What is the penetration test scoping form template?
A penetration test is only as good as its scope. Test too little and the report misses the system that matters; test the wrong thing and you may knock over a production service or touch a provider you had no permission to test. A written scope, signed by someone with the authority to give it, protects both the client and the testers.
This two-page scoping questionnaire is sent by a security firm or internal red team to the client. Page one asks what the test should tell them, whether there is a specific requirement behind it, and which test types are wanted, from web applications and APIs to internal networks, cloud configuration, wireless and phishing. Choosing Web application asks for the URLs in scope, whether testing is authenticated, which user roles to test and the rough size of the app. Targets, exclusions and third-party hosting come next.
Page two covers dates, testing windows, environment, restrictions such as no denial-of-service, emergency and technical contacts, where to send the report, and a retest. The client confirms they are authorized and signs. The completed scope is filed as a PDF in your FileIt vault, ready to attach to the rules of engagement.
- Best for
- Penetration testing firms, MSSPs and internal security teams
- Filled in by
- The client's security or IT contact
- Time to complete
- About 15 minutes
- Includes
- Eight test types, web app follow-ups, exclusions, third-party hosting check, windows, restrictions, authority and signature
Who uses a penetration test scoping form?
- Scoping an annual external and web application test
- An internal network test before a security certification audit
- A SaaS company scoping an API test a customer asked for
- Planning a phishing simulation alongside a technical test
- Internal security teams agreeing scope with system owners
- Re-scoping a retest after fixes
Questions on this penetration test scoping form
29 questions over 2 pages · includes signature, conditional questions, multiple pages, consent checkbox.
1 Targets & test types
- Organisation*
- Your name*
- Email*
- Phone
- What should the test tell you?*
- Is the test for a specific requirement?
- Test types* Web application · API · External network · Internal network · Mobile app · Cloud configuration · Wireless · Phishing or social engineering
- Application URLs in scope* asked only when it applies
- Authenticated testing?* asked only when it applies Unauthenticated only · With test accounts · Both
- User roles to test asked only when it applies
- Rough size of the app asked only when it applies
- Other targets in scope
- Out of scope and exclusions*
- Are any targets hosted or run by a third party?*
- Which providers, and is permission in place?* asked only when it applies
2 Windows, limits & contacts
- Earliest start*
- Must finish by
- When may testing run?* Business hours · Outside business hours only · Any time · Specific windows
- Windows* asked only when it applies
- Environment* Production · A staging or test copy · Both
- Restrictions No denial-of-service testing · No changing or deleting data · Keep automated scans rate-limited · Tell us before exploiting a critical finding
- Do you need the testers' source IP addresses to allow-list or recognise?
- Emergency contact during testing*
- Emergency phone*
- Technical contact
- Send the report to
- Include a retest after fixes?
- Authority*
- Signature*
The penetration test scoping form, page by page
1 Targets & test types
The client gives their organisation, name, email and phone, then What should the test tell you? and any requirement driving it. Test types offers web application, API, external network, internal network, mobile app, cloud configuration, wireless, and phishing or social engineering. Web application adds Application URLs in scope, Authenticated testing?, user roles and app size, with a reminder that test accounts are shared separately. Other targets in scope, Out of scope and exclusions and the third-party hosting question finish the page; a yes asks which providers and whether permission is in place.
2 Windows, limits & contacts
Earliest start and Must finish by set the dates. When may testing run? offers business hours, out of hours, any time or specific windows. Environment is production, a staging copy or both. Restrictions covers no denial-of-service, no data changes, rate-limited scans and a heads-up before exploiting critical findings. The emergency contact and phone are required, with a technical contact, a report address and whether to include a retest. The authority statement and signature complete the scope.
Make the template yours
- Add your own test types, such as thick client or OT systems
- Ask for asset counts per test type if you price by size
- Put your rules of engagement summary in the cover text
- Send each scope to a vault folder per client
- Add your scoping call booking link to the confirmation message
Tips for a better penetration test scoping form
- Insist on a named emergency contact who will answer during the windows
- Confirm third-party permissions before the start date, not on it
- Keep credentials out of the form and out of email
- Repeat the exclusions back to the client before testing starts
- Agree what happens if a critical issue is found mid-test
Every response becomes a PDF in your vault
The completed scope is filed as a signed PDF in your FileIt vault and you get an email straight away. When the client gives an email, they can be sent a copy for their own records.
Use the Responses table to see which scopes have come in and which test types each client asked for.
- Start from this template. It opens in the FileIt Forms designer — change any question, add pages, set the rules for when questions appear.
- Share it. Turn on a public link, or send it to people by email, each with their own link. They don’t need a FileIt account.
- Get the answers as PDFs. Each response is saved as a PDF in the vault folder you choose, with uploaded files attached — and listed in a Responses table you can export to CSV.
Penetration test scoping form: frequently asked questions
Is this pentest scoping template free?
Yes. It's one of the FileIt Forms starter templates, and every question can be edited.
Does signing this form authorize testing?
The form records who confirmed their authority and what they agreed to. Most firms also use a signed contract or rules of engagement, and the statement says testing waits for one.
Where do test credentials go?
Not in the form. The questionnaire asks which roles to test and reminds clients that accounts are shared through a secure channel.
Why are some questions only shown for web apps?
URLs, authentication, roles and app size only matter for web application testing, so they appear when that test type is ticked.
Can clients fill it in without an account?
Yes. Email them the form or share the link; they don't need to sign up.