Questions to Ask the Client

[Resheph]

Prior to executing a penetration test, seek your client's guidance and agree on the following questions along with any others that you might think are relative.

Questions to Ask the Client

• Why did the client request a penetration test?
• What is the function or mission of the organization to be tested?
• What will be the constraints or rules of engagement for the test?
• What data and services will be included as part of the test?
• Who is the data owner?
• What results are expected at the conclusion of the test?
• What will be done with the results when presented?
• What is the budget?
• What are the expected costs?
• What resources will be made available?
• What actions will be allowed as part of the test?
• When will the tests be performed?
• Will insiders be notified?
• Will the test be performed as black or white box?
• What conditions will determine the success of the test?
• Who will be the emergency contacts?