handbook/01 - Planning.md

## Target Audience

- Identify targets of the engagement 
- Identify scope and size of the engagement
- Surface area of engagement

## Objective

Asses reasons for the assessment. Security, risk assessments, customer personal data protection, etc.

Identify Protected Assets 

[[ASSET INVENTORY]]

[[RISK REGISTER]]

## Compliance

Establish guidelines (or necessity) for compliance with internal and external regulations or standards.
Example: PCI DSS, GDPR, HIPPA, etc
- Strictly defined surface area of engagement

[[Statement of Work]]

[[Non-Disclosure Agreement]]

[[Request for Information (RFI)]]

## Resources

1. Define budgeting requirements for the campaign.
2. Identify target's accessibility:
	- Physical access
	- Remote access
	- Tooling required
	
## Communication Plan

1. Aquire Trusted Agent(s) within the company for trusted communication
2. Establish communication guidelines and information access control rules during engagement (who knows what)
3. Establish escalation procedures


## Product/Report

Establish reporting guidelines

[[PENTEST REPORT TEMPLATE]]

## Technical Constraints

Identify and establish all technical restrictions during the engagement. What parts of the infrastructure is tested and what is out of scope.

## Comprehensiveness

Identify specifics on the engagement, what parts of the infrastructure is tested, what type of vulnerabilities, etc.