Penetration Test Scoping Questionnaire

About This Resource

Under-scoping is the single biggest cause of day-rate surprises once penetration testing starts. This questionnaire captures why you are testing, what needs testing, whether you need CREST or CHECK accreditation, your constraints, and who the final report is for — so every provider you approach quotes against the same brief. Complete it once and attach it to every RFQ you send.

What's Included

• Business context and testing-driver capture (client, insurer, compliance, peace of mind)
• Full asset inventory fields — external IPs, web apps, APIs, cloud tenants, internal hosts
• CREST vs standard accreditation decision aid with clear guidance on which to choose
• Constraints capture — test windows, exclusions, DoS and social engineering scoping
• Report audience selector so the deliverable matches technical, executive or insurer needs

Related Resources