Plain English
The penetration test approval process, inside your own organization
The penetration test approval process is the internal side of authorization. Before testing, the right people must agree in writing. So this guide explains who signs, in what order, and what they need to see.
- Authorisation before any test
- Plain-English guidance
- Written scope on every engagement
Why the penetration test approval process matters
Authorization is the legal basis for testing. However, it is only valid if the person signing actually controls the system. A manager who approves a test of a system they do not own creates a real problem.
Therefore the approval process is about matching each system to its true owner. Then each owner signs for their part.
Who signs in the penetration test approval process
Start with an executive sponsor who approves the project and budget. Then each system owner signs for the systems they control. Finally, operations confirms the testing window.
Also involve legal early. Because they review the contract anyway, they can check the authorization wording at the same time.
| Signer | What they approve |
|---|---|
| Executive sponsor | The project, budget and reason |
| System owners | Testing of their systems |
| Operations | The dates and change freeze |
| Legal | Contract and authorization wording |
| Third parties | Testing on systems they host |
Penetration test approval process checklist
Tick each approval you already hold.
Your result appears here as you tick, so you can see what is still open.
Third parties in the penetration test approval process
Some systems sit with hosting or cloud providers. Many of them publish their own testing rules, and some require notice in advance. So check each provider before the window is fixed.
Similarly, a system run by a supplier may need that supplier's written consent. Without it, your own approval does not cover their part.
Order and timing
Approvals work best in a fixed order: sponsor, then owners, then operations. Because each step depends on the last, starting the owners first can mean repeating work.
Allow time for absences. A single owner on leave can delay the start date by a week.
Recording the penetration test approval process
Keep every signature with the scope it covers. If the scope changes, the affected owners sign again. As a result, the record always matches what was tested.
Then file the approvals with the report. Auditors often ask for both together.
How we handle it
We prepare the written scope and authorization wording, and we confirm third-party approvals before day one. Nothing is tested until the owner signs.
Full engagements run from $35,000 to $120,000, while the floor is $25,000. Also, the bounded External Attack Surface Review starts at $4,500. Moreover, its fee is credited in full against a full engagement commissioned within ninety days. Every fee is agreed in writing before anyone starts. The method follows the Penetration Testing Execution Standard.
Penetration test approval process questions
Who must sign in the penetration test approval process?
The owner of each system, plus a sponsor for the project.
Do cloud providers take part in the penetration test approval process?
Some do. Check each provider's published rules first.
What if the scope changes?
The owners of the affected systems sign again.
How long does the penetration test approval process take?
Often one to three weeks, depending on how many owners are involved.
Related guides
Prepare the penetration test approval process with us
Send a list of systems and owners. We reply with a written scope, authorization wording and a fixed fee.
Ask about authorised testing