Pre-VAPT Readiness / Scoping Checklist — ask these before you request a test.

Test procedureCross-check the submitted asset list against your actual DNS records, cloud inventory and API gateway config for anything left off.

Practical example / evidenceSigned-off asset/scope list with owner confirmation.

Test procedureConfirm the scoping document has an explicit exclusions section, not just a list of what's included.

Practical example / evidenceScoping document's exclusions/out-of-scope section.

Test procedureVerify the agreed environment is reachable and representative, or that the production test window is confirmed with the hosting/ops team.

Practical example / evidenceEnvironment access confirmation or signed production test-window agreement.

Test procedureCheck the rules of engagement names the test type and that it matches the stated objective (e.g. simulate external attacker vs. insider).

Practical example / evidenceRules of engagement document naming the test type and rationale.

Test procedureConfirm the network diagram marks which segments are in scope and whether testing originates internally or externally.

Practical example / evidenceNetwork scope diagram or statement.

Test procedureCheck the statement of work line-items against the asset list to ensure every claimed layer actually has corresponding assets.

Practical example / evidenceStatement of work with layer-by-layer scope breakdown.

Test procedureLog in with each prepared test account before the engagement starts to confirm it works at the intended privilege level.

Practical example / evidenceCredential handover sheet (shared securely) listing accounts and privilege levels.

Test procedureCheck the notification email or ticket went to ops/security/on-call with the exact test window and source IPs.

Practical example / evidenceSent notification (email/ticket) with timestamp and recipient list.

Test procedureConfirm the SOC/monitoring team acknowledged the briefing and tagged the tester's source IPs as expected traffic.

Practical example / evidenceSOC acknowledgment or allow-list entry for tester IPs.

Test procedureConfirm the authorization letter is signed by someone with the authority to approve testing, dated before the test start date.

Practical example / evidenceSigned authorization letter / rules of engagement document.

Test procedureCheck the rules of engagement specify how discovered sensitive data (PII, credentials) will be handled, stored and disclosed.

Practical example / evidenceData-handling clause in the rules of engagement.

Test procedureConfirm there's a named contact and channel the tester can reach within minutes if something breaks.

Practical example / evidenceEscalation contact sheet shared with the testing team.

Test procedureCheck the kickoff notes name a specific person (not a team alias) responsible for triage.

Practical example / evidenceKickoff meeting notes or RACI naming the remediation owner.

Test procedureConfirm the contract or SOW includes a scheduled retest window, not an open-ended 'we'll get to it'.

Practical example / evidenceSOW clause or calendar booking for the retest window.