We have listed some of the commonly asked questions and considerations that may be used as a basis to create a conventional customer requirements form. It is important to note that this list can be extended or shortened according to the goal of a client:

• Collect basic information, such as company name, address, website, contact person(s) details, email address, and telephone number(s)
• Determine the key objectives behind the penetration testing project
• Determine the penetration test type (with or without specific criteria):
  • Black box testing
  • White box testing
  • External testing
  • Internal testing
  • Social engineering included
  • Social engineering excluded
  • Investigate employee background information
  • Adopt an employee's fake identity (legal counsel may be required)
  • Denial of service included
  • Denial of service excluded
  • Penetrate business partner systems:
    • How many servers, workstations, and network devices need to be tested?
    • Which operating system technologies are supported by your infrastructure?
    • Which network devices need to be tested? Firewalls, routers, switches, load balancers, IDS, IPS, or any other appliances?
    • Are disaster recovery plans in place? If yes, whom should we contact?
    • Are there any administrators currently managing your network?
    • Is there any specific requirement to comply with industry standards? If yes, list them.
    • Who will be the point of contact for this project?
    • What is the timeline allocated for this project?
    • What is your budget for this project?
    • List any miscellaneous requirements, if necessary.