Penetration Test Readiness Checklist

Scope and goals

• Write down the one question the test must answer (for example: can an outside attacker reach customer data?).
• List every in-scope asset: domains, IP ranges, applications, APIs, cloud accounts.
• List what is explicitly out of scope, including third-party services you do not own.
• Confirm you have authority to test every asset, including hosting and SaaS providers whose terms require notice.
• Name the framework the report must satisfy, if any (PCI DSS 11.4, SOC 2, HIPAA, ISO 27001).

Access and accounts

• Create test accounts for every role in scope, two per role for authorization testing.
• Provide API documentation or an OpenAPI/Postman collection for any API in scope.
• Decide black-box or source-assisted testing, and share repository access if source-assisted.
• Set up VPN or jump-host access for internal testing, and test it before day one.
• Seed test data that looks like production so business logic can be exercised.

Environment and safety

• Choose staging or production. If production, agree testing windows and any fragile systems to avoid.
• Allowlist the testers' source IPs in the WAF if you want depth, or leave it on if you want to test the WAF.
• Take fresh backups of any system that will be tested with write access.
• Confirm rate limits and account lockout settings so testers don't lock out real users.

People and communication

• Name a technical point of contact who can answer questions within a business day.
• Name an emergency contact for critical findings, reachable outside business hours.
• Tell your SOC or MSSP that a test is running, or decide deliberately not to (to test detection).
• Agree how findings are shared securely: encrypted report, portal, never plain email attachments.

After the test

• Book the readout meeting with both engineering and leadership before testing starts.
• Assign an owner for each finding within a week of the report.
• Schedule the retest once fixes are in, inside the retest window.

Print or save as PDF