Penetration Testing Policy

Company: [Company Name] · Effective Date: [Date]

Purpose

This policy establishes how [Company Name] authorizes and manages penetration testing of its systems to identify security vulnerabilities.

Authorization Required

No penetration testing (internal or by a third party) may be conducted against [Company Name]'s systems without written authorization from [Security Lead/CISO], specifying the exact scope and dates.

Scope Definition

Each authorized test will define: systems/IP ranges in scope, testing methods permitted (e.g. no denial-of-service testing without separate approval), and explicitly excluded systems.

Third-Party Testers

External penetration testing firms must: sign an NDA, provide proof of professional liability insurance, and receive written authorization (a "get out of jail free" letter) before testing begins.

Timing

Tests are scheduled [ ] during a defined maintenance window [ ] with [Notice Period] advance notice to affected system owners, to avoid unexpected disruption.

Findings and Remediation

Findings are documented in a report, classified by severity, and tracked to remediation with target deadlines based on severity (e.g. critical findings remediated within [Timeframe]).

Retesting

Critical/high findings are retested after remediation to confirm the fix is effective.

Adopted by: ______________________ Date: ____________

*The written authorization letter (sometimes called a "get out of jail free" letter) genuinely matters legally — without documented authorization, the exact same technical activity that's a legitimate security test could be indistinguishable from unauthorized computer access under laws like the Computer Fraud and Abuse Act.*