Write the scope before you book the pentest.

The reason for the test, every surface in scope (web app, API, mobile apps, AI features, cloud), the user roles and test accounts, how much access the testers get, what is out of scope, the rules of engagement, what the report must contain and who signs it off. A scope that leaves any of these open gets priced on guesses.

The Trust Services Criteria leave the method to the company. A point of focus under CC4.1 names penetration testing among the evaluations management can use, and many auditors and enterprise customers expect a recent report. The binding commitment is the testing frequency written into your own control description, so agree it with your auditor.

At least two for every role. In a multi-tenant product, create every role in two separate customer organisations, because broken object level authorisation, one account reaching another’s data, is the first risk on the OWASP API Security Top 10.

Staging is safer when it truly mirrors production; differences in code, configuration or data hide real flaws. Production testing finds what customers are exposed to, so it needs tighter limits: test accounts only, no load testing and no destructive actions.

AWS, Microsoft and Google let customers test their own resources without prior approval, within published policies that prohibit denial-of-service and flooding tests. Services you use but do not own need their owners’ written authorisation.

PCI DSS sets at least every 12 months and after significant changes; SOC 2 follows whatever your control description says. A product that ships every week changes faster than any yearly cycle, which is why the rules in section 5 are worth re-checking on every release.

Nothing leaves your browser. The page keeps your draft on this device so you can come back to it, and the Start again button clears it.