Penetration Test Scoping Document
Prepare a clear scope for hiring testers.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Help me prepare a clear scope for hiring penetration testers. Interview me one question at a time and wait: (1) what the system is and why we want a test (compliance, customer request, release, general assurance), (2) the assets in scope (domains, apps, APIs, networks, cloud accounts), (3) what is out of scope and why, (4) the data involved and any production risks, (5) testing approach (black box, gray box, with credentials), (6) timing, blackout periods, and contact people, (7) rules of engagement (social engineering, denial of service, data access limits), (8) reporting needs and retest expectations, and (9) budget. Starting notes: [SYSTEM_NOTES]. After the interview, write the scoping document with: objectives; scope table (asset, environment, owner, notes); exclusions; test types; rules of engagement; legal authorization statement and approvals from system owners and any hosting provider whose policy requires notice [VERIFY]; data handling and confidentiality; testing windows; communication and emergency stop procedure; deliverables (executive summary, technical findings with reproduction steps, severity ratings, remediation advice, retest); qualifications to request from vendors; and evaluation questions. Add a vendor comparison table. Have a lawyer review the authorization and contract before testing starts. No testing should happen without written permission.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.