Scope
Only what you name in writing.
The signed scope is the list of systems under test. If an asset is not on that list, it is not assessed.
Assessed when named
- Public-facing websites
- Applications reachable over the internet
- APIs
- Internet-facing infrastructure
Each target is identified in the signed scope. Hostnames, URL prefixes, and API surfaces are listed before work starts.
Default exclusions
- Anything not named in the signed scope
- Destructive testing
- Techniques the signed rules prohibit
- Denial-of-service or availability attacks
- Systems you do not authorise, including third-party platforms you do not control
An exclusion can be lifted only by naming it in a new or amended signed scope.
Authorisation is the start line
Scope, rules, and a maximum invoice are signed first. The assessment does not expand mid-engagement because a related host was noticed. Related hosts can be added. They are not tested until they are signed in.