Schellman Penetration Testing Scoping Questionnaire

Penetration Testing Scoping Questionnaire

Thank you for choosing Schellman to help secure your organization. Whether this is for a compliance initiative or a general security assessment, answering these questions below will help us determine the overall time of the engagement.
Choose by compliance requirement:

PCI-DSSSOC 2FedRAMPHIPAAISO 27001ISO 27701
Note: This compliance framework does not explicitly require a penetration test.
Select all services you are interested in:*

Web Application Penetration TestingExternal Network Penetration TestingInternal Network Penetration TestingMobile App (iOS / Android) Penetration TestingSocial Enginering (Phishing / Vishing)Active Directory Password Strength AuditVulnerability ScanningAI / Large Language Model (LLM) TestingPhysical Penetration TestingRed Team Assessment (Advanced Threat Simulation)Cloud Configuration Security ReviewCI/CD Pipeline Penetration TestingNetwork Segmentation TestingOther
Unsure which to choose? Read about our suite of Penetration Testing services.

Physical Penetration Testing
Physical Penetration Testing
How many buildings would you like tested?
We will go over locations and other details during our scoping call.

Web Application Penetration Testing
Web Application Penetration Testing
Take a moment to review how Schellman approaches a web application pen test and what common questions are associated - https://schellman.com/pentest/webapp
What domains/applications are in scope for testing? *
Which of the above require authentication?*
These domains support logging in with a username and password.
List the different user roles are available:*
Examples would include: read only user, administrator, etc.
Please provide links to a demo video or documentation for the application(s):*
If none are publicly available, it typically is helpful to schedule a quick demo before providing a proposal
Is there an API in scope?*

YesNo
Please provide links to documentation:*
Having a Postman Collection or Swagger UI (OpenAPI) specification can help expedite testing

Social Engineering
Social Engineering
Take a moment to review how Schellman approaches phishing assessment and what common questions are assoicated - https://schellman.com/pentest/phishing
Please choose your service:

Yes, e-mail based phishingYes, voice based vishing
Estimation of how many employees would be in scope:*
If more than 200, we'll plan multiple campaigns
Frequency of the campaign: *
Many organizations choose quarterly vs. annually to keep employees more engaged

Penetration Testing Scoping Questionnaire