Vulnerability assessment and penetration testing (VAPT) is specialised work with real risks: testing the wrong system, at the wrong time, without proper authorisation. A disciplined process protects the client and your firm.
Before testing: authorisation and scope
Never start without:
- written authorisation from someone with the authority to give it;
- an exact scope: applications, IP addresses, environments;
- rules of engagement: testing windows, what's out of bounds, who to call if something breaks;
- test accounts and access, if needed.
During testing: communicate
- Agree an emergency contact on both sides.
- Report critical findings straight away, not in the final report.
- Keep a log of what was tested, and when.
The report
A good report serves two audiences:
- Executives: overall risk, the most important findings, what to do first.
- Engineers: each finding with evidence, risk rating and specific fix.
The re-test
The engagement isn't complete until fixes are verified. Agree in the proposal:
- how long the client has to fix findings;
- that one re-test is included;
- what a closure report contains.
Billing
A share on starting, and the balance on the report or closure report, works well. Re-tests beyond the one included should be priced separately.
How MSMEPulse helps
MSMEPulse includes a security assessment (VAPT) template with authorisation and scope on the client checklist, testing, reporting and re-test as tasks and milestones, and an ISO 27001 implementation template for longer engagements. Clients upload authorisations and access details through their portal rather than email.
