Penetration Testing Scope Template: Assets, Access, Evidence, and Stop Conditions
========================================================================

Source: https://getceron.com/blog/penetration-testing-scope-template
Published: 2026-10-31T11:37:48-07:00
Updated: 2026-11-05T12:56:59-07:00

Original worksheet and cases: Ceron, 2026. Licensed under CC BY 4.0.
https://creativecommons.org/licenses/by/4.0/
Attribute Ceron, link to the resource, and identify changes. Third-party standards
and Ceron branding are excluded. Illustrative cases; no customer findings.
Run only within your written authorization and agreed scope.

PLANNING WORKSHEET
This worksheet does not grant testing permission or replace an engagement agreement.
Engagement / version / date:
Business owner:
Technical owner:
Assessor:

1. OBJECTIVE AND ACCEPTANCE
Record: Business question; intended decisions; evidence required; what the assessment does not establish.
Agreed details:
Owner / unresolved item:

2. AUTHORIZED ASSET INVENTORY
Record: Exact hostnames, API base URLs, applications, environments, cloud account IDs, and an accountable owner for each.
Agreed details:
Owner / unresolved item:

3. OWNERSHIP AND THIRD PARTIES
Record: Who controls each asset; provider restrictions; evidence of any required permission; excluded shared services.
Agreed details:
Owner / unresolved item:

4. TEST IDENTITIES AND ROLES
Record: Synthetic tenants and records; approved roles; provisioning and revocation owners; secret exchange channel.
Agreed details:
Owner / unresolved item:

5. ALLOWED METHODS
Record: External checks, authenticated business-logic tests, configuration review, source review, and individually approved deeper techniques.
Agreed details:
Owner / unresolved item:

6. EXCLUSIONS
Record: Unlisted systems; denial of service; destructive writes; phishing; physical access; persistence; production customer-data extraction unless separately authorized.
Agreed details:
Owner / unresolved item:

7. SCHEDULE AND TRAFFIC
Record: Start and end with time zone; production windows; source IPs; concurrency and request limits; monitoring contacts.
Agreed details:
Owner / unresolved item:

8. STOP AND RESTART
Record: Observable stop conditions; immediate notification path; named restart authority; time and method of restart approval.
Agreed details:
Owner / unresolved item:

9. EVIDENCE HANDLING
Record: Permitted data; minimal proof; redaction; secure storage; recipients; retention and deletion dates.
Agreed details:
Owner / unresolved item:

10. AI AND SUBCONTRACTORS
Record: Approved providers and tools; data each may receive; human review; agreed handling and retention.
Agreed details:
Owner / unresolved item:

11. FINDING VERIFICATION
Record: Reproduction conditions; evidence standard; severity method; business context; false-positive handling.
Agreed details:
Owner / unresolved item:

12. DELIVERABLES AND COVERAGE
Record: Executive summary; technical findings; tested and untested assets; blocked cases; limitations and handover format.
Agreed details:
Owner / unresolved item:

13. RETEST AND CLOSURE
Record: Included fixes and paths; time window; configuration/build to retest; result definitions; who accepts residual risk.
Agreed details:
Owner / unresolved item:

14. FEE AND SCOPE CHANGES
Record: Fixed fee or agreed model; qualifying finding definition if applicable; approval before adding assets or methods.
Agreed details:
Owner / unresolved item:

ASSET REGISTER (repeat per asset)
Stable asset ID:
Exact hostname / URL / cloud account / resource identifier:
Environment:
Accountable owner:
Authorization / provider permission reference:
Test roles / synthetic data:
Permitted methods and request limits:
Excluded methods and dependencies:
Window and timezone:

KICKOFF READINESS
[ ] Written authorization completed by the appropriate parties
[ ] Assets, environments, ownership, and third-party boundaries confirmed
[ ] Test identities and synthetic records work
[ ] Methods, exclusions, request limits, and window agreed
[ ] Monitoring contacts and stop / restart procedure confirmed
[ ] Evidence handling and AI / subcontractor data access agreed
[ ] Deliverables, fee, scope changes, and retest terms agreed
Missing prerequisites / owner / resolution:

Do not begin an unresolved activity. Narrow its scope or complete its prerequisite.