# Penetration test report quality checklist

Use this on the sample report a firm sends with its quote, and again on the report you receive. A good report lets a director decide what to do and lets an engineer reproduce and fix every finding.

Online version: https://pentesting.org/toolkit/pentest-report-checklist

## Executive summary

- [ ] Says in plain language what was tested, when, and the overall result
- [ ] Names the most serious risks and what they would mean for the business
- [ ] Says what to do first
- [ ] Can be read without the technical sections

## Scope and method

- [ ] Lists every system tested, and anything agreed in scope that was not tested, with the reason
- [ ] States the testing dates, the perspective (outside or logged in) and the accounts used
- [ ] Names the standards or methodology followed
- [ ] Names the testers or their roles

## Each finding

- [ ] A clear title and the affected systems, URLs or hosts
- [ ] A severity rating, with the rating method and version stated, such as a CVSS vector
- [ ] A description of the weakness in plain terms
- [ ] Evidence you can follow to reproduce it: requests, steps or screenshots
- [ ] The impact: what an attacker could actually do
- [ ] Specific remediation for your systems, not generic advice
- [ ] References where useful, such as a CVE or CWE

## After the findings

- [ ] A summary table of all findings with their severity and status
- [ ] A remediation plan ordered by risk
- [ ] Retest results showing which findings are closed
- [ ] Good practice the testers found, as well as the problems

## Warning signs

- Pages of scanner output with little explanation.
- Findings with no evidence, or evidence you cannot follow.
- Severity ratings with no method behind them.
- The same generic remediation text on many findings.
- No statement of what was in scope or when it was tested.
- Nothing on business impact.