Loading…
Home / Templates / Authorization letter
Penetration test authorization letter: a free template
Before anyone sends a packet at an asset, the permission to do so should exist in writing. This page explains the six things an authorization letter has to pin down, then gives you the full letter to copy and adapt — no signup, no email required.
The six things the letter must pin down
Who signs
The letter must name a person with the authority to grant permission for the assets in scope, not just a team. Record the signer's name, job title, organization and email so the permission is attributable.
Scope
List the exact in-scope assets — hostnames, IP ranges, applications and environments — and, just as importantly, the assets that are out of scope. An unlisted asset is not authorized.
Testing window
State the start and end date and the permitted hours, in a named time zone. Testing outside the agreed window is unauthorized even if the asset is in scope.
In-scope IPs
Give the source IP addresses or ranges the test will originate from, so the client's monitoring team can allow and attribute the traffic instead of paging on it.
Points of contact
Name a technical contact on each side, reachable during the test, with a phone number as well as email. A second contact each is prudent.
Emergency stop
Agree in advance how the client says stop, who may say it, and how the tester confirms and halts work. This is the single most important line in the letter.
The template
PENETRATION TEST AUTHORIZATION LETTER
1. AUTHORIZING PARTY ("Client")
Organization: ______________________________
Authorized signer (name): ____________________________
Job title: ______________________________
Email: ______________________________ Phone: ______________
2. TESTING PARTY ("Tester")
Organization: ______________________________
Lead tester (name): ______________________________
Email: ______________________________ Phone: ______________
3. AUTHORIZATION
The Client authorizes the Tester to perform the security testing described
below. The Client confirms it owns, or is authorized to permit testing of,
every asset listed in scope.
4. SCOPE — IN SCOPE (assets the Tester may test)
Domains / hostnames: ______________________________
IP ranges: ______________________________
Applications / environments (e.g. staging only): ______
5. SCOPE — OUT OF SCOPE (explicitly not authorized)
______________________________________________
6. TESTING WINDOW
Start (date/time): ______________ End (date/time): ______________
Permitted hours: ______________ Time zone: ______________
7. SOURCE IPs
The test will originate from: ______________________________
8. PERMITTED TESTING
[ ] Network / infrastructure [ ] Web application [ ] API
[ ] Authentication testing [ ] Social engineering (separately agreed)
Intrusive testing (e.g. denial of service) is: NOT authorized / authorized
9. POINTS OF CONTACT
Client technical contact: _________ Phone: ______________
Tester technical contact: _________ Phone: ______________
10. EMERGENCY STOP
The Client may halt testing at any time by contacting the Tester's technical
contact above and stating "STOP". The Tester will acknowledge the stop
immediately and cease all active testing within ____ minutes.
11. DATA HANDLING
Findings and any data captured are confidential to the Client and will be
stored securely and destroyed on request.
12. SIGNATURES
Client (authorized signer): ____________________ Date: __________
Tester (lead): ____________________ Date: __________
This authorization is valid from the start of the testing window in
section 6 until the end date, unless withdrawn in writing earlier.Plain text on purpose, so you can paste it into your own document or contract workflow and adapt the wording to your jurisdiction.
How to use it
- 1.Copy the template and fill every blank. An unfilled blank is an unsigned blank: if a field does not apply, write "not applicable" rather than leaving it empty.
- 2.Have the signer confirm they own, or may authorize testing of, each in-scope asset. Note the basis (ownership, contract, written delegation).
- 3.Send the signed letter to whoever monitors the in-scope assets, so the test traffic is expected rather than reported as an attack.
- 4.Keep the signed letter with the test record. If a scan is ever questioned, the letter is the evidence that testing was permitted.
- 5.Re-issue the letter for each test with a new window. An authorization for last quarter does not authorize this quarter's testing.
Authorization letter FAQ
- Is a penetration test authorization letter legally required?
- In most jurisdictions, testing systems you do not own without documented permission can expose the tester and the client to legal risk. An authorization letter is not a substitute for legal advice, but a signed letter that names the assets, the window and the signer is the standard way to evidence that the testing was permitted. Check your own legal and contractual requirements.
- Who should sign the letter?
- Someone with the authority to permit testing of the assets in scope — often the asset owner or a security lead acting with delegated authority, not the tester. If you are testing on behalf of a client, the client signs; if you are testing your own estate, the system owner signs.
- Does the letter replace a rules of engagement document?
- No. The authorization letter records permission and scope; the rules of engagement document records how the test will be run — testing categories, communication, escalation and evidence handling. The two are usually issued together. There is a matching rules of engagement template on this site.
- What has to be in the scope section?
- Every asset the tester may touch, listed by hostname, IP range, application and environment, clearly separated from the assets that are explicitly out of scope. If an asset is not listed in scope, treat it as not authorized.
Related template
Pair this letter with the rules of engagement template, which covers how the test is run rather than whether it is permitted.
PentSeal turns this into a signed, ownership-verified record
The letter above is a document. PentSeal makes the same information a gate: it verifies target ownership, records the signed scope and window, and will not run a scan outside them. Walk the workflow in the browser, or talk to us about a pilot on a domain you own.