning. The team also needs authority, operating constraints, third party permissions, relevant identities and a clear description of the result the organization expects to use. NIST's testing guidance treats planning and analysis as part of the assessment process, not as paperwork added after testing. [TEST]
State the business objective and the intended audience
Explain whether the work supports a customer requirement, a regulatory obligation, a transaction, a new release, remediation verification or another decision. Identify who will use the result and what evidence they need. A vulnerability scan, a penetration test, an application review and an OT assessment answer different questions. Do not assume that a report with the right title will satisfy a specific contractual or regulatory request.
Bring the requirement or request that prompted the work, together with the intended completion date and any review meeting. Ask which deliverables are needed: executive findings, technical reproduction detail, remediation guidance, a retest account or a scoped attestation. Keep proposed assurance wording subject to the actual work and its limitations.
Inventory the targets and the owners who can authorize them
List the network ranges, domains, applications, APIs, cloud environments and other proposed targets. Identify their business and technical owners and distinguish production from development or test. Include externally hosted and third party systems, even when your organization uses them daily. Confirm what the owner and provider permit before treating a target as authorized.
For applications, describe the main functions, account roles, authentication process, sensitive workflows and important integrations. State whether source code, documentation or test accounts can be provided through a secure arrangement. Record significant exclusions and why they matter. A small target list may still contain a complex authorization model or a high-consequence business function.
Describe operating and safety constraints
Identify services that cannot be interrupted, testing windows, change freezes, monitoring arrangements and systems that require a different method. Call out OT, industrial control, medical, safety or physical-process dependencies. Do not include those systems in a routine enterprise test by implication. Their owners need a separately approved assessment approach and operational stop conditions. [OT]
Define who can stop the test, how that person will be reached and who can authorize resumption. Agree on the handling of an unexpected outage or a suspected active compromise discovered during testing. Identify backups and recovery arrangements relevant to the proposed work. A permitted time window does not itself authorize every technique within that window.
Prepare identities, access and rules of engagement
Identify the account roles that may be needed, their approval owner and the supported way to deliver credentials. State whether MFA, conditional access, federated identity or device restrictions affect test access. Do not paste passwords, tokens, keys or privileged connection information into a public request form or ordinary scoping worksheet.
Discuss permitted techniques and prohibited actions explicitly. The rules of engagement should address the target boundary, test sources, timing, escalation, data handling and evidence needed to demonstrate a finding. Clarify whether exploitation, privilege escalation, social engineering, data access or source code review is included. Those activities should not be inferred from a broad request to test security. [ROE]
Explain prior findings and relevant changes
Identify earlier reports, known unresolved weaknesses, recent incidents and material changes to the environment. Record the dates and scope of prior work so the assessor can distinguish a retest from a new assessment. A previous report can help focus a conversation without becoming proof of the current state.
Describe planned releases, migrations or significant provider changes that could invalidate a test's assumptions. Ask whether testing should occur before or after the change and whether follow-up work will be needed. If the team wants a comparison over time, agree on what can be compared and what differences in scope or access must be explained.
Agree on evidence, reporting and secure communication
Identify the people authorized to receive findings and the severity of issues that require immediate notice. Discuss how sensitive evidence will be minimized and shared. A finding should demonstrate the relevant consequence within the approved scope; the test is not permission to copy unnecessary client or employee information.
Before the call ends, confirm the remaining inputs needed for a written scope, the owner of each input and the decision date. Ask how the report will distinguish validated findings, unconfirmed observations and untested areas. Record the arrangements for remediation discussion and any retest. A successful engagement gives the business a supported account of the tested conditions and practical next steps, not a guarantee that no other weakness exists.
Information Gathering Q&A Checklist
Use this Q&A with the people who own the systems and the relevant legal or business decisions. Mark unknown or not applicable answers explicitly. Record an owner, a confirming source and the date. The public guide-request form asks for your email, not the answers below.
Do not write passwords, recovery keys, unlock codes or authentication secrets here. Record whether authorized access is available, who controls it and how a secure handoff can be arranged. Keep completed copies in the location counsel or the company approves. Do not send a completed record containing sensitive account or employee details through a public contact form.
- Who is directing the matter and who can authorize technical access?
Identify directing counsel, the business decision maker, the IT security owner and any outside administrator. Record the immediate deadline, relevant period and known preservation risk. An employee's possession of a device or an administrator's ability to access an account does not by itself settle the authorized examination scope.
Answer:
Owner, source, date and unresolved questions:
- Who provides the email service and who administers it?
Identify Microsoft 365, Google Workspace, an internal Exchange environment, a hosted service or a combination. Record the tenant or organization reference, relevant domains, mailbox owners, aliases, shared mailboxes and the MSP or administrator responsible. Identify available preservation and export permissions and any licensing question that needs confirmation.
Answer:
Owner, source, date and unresolved questions:
- Does the company have archiving, backups or preservation holds in place?
Name each service and distinguish an archive or journal from a backup, a retention policy and a matter specific hold. Identify what each covers, the available dates, deletion or rotation rules and who can export or restore records. Record whether preservation has actually been verified, rather than treating the existence of a subscription as proof of coverage.
Answer:
Owner, source, date and unresolved questions:
- Does the company supply the computers or do employees use their own?
Record company owned, personally owned, leased and shared equipment separately. Identify the assigned user, operating system, asset or serial reference and present location. Note any employee owned computer used for business and the applicable access agreement. Company ownership and permission to examine particular personal material should not be assumed to be the same.
Answer:
Owner, source, date and unresolved questions:
- Are mobile devices company owned, employee owned or a mixed arrangement?
Identify the phone or tablet, assigned user, model and operating system where known, and who currently holds it. Distinguish the owner of the handset from the owner of the cellular service account. Record whether work data is separated into a managed profile and whether a replacement, return or wipe is already scheduled.
Answer:
Owner, source, date and unresolved questions:
- Whose Apple, Google or Samsung account is registered or signed in on each phone?
Record each relevant account as personal, company controlled or unknown, and identify who can lawfully arrange access. For Apple devices, note any organization enrollment and known Activation Lock status separately from the signed in Apple Account. For Android devices, distinguish personal and work profiles and note relevant Google and Samsung accounts separately. Do not sign out or reset an account to answer this question. [S14] [S15]
Answer:
Owner, source, date and unresolved questions:
- Does the company use MDM and what does it actually manage on these devices?
Name the management service, administrator and enrollment mode, including supervision or work profile details where applicable. Record the last known device contact and any pending retire, lock or wipe command. A device appearing in a management console does not establish access to every personal application, message or backup. Preserve the management record without issuing a command merely to test capability.
Answer:
Owner, source, date and unresolved questions:
- Can the company recover the BitLocker or other encryption keys for each relevant computer?
Ask whether recovery material is actually available for the identified device and drive, where it is escrowed and who has authorized retrieval permission. Possible locations include Microsoft Entra ID, Active Directory or another approved store. Note FileVault or other encryption separately. Do not assume that MDM enrollment guarantees key availability, and do not place the key itself on this record. [S13]
Answer:
Owner, source, date and unresolved questions:
- Who controls identity, administrator access and multifactor authentication?
Identify the identity provider, relevant privileged accounts, outside administrator and person who can approve an export or collection. Note access dependencies such as an unavailable administrator or authentication device without recording secrets. Shared or delegated access should be identified because account activity may require additional evidence before it can be attributed to an individual.
Answer:
Owner, source, date and unresolved questions:
- Which cloud storage, collaboration and messaging services contain relevant work?
Identify shared drives, Teams, SharePoint, OneDrive, Slack, Google Chat and other platforms actually used for the relevant work. Note external ownership, linked documents, personal accounts used for business and any unsupported or unavailable source. A mailbox export should not be assumed to include the contents of every linked file or separate conversation.
Answer:
Owner, source, date and unresolved questions:
- What activity logs and endpoint records are available now?
Ask the responsible administrator which email, identity, endpoint, cloud sharing, USB, security and data protection records exist for the relevant period. Record actual date coverage, export permissions, known gaps and the next expiration or rotation point. Enabling a logging feature today should not be described as recovering activity that was never recorded.
Answer:
Owner, source, date and unresolved questions:
- What has already changed on the devices or accounts?
Record password resets, access restrictions, account deletions, mailbox conversions, software installations, cleanup activity, repairs, cloud sync changes and any device reset or wipe. Identify who acted, when and why. Include informal handling or earlier collections so the examiner can distinguish relevant historical activity from changes made during the response.
Answer:
Owner, source, date and unresolved questions:
- Which networks, applications, APIs and cloud environments can your organization authorize?
Identify third party ownership and permission requirements.
Answer:
Owner, source, date and unresolved questions:
- What are the testing window, stop conditions and escalation contacts?
Identify any OT, safety or production dependency requiring a separate approach.
Answer:
Owner, source, date and unresolved questions:
Primary sources and further reading
Prepared November 1, 2026. Sources explain the general framework; applicability, licenses, available records and legal requirements vary. This guide is technical preparation, not legal advice or an assurance of compliance or admissibility.
- TEST: NIST SP 800-115, Technical Guide to Information Security Testing and Assessment
- OT: NIST SP 800-82 Revision 3, Guide to OT Security
- ROE: NIST rules-of-engagement glossary
- S13: Microsoft BitLocker recovery overview
- S14: Apple guidance on Activation Lock and device management
- S15: Android Enterprise guidance on work profiles