The whole category in one page.
AUTHORISATION IN WRITING COMES BEFORE EVERYTHING, FROM SOMEONE WITH ACTUAL AUTHORITY OVER THE SYSTEMS
Testing without it is a criminal matter regardless of intent. Systems you use but do not own — hosting, cloud, software as a service — require that provider's permission too.
FIX THE OBVIOUS THINGS BEFORE COMMISSIONING A TEST, OR YOU WILL PAY FOR A REPORT OF WHAT YOU ALREADY KNEW
Patch, remove default credentials, restrict access. Most compromises exploit configuration and known unpatched issues rather than novel vulnerabilities.
RAW SCANNER OUTPUT PRESENTED AS PENETRATION TESTING IS THE CLEAREST SIGN OF A POOR PROVIDER
Ask what proportion is manual, who will actually perform it, and request a redacted sample report.
PROVIDE MULTIPLE USER ROLES FOR APPLICATION TESTING, BECAUSE ACCESS CONTROL FAILURES BETWEEN USERS ARE COMMON AND SCANNERS CANNOT FIND THEM
AGREE THAT CRITICAL FINDINGS ARE REPORTED IMMEDIATELY RATHER THAN HELD UNTIL THE REPORT
A PENETRATION TEST REPORT IS A DETAILED DESCRIPTION OF HOW TO COMPROMISE YOU — CONTROL HOW IT IS DELIVERED, STORED AND SHARED
ASK OF EVERY FINDING WHERE ELSE THAT SAME CAUSE APPLIES, SINCE TESTERS EXAMINE A SAMPLE AND THE MISTAKE IS USUALLY REPEATED
IN SOCIAL ENGINEERING ASSESSMENT, NEVER NAME OR DISCIPLINE INDIVIDUALS — FEAR PRODUCES CONCEALMENT OF REAL INCIDENTS, AND REPORTING RATE MATTERS MORE THAN FAILURE RATE
PUBLISH A ROUTE FOR REPORTING VULNERABILITIES AND STATE THAT GOOD-FAITH REPORTING WILL NOT BE PURSUED, BECAUSE THREATENING A REPORTER BECOMES PUBLIC AND ENDS ALL FUTURE REPORTS
AND NEVER SCOPE A TEST NARROWLY TO PRODUCE A CLEAN REPORT, BECAUSE IT SATISFIES THE REQUIREMENT AND LEAVES YOU EXACTLY AS EXPOSED AS THE REQUIREMENT EXISTED TO PREVENT
