# Pentest scope and rules of engagement

Template from https://hackergpt.org/blog/pentest-scope-template/
Fill every field. A field you leave empty is a question you have not asked yet.
Anything not listed under "In scope" is out of scope. This is not legal advice.

Version: 1        Date:

## 1. Parties and authority

- Owner of the target (organisation):
- Person granting permission (name, role):
- Why they can grant it (owns the system / is authorised by the owner):
- Tester(s) (name, contact):

## 2. In scope

| Target (exact host, URL, IP or app) | Environment | Notes |
|---|---|---|
|  |  |  |

- Test accounts provided (username, role):

## 3. Out of scope

- Third-party services the site loads or links to (payment, login provider, CDN, analytics, chat):
- Other hosts, subdomains and environments:
- Other:

## 4. Techniques

- Allowed:
- Not allowed: denial of service and load testing; social engineering; physical access;
  deleting or changing other users' data; sending email or messages to real users.
- Automated scanning and agents allowed? Maximum request rate:
- Stop at proof: show that a finding exists, do not use it to go further.

## 5. Time window

- Start (date, time, time zone):
- End (date, time, time zone):
- Times to avoid (releases, peak hours):

## 6. How the testing traffic can be recognised

- Source IP addresses:
- User-Agent or header added to requests:

## 7. Data

- Data the tester may view:
- Data the tester must not copy or keep:
- If personal data, credentials or secrets are reached: stop, record what was seen,
  tell the contact below, delete any copy.

## 8. Contacts and stop conditions

- Technical contact (name, phone, hours):
- Emergency contact if the site goes down:
- Stop testing and call when: the site degrades; real users' data is reached;
  something outside scope is reached; anything unexpected.

## 9. Rules on top

- Hosting provider and its testing policy (link):
- Other vendor policies that apply:

## 10. Reporting

- Report format and delivery (encrypted? to whom?):
- Deadline:
- Retest after fixes? (yes/no, when):
- Who may publish or share findings, and when:

## 11. Changes and sign-off

Any change to this scope is agreed in writing before it is tested.

- Permission granted by (name, role, signature, date):
- Tester (name, signature, date):