Scope template for a security test
To be filled in with the client before starting. It is a ready-made template: adapt it to each job. Tick what you need and write the details on the line.
1. Who
Client: company name, VAT number, who signs and in what role
Assigned professional: name, certifications
Emergency contact reachable for the whole window: name and phone
2. What is tested
Domains and subdomains
IP addresses or networks
Applications: address and environment (test or production)
Test accounts provided by the client
3. What stays out
Excluded systems
Third-party services (payments, mail, hosting, management software), unless their provider gives written permission
People: no social engineering unless written here
4. When
Start and end dates
Time window, 24-hour format with time zone
Forbidden windows: closures, sales peaks, maintenance
5. How
Remote or on site
Type of test: vulnerability assessment, penetration test
What is forbidden beyond the rules of engagement
6. Permissions
Statement by the owner of the systems
Permission from the third-party provider, if the systems are hosted there
7. Delivery
Report format
Who receives it
By when
8. Signatures
Client: name, role, date, signature
Professional: name, date, signature
The template is provided as is: filling it in correctly and adapting it to each job is the sole responsibility of the member and the client.