Preparing a penetration test: the checklist

To decide

• The goal: customer requirement, insurance, product launch, recent incident
• Scope: addresses, domains, applications, sites, Wi-Fi networks
• Exclusions: fragile systems, unauthorized third parties
• Time windows and a reachable contact
• Is the IT team told?

To gather

• IP address and domain list
• Test accounts for each application role
• API documentation (Swagger/OpenAPI) if available
• Authorizations from hosts or cloud providers
• Recent backups, as a precaution

After the test

Plan time to fix, then a retest. The report then serves as evidence for customers, insurers or your board.