Security hardening / United Kingdom
Penetration testing
Commission a clearly bounded security test, with written authorisation, useful findings and an agreed remediation-verification scope.
Last reviewed . Fees in pounds sterling plus VAT.
What are we authorised to test—and when must we stop?
Scope and fee
Agree the work.
Know the boundary.
The written proposal defines the scope, responsibilities, price and delivery timetable.
What shapes your quote
- Scope, complexity and existing evidence
- Required specialist work and access arrangements
- Depth of reporting and any separately agreed follow-up
The requirement in context
Define the requirement before selecting the work.
Define the targets, business risk, permitted techniques and escalation contacts before testing. A vulnerability scan, a penetration test and a Microsoft 365 configuration assessment are different engagements.
Primary references
NCSC: commissioning penetration testingInside the work
What are we authorised to test—and when must we stop?
Original fictional working example. The actual criteria, evidence, scope and delivery arrangements are agreed for your organisation.
| Work area | Decision to make | Evidence to retain |
|---|---|---|
| Authority | Confirm ownership and permission for every target. | Signed scope and relevant third-party permission. |
| Safety | Agree testing window, exclusions and stop conditions. | Rules of engagement and escalation contact. |
| Findings | Connect observed evidence to impact and a practical fix. | Report, limitations, owner and retest agreement. |
Fictional example · Not a client result, legal determination or complete audit checklist.
Download this working example (CSV)What you take away
Evidence.
Ownership.
A practical next step.
Commission a clearly bounded security test, with written authorisation, useful findings and an agreed remediation-verification scope.
- Asset scope, ownership and written authorisation
- Rules of engagement, timing and stop conditions
- Agreed testing and evidence-led findings
- Prioritised report and separately defined retest
How the work moves forward
Assess first. Change with control.
Responsibilities and access are agreed before the engagement. Work stays connected to the outcome—not the number of documents produced.
Confirm the boundary
Agree systems, permissions, dependencies and exclusions.
Assess the evidence
Record observed settings and prioritise the agreed risks.
Control the change
Approve remediation, test the result and keep a handover record.
A practical starting point
What are we authorised to test—and when must we stop?
Define the targets, business risk, permitted techniques and escalation contacts before testing. A vulnerability scan, a penetration test and a Microsoft 365 configuration assessment are different engagements.
Authority — Confirm ownership and permission for every target. — Signed scope and relevant third-party permission. Safety — Agree testing window, exclusions and stop conditions. — Rules of engagement and escalation contact. Findings — Connect observed evidence to impact and a practical fix. — Report, limitations, owner and retest agreement.
Before you commission the work
Your questions.
Clear answers.
What are we authorised to test—and when must we stop?
Define the targets, business risk, permitted techniques and escalation contacts before testing. A vulnerability scan, a penetration test and a Microsoft 365 configuration assessment are different engagements.
What is included in the engagement?
Asset scope, ownership and written authorisation; Rules of engagement, timing and stop conditions; Agreed testing and evidence-led findings; Prioritised report and separately defined retest. The proposal defines the exact outputs and acceptance criteria.
What is not automatically included?
No test begins without authority for the targets. Social engineering, denial-of-service testing, third-party infrastructure, remediation and retesting are not included unless explicitly agreed.
What does the service cost?
UK service fees are quoted for the agreed scope. We confirm a quote after reviewing the agreed boundary, starting position, dependencies and required deliverables.
How should we share evidence?
Agree secure access, minimisation and retention before work starts. Describe the requirement in the enquiry; do not send passwords or sensitive records through the form.
What should a penetration-test scope specify?
Identify authorised targets, objectives, exclusions, test accounts, allowed techniques, timing, third-party permissions and escalation contacts. Agree evidence handling, reporting and retest boundaries. Testing must not begin without appropriate written authorisation.
Do you claim CHECK or CREST accreditation?
We do not make a blanket CHECK or CREST accreditation claim. If your procurement requires a specific scheme or accreditation, make it an explicit requirement and verify the appointed provider’s current scope before engagement. General penetration testing and a scheme-specific assessment are not interchangeable.
What should we prepare for a scoping conversation?
Describe the organisation, product or service, customer requirement, systems and preferred timing. Do not send passwords or confidential records through the enquiry form. We agree secure evidence handling separately.
Resources for this decision.
NCSC: CHECK introductionLet’s define the work you actually need.
Tell us what you need to achieve, what is in scope and where you are starting.
Talk about your project