Plain English
A penetration testing checklist for the buyer's side
This penetration testing checklist covers your side of the work, not the testing itself. So every item is a decision, a document or a person. Work through it in order, and the engagement runs on time.
- Authorisation before any test
- Plain-English guidance
- Written scope on every engagement
How to use this penetration testing checklist
Each stage has a short list. Tick an item only when it exists in writing. Because a verbal agreement is easy to forget, written items are the only ones that count.
Also share the checklist with the firm. Then both sides see the same open items.
Before the test
Most of the work happens here. The reason, scope, owners and authorization all come before any testing starts.
In addition, confirm any third-party approvals. Hosting providers and suppliers may need notice.
| Item | Done when |
|---|---|
| Reason for testing | Written in one sentence |
| Scope | Signed list of in and out |
| Authorization | Signed by each system owner |
| Rules of engagement | Hours, contacts and limits agreed |
| Contract and NDA | Signed by both sides |
| Third-party approvals | Received in writing |
Penetration testing checklist summary
Tick the items that already exist in writing.
Your result appears here as you tick, so you can see what is still open.
The penetration testing checklist during the window
Keep it short. The operations contact is reachable, the security lead knows how to receive urgent reports, and any pause rule is understood.
Then leave the testers to work. Because changes during the window can confuse results, hold back major releases if you can.
The penetration testing checklist after the report
Read the summary first, then share findings with the owners who will fix them. Give each finding an owner and a date. Then book the retest.
Finally, file the report, the retest result and the signed scope together. As a result, the evidence is ready for auditors and customers.
Items buyers often miss
A backup for each contact is the most common gap. Another is a named list of report readers. A third is a date for the retest.
So check those three items twice. They are small, but each one can delay the engagement.
Our part of the list
We draft the scope and rules, name the senior practitioner, and confirm third-party approvals before day one. The owner signs authorization before any testing.
Full engagements run from $35,000 to $120,000, while the floor is $25,000. Also, the bounded External Attack Surface Review starts at $4,500. Moreover, its fee is credited in full against a full engagement commissioned within ninety days. Every fee is agreed in writing before anyone starts. The method follows the Penetration Testing Execution Standard.
Penetration testing checklist questions
What belongs on a penetration testing checklist?
Decisions, documents and people on your side, from scope to retest.
Who keeps the penetration testing checklist?
Usually the security lead who owns the project.
Is the checklist the same every year?
Mostly. Update the scope and contacts each time.
Does the firm see our penetration testing checklist?
It helps to share it, so both sides track the same items.
Related guides
Work through the penetration testing checklist with us
Send a short brief. We reply with a written scope, rules of engagement and a fixed fee.
Ask about authorised testing