IT Vulnerability Assessment and Penetration Testing Scoping Questionnaire
# Category / Question Response
General
1 Estimated Engagement Start Date: 01st Dec 2023
Frequency of testing (One Time/ Every Quarter as
2 02 / Year
per IS Audit / Nepra requirement)
0 Locations (offices, main and remote/ Nos. of sites) Plant and Head Office
Dealings with third parties Required? For example:
> Cloud Services
4 > ISP
> Web Hosting
> Countries where servers are hosted
A2Z for WebHosting
Which type of penetration testing would be
5 required in External? (Black-Box / Grey-Box / White- White-Box
Box)
Which type of penetration testing would be
6 White-Box
required in Internal? (Grey-Box, White-Box)
Role-Based Testing will be required? (Do we have to
7 bypass end-user domain and antivirus policies)? YES No
/ NO
No. of Roles Roles Description / Names
1. Network/ System Vulnerability Assessment.
8 How many roles are required for testing?
3 2. Identify system vulnerabilities. 3. Endpoints /
Assets /network devices and Device Hardening
Assessments.
Mobile App Pentest Required? Mobile App Platform(s) Quantity
Mobile application is available? Do you want to
9
include it in the PT scope as well? Yes Android & IOS 1
Network Security Configuration Required for
10 Yes
devices like firewall, router, switch?
11 End-Points Assessment Required? Yes
Would you require a re-test after issues have been
12 Yes
reported and remediated? YES / NO
Infrastructure Quantity Details
# Description / Details Quantity / Client Response
1 No. of External Penetration Testing Ips / Hosts 2
2 No. of Internal Penetration Testing Ips / Hosts 200
No. of Applications for Web Penetration Testing
3 5
(this can include any web based app or a website)
No. of Applications for White-Box / Credential Based
4 N/A
Testing (if required)
No. of Network Devices for Security Configuration
5 8
Review (if required)
6 No. of End-Points for Assessment (if required) 75
7 No. APIs N/A
