The final approval should not rely on the sales proposal alone. Before saying yes, the buyer needs one coherent engagement pack that connects target, identities, methods, safety, deliverables, commercial terms and closure. Anything still described as “standard” is a candidate for disagreement later.

Use this checklist as a gate, not a wish list. Assign an owner and evidence for every item, record exceptions and do not grant access until mandatory conditions are accepted by both parties.

Scope and assurance objective are final

The statement of work names applications, APIs, environments, builds, accounts, roles, tenants, workflows, integrations and explicit exclusions. The assurance purpose and intended report recipients are recorded.

Coverage is measurable. Where sampling is used, the population, selection logic and limitation are stated. No party assumes that “full VAPT” carries an unstated universal meaning.

  • Canonical target and environment inventory attached.
  • Build or change cut-off agreed.
  • Roles, tenants and test data defined.
  • Out-of-scope and prohibited systems explicit.

The delivery team is named and accepted

Record lead tester, key specialists, quality reviewer, project manager, employer and location. Validate experience against the actual technology and business risks.

Substitution requires notice and approval against equivalent criteria. All subcontractors and affiliates are disclosed before they receive access or evidence.

  • Named personnel and responsibilities.
  • Relevant capability evidence reviewed.
  • Subcontracting chain accepted.
  • Replacement and continuity process written.

Method and coverage are testable promises

The provider explains discovery, automated support, manual analysis, authorization, business logic and specialist techniques. Standards are mapped to actual test actions rather than cited as marketing labels.

A coverage record will show completed, constrained, not applicable and untested areas. Limitations are delivered with enough detail for the buyer to understand residual uncertainty.

  • Architecture-specific test plan approved.
  • Manual depth and automation roles separated.
  • Coverage matrix format agreed.
  • Source-assisted or internal access boundaries set.

Access and environment readiness are proven

Accounts, MFA, allowlisting, network paths, build installation and representative data are tested before the assessment clock starts. Owners are available to resolve access without sharing personal credentials.

The agreement defines pause, reschedule and change treatment when the environment is unavailable, unstable or materially different from the scoped baseline.

  • Readiness check completed.
  • Least-privilege test access issued.
  • Secrets transferred through approved channels.
  • Blocked-time and rescheduling rules accepted.

Rules of engagement protect operations

Written authorisation identifies who permits testing, when and against what. It defines rate and concurrency ceilings, destructive techniques, social engineering, third parties, production constraints and stop conditions.

Named contacts can pause work and receive critical findings. Monitoring teams know the expected activity without being given information that invalidates defensive-control objectives.

  • Testing windows and time zone.
  • Allowed and prohibited techniques.
  • Emergency stop and incident path.
  • Cleanup and reconciliation responsibilities.

Evidence and data handling are controlled

Define what evidence may be collected, how it is minimized and redacted, where it is stored, who can access it and how it is transferred. Include raw artefacts, notes, screenshots, payloads and credentials.

Retention and verified deletion dates apply to provider, subcontractors and backups. The process addresses suspected exposure or loss of engagement data.

  • Approved storage and encryption.
  • Named access boundary.
  • Data residency if required.
  • Retention, deletion and incident notification.

Critical findings have a rapid route

Agree severity language, initial notification time, authorised recipients and the minimum evidence for an urgent alert. The provider should not wait for the final report when an exploitable critical risk is confirmed.

Define how false positives, disputed impact and production incidents are handled. Preserve technical evidence and separate risk acceptance from whether the finding exists.

  • Critical-notification channel tested.
  • 24-hour contacts and alternates recorded.
  • Dispute and escalation path agreed.
  • Risk acceptance authority identified.

Reports and meetings meet acceptance criteria

The contract lists executive and technical deliverables, coverage and limitation statements, evidence standard, severity method, remediation guidance and formats. Sample quality has already been evaluated safely.

Set review periods and correction rules for factual errors. Acceptance should not allow the buyer to suppress valid findings, nor require payment for an unusable scanner export.

  • Draft and final dates.
  • Technical and executive readouts.
  • Independent quality review.
  • Objective deliverable acceptance checklist.

Retesting and closure are unambiguous

State included cycles, eligible findings, request window, scheduling, evidence and status vocabulary. Define whether related variants and regression paths are checked.

Additional cycles, redesign or expanded scope have pre-agreed units or rates. Closure depends on observable control outcomes, not only a developer declaration.

  • Included retest cycle count.
  • Expiry and scheduling commitment.
  • Fixed, partial, not fixed and cannot verify criteria.
  • Final closure artefact and recipients.

Commercial and change terms reconcile

The order form matches the technical pack. Confirm currency, taxes, payment milestones, expenses, travel, onsite work, cancellation, blocked time and validity.

Change control identifies triggers, required evidence, approvers and pricing. A provider cannot quietly reduce coverage to protect margin, and a buyer cannot expand the target without recognising additional work.

  • Total base price and options.
  • GST and expenses treatment.
  • Milestone-to-deliverable mapping.
  • Written change approval before work.

Confirm testing authorisation, confidentiality, intellectual property, liability, breach notification and any third-party permission. Ensure cloud, processor and platform terms permit the planned techniques.

Conflict disclosures, independence safeguards, insurance evidence where required and sanctions or background requirements are complete. Legal review supports safe testing without redefining technical scope.

  • Authority for every target.
  • NDA and evidence ownership.
  • Conflict and independence decision.
  • Applicable regulatory and customer obligations.

Final internal go/no-go is recorded

Security, system owner, operations, privacy, legal, procurement and risk owners approve the parts they own. One engagement owner confirms the documents are consistent.

Record open exceptions, residual risks and dates. If a mandatory safety, authority or evidence condition remains unresolved, the correct decision is no-go—not an informal promise to fix it after access.

  1. Reconcile proposal, SOW, rules and commercial order.
  2. Close or formally accept every exception.
  3. Verify contacts, accounts and escalation channels.
  4. Issue written go only when mandatory gates pass.

Use NIST SP 800-115 as a primary reference for planning, rules of engagement, execution and reporting. Use the OWASP Web Security Testing Guide to make application testing areas explicit, then apply the legal, regulatory and contractual requirements governing your targets.

Make the final yes operationally complete

The purpose of the checklist is not paperwork volume. It is shared understanding that survives sales handoff, staff changes, a critical discovery and a disputed closure.

WIMD uses linked technical, operational and commercial acceptance gates so providers can start efficiently and buyers can defend what was authorised, delivered and closed.