What determines the cost
See how scope, complexity, access, constraints, reporting, and retesting change the amount of work.
Read nextScoping guide
What should a penetration-test scope include?
The scope should state why the test is happening, which systems and environments are included, what access the tester will have, what is excluded or restricted, how the parties will communicate and stop testing if needed, and what report and retest will be delivered.
It should be specific enough that the client, tester, and report reader understand what is and is not being assessed. The detailed checklist below covers the individual items.
Primary references: NIST SP 800-115
Published by Trespass Security
Requirement versus scope
Requirement and scope
The requirement explains why testing is needed. The scope lists the systems, access, methods, restrictions, and deliverables that are approved.
Example: “Our customer needs current application testing” explains the reason. The application, environment, user roles, APIs, permitted techniques, exclusions, dates, and report belong in the scope.
Scoping checklist
What to include in the scope
Systems and environments
- Applications, modules, domains, APIs, endpoints, networks, hosts, locations, or wireless components
- Production, staging, test, or other environments
- Connected systems and integrations
- Explicit exclusions and non-target assets
Identity and access
- User roles, privilege levels, administrative paths, and tenant models
- Authentication, federation, recovery, and session paths
- Test accounts, credentials delivery, VPN, allowlisting, and other access
- Unavailable roles or paths that may limit coverage
Safety and authorization
- System ownership and third-party permission
- Permitted and excluded techniques
- Production constraints, sensitive workflows, and data-handling restrictions
- Test window, primary contacts, escalation path, and stop conditions
Report and retest
- Intended report audience and evidence expectation
- Deliverable contents and known confidentiality restrictions
- Communication of material findings during testing
- Remediation review and consolidated retest terms
Details that matter
Details that affect coverage
A scope is more than a list of URLs. It states what testing is allowed and gives the report its boundaries.
- Third-party systems
Connected providers, platforms, hosting services, and integrations require clear ownership and permission.
- Production restrictions
List rate limits, fragile workflows, customer data, maintenance windows, monitoring, backups, and prohibited actions.
- Report requirements
Confirm whether the recipient expects a full report, summary, scope statement, completion evidence, or retest status.
- Limitations
Unavailable accounts, inaccessible systems, time limits, environment differences, and excluded techniques affect what the report can conclude.
Example
A specific scope example
Scroll horizontally to read all columns →
| Element | Example entry | Question to answer |
|---|---|---|
| Reason | Respond to a customer request for current web application testing. | What will the customer review? |
| Systems | Named production application and documented API endpoints. | Are administrative and support interfaces included? |
| Roles | Standard user, organization administrator, and read-only support role. | Are multiple tenant organizations required? |
| Restrictions | No denial of service; stop on material instability; named escalation contact. | Are any data-changing workflows prohibited? |
| Deliverables | Written report, live review, and consolidated retest. | Will an executive summary be shared separately? |
Authorization
Authorization before testing
Before testing, the parties must complete the applicable agreements, written authorization, and Rules of Engagement.
Those documents should name who has authority, who is responsible, how the parties will communicate, when testing must stop, and which activities are permitted. This guide is not a legal authorization form.
Next step
Send the original requirement before the scope is finished.
Tell us who asked, what they said, which systems may be involved, and the deadline. We will identify the remaining scoping questions.