BUYER GUIDE · TURKS AND CAICOS ISLANDS

How to prepare for a penetration test

A practical checklist for system owners and IT teams.

Confirm ownership and permission

List public IP addresses, domains, applications and APIs. Identify who owns each asset. Obtain written authorisation and check hosting, supplier and third-party approval conditions before testing starts.

Prepare access and accounts

Provide appropriate test accounts for each agreed role, including separate organisations or tenants where relevant. Share credentials through an agreed secure channel. API work may require documentation, example requests and sandbox access.

Agree operating safeguards

Confirm backups and recovery arrangements, emergency contacts, permitted activities, excluded systems, rate limits and stop conditions. Agree whether a test environment is suitable and what differences from production should be recorded.

Plan the follow-up

Make someone responsible for receiving urgent findings, arranging the reporting discussion and assigning fixes. Allow time to review evidence and agree any retesting. Do not send passwords or confidential documents through a general enquiry form.

Further reading: NIST technical guide to security testing and assessment ↗ .

General buyer guidance. Your written proposal and rules of engagement define the service.