Who does the work.
WHAT TO ASSESS
Competence Relevant experience Certification, where it indicates something Methodology Reporting quality Insurance
WHY REPORTING QUALITY MATTERS AS MUCH AS TESTING
A report you cannot act on wastes the whole exercise.
WHAT TO REQUEST
A sample report, redacted.
WHAT TO LOOK FOR IN IT
Clear description of each finding Evidence Assessment of actual risk in context Specific remediation guidance Distinction between serious and minor issues
WHAT INDICATES POOR QUALITY
Raw scanner output presented as testing Findings without context or verification Every issue rated as critical Generic remediation advice
WHY RAW SCANNER OUTPUT
Anyone can run a scanner, and unverified output contains many findings that do not apply.
WHAT TO ASK
How findings are verified What proportion of the work is manual Who will actually perform it, and their experience
WHY WHO ACTUALLY PERFORMS IT
Senior people sell and junior people test.
WHAT TO ESTABLISH ABOUT THE INDIVIDUALS
Their background and whether they have tested comparable systems.
WHAT TO VERIFY
References from clients with similar requirements.
WHAT TO ESTABLISH ABOUT CONDUCT
Whether they hold relevant certification and are bound by a professional standard.
WHAT TO AGREE
Confidentiality, strictly.
WHY
Testers see your weaknesses in detail.
WHAT TO ESTABLISH
How findings are transmitted and stored How long they retain data What is destroyed afterwards
WHAT TO AVOID
Selecting on price alone.
WHY
Cheap testing is usually scanning presented as testing.
