Pen Testing Scope & Methodology Framework
Build defensible pen testing scopes, threat models & attack surface maps
by pikkujsConsulting & Professional ServicesTechnology ConsultingCybersecurity ConsultantPen TestingWhat You Can Do
You can generate detailed penetration testing scopes that integrate NIST, PTES, and ISO 27001 requirements with client business context. The framework helps you map attack surfaces across applications, infrastructure, and cloud environments; create defensible threat models for risk-based testing prioritization; develop rules of engagement documentation that prevent scope creep; and clearly delineate in-scope and out-of-scope items to reduce false findings and liability.
Features
Automatically structure in-scope systems, excluded items, and testing boundaries aligned with client infrastructure topology
Generate risk-based threat models using business context to prioritize testing focus across attack vectors
Inventory applications, APIs, infrastructure components, and integration points with severity classification
Create defensible ROE documentation covering testing hours, notification procedures, and escalation protocols
Incorporate NIST, PTES, and ISO 27001 controls into scope documentation for compliance and stakeholder confidence
Structure staged scope expansion across penetration testing phases with clear progression criteria
Document out-of-scope exclusions with justification to manage expectations and reduce disputed findings
Build scope based on actual business criticality, asset sensitivity, and regulatory exposure
Example Output
Example 1: E-commerce Platform Scope
- In Scope: Web application (public facing), payment processing APIs, admin portal, database infrastructure
- Out of Scope: Third-party payment processors (PCI-DSS certified separately), legacy reporting system (sunset Q2)
- Threat Model: Focus on authentication bypass, injection attacks, privilege escalation
- Testing Windows: Non-production hours, 8am-6pm EST, avoid payment processing peaks
Example 2: Hybrid Cloud Infrastructure
- Attack Surface: AWS EC2 instances, RDS databases, on-premises Active Directory, hybrid VPN connectivity
- Severity Classification: Database access (Critical), web application (High), internal services (Medium)
- Rules of Engagement: Single point of contact for kill-switch activation, daily status reports, staged remediation windows
- NIST Alignment: Maps to AC-2 (Access Control), SI-4 (Information System Monitoring), SI-6 (Security Function Verification)
What's Included
- SKILL.md instruction file with framework overview and usage guidelines:
- Scope Definition Template: structured format for in-scope systems, exclusions, and testing boundaries
- Threat Model Worksheet: risk assessment grid mapping attack vectors to business assets
- Attack Surface Inventory Checklist: comprehensive component discovery across applications, APIs, and infrastructure
- Rules of Engagement (ROE) Template: client-facing documentation covering testing procedures, notification protocols, and escalation paths
- Governance Alignment Matrix: NIST/PTES/ISO 27001 control mapping to scope elements
Who It's For
- Penetration Testers/Ethical Hackers — structure engagements with defensible, detailed scopes that satisfy clients and reduce liability
- Security Consultants — develop risk-based testing plans aligned with client governance frameworks and business context
- Cybersecurity Managers — define testing boundaries for internal security assessments and vendor management
- Risk & Compliance Officers — document scope boundaries that align with regulatory requirements (PCI-DSS, HIPAA, SOC 2)
- Enterprise Security Teams — plan multi-phase penetration testing across hybrid infrastructure and complex environments
Best For
- Initiating new external or internal penetration testing engagements
- Mapping attack surfaces across legacy systems, cloud deployments, and hybrid infrastructure
- Creating threat models for risk-based testing prioritization
- Developing rules of engagement and scope boundaries with ambiguous or overlapping client requirements
- Structuring multi-phase engagements with staged scope expansion
- Documenting out-of-scope items to manage client expectations and reduce liability
You might also like
You can systematically evaluate acute and chronic musculoskeletal injuries using validated clinical protocols and generate detailed, defensible documentation that meets professional standards. Claude structures your examination findings, produces rehabilitation recommendations grounded in current evidence, and organizes complex injury data into clear reports suitable for medical records and insurance submission.
by pikkujs
You can conduct comprehensive assessments of team cohesion, identify specific dysfunctional group processes like poor communication or misaligned goals, and receive tailored intervention strategies grounded in organizational psychology research. The skill generates actionable recommendations that strengthen psychological safety, improve collaboration, and boost overall team performance.
by pikkujs
Design comprehensive rehabilitation protocols grounded in current sports medicine research and best practices. You'll generate individualized programs that account for specific injuries, athlete characteristics, and return-to-play timelines. The skill helps you structure progressions, select evidence-backed interventions, and document clinical reasoning for professional accountability.
by pikkujs
Create structured return-to-play (RTP) protocols that incorporate evidence-based clinical frameworks, progressive loading stages, and objective outcome criteria. You'll generate injury-specific rehabilitation plans with clinical decision trees, risk stratification, and documentation templates that meet standard-of-care requirements. This accelerates protocol development from hours to minutes while ensuring consistency and clinical defensibility.
by pikkujsYou can create comprehensive clinical assessment protocols, standardized documentation templates, and regulatory-compliant procedures tailored to your specialty or department. This skill automates the development of clinical forms, assessment checklists, and protocol workflows that ensure consistent, evidence-based practice across your organization.
by pikkujs
Create progressive, age-appropriate practice plans that develop fundamental skills while preventing overuse injuries. Evaluate your athletes using objective performance metrics and development frameworks, then communicate clear, actionable updates to parents about their child's progress and areas for growth. This skill handles everything from periodized training design to parent communication templates.
by pikkujs
This skill generates comprehensive, evidence-based return-to-play (RTP) protocols tailored to collegiate athletics. You provide athlete injury details, sport type, and institutional requirements, and Claude creates systematic assessment criteria, progressive rehabilitation phases, compliance documentation, and medical clearance checklists. This ensures your protocols meet NCAA guidelines, institutional liability standards, and current sports medicine best practices while reducing documentation burden on your athletic medicine staff.
by pikkujs
Upload athlete performance data and get comprehensive analysis identifying your athletes' limiting factors. Claude generates periodized training plans tailored to individual strengths and weaknesses, then tracks progress across key metrics throughout the training cycle. You receive specific workout prescriptions, recovery recommendations, and data-driven insights to optimize athletic development.
by pikkujs