Pen Testing Scope & Methodology Framework
Build defensible pen testing scopes, threat models & attack surface maps
by pikkujsConsulting & Professional ServicesTechnology ConsultingCybersecurity ConsultantPen TestingWhat You Can Do
You can generate detailed penetration testing scopes that integrate NIST, PTES, and ISO 27001 requirements with client business context. The framework helps you map attack surfaces across applications, infrastructure, and cloud environments; create defensible threat models for risk-based testing prioritization; develop rules of engagement documentation that prevent scope creep; and clearly delineate in-scope and out-of-scope items to reduce false findings and liability.
Features
Automatically structure in-scope systems, excluded items, and testing boundaries aligned with client infrastructure topology
Generate risk-based threat models using business context to prioritize testing focus across attack vectors
Inventory applications, APIs, infrastructure components, and integration points with severity classification
Create defensible ROE documentation covering testing hours, notification procedures, and escalation protocols
Incorporate NIST, PTES, and ISO 27001 controls into scope documentation for compliance and stakeholder confidence
Structure staged scope expansion across penetration testing phases with clear progression criteria
Document out-of-scope exclusions with justification to manage expectations and reduce disputed findings
Build scope based on actual business criticality, asset sensitivity, and regulatory exposure
Example Output
Example 1: E-commerce Platform Scope
- In Scope: Web application (public facing), payment processing APIs, admin portal, database infrastructure
- Out of Scope: Third-party payment processors (PCI-DSS certified separately), legacy reporting system (sunset Q2)
- Threat Model: Focus on authentication bypass, injection attacks, privilege escalation
- Testing Windows: Non-production hours, 8am-6pm EST, avoid payment processing peaks
Example 2: Hybrid Cloud Infrastructure
- Attack Surface: AWS EC2 instances, RDS databases, on-premises Active Directory, hybrid VPN connectivity
- Severity Classification: Database access (Critical), web application (High), internal services (Medium)
- Rules of Engagement: Single point of contact for kill-switch activation, daily status reports, staged remediation windows
- NIST Alignment: Maps to AC-2 (Access Control), SI-4 (Information System Monitoring), SI-6 (Security Function Verification)
What's Included
- SKILL.md instruction file with framework overview and usage guidelines:
- Scope Definition Template: structured format for in-scope systems, exclusions, and testing boundaries
- Threat Model Worksheet: risk assessment grid mapping attack vectors to business assets
- Attack Surface Inventory Checklist: comprehensive component discovery across applications, APIs, and infrastructure
- Rules of Engagement (ROE) Template: client-facing documentation covering testing procedures, notification protocols, and escalation paths
- Governance Alignment Matrix: NIST/PTES/ISO 27001 control mapping to scope elements
Who It's For
- Penetration Testers/Ethical Hackers — structure engagements with defensible, detailed scopes that satisfy clients and reduce liability
- Security Consultants — develop risk-based testing plans aligned with client governance frameworks and business context
- Cybersecurity Managers — define testing boundaries for internal security assessments and vendor management
- Risk & Compliance Officers — document scope boundaries that align with regulatory requirements (PCI-DSS, HIPAA, SOC 2)
- Enterprise Security Teams — plan multi-phase penetration testing across hybrid infrastructure and complex environments
Best For
- Initiating new external or internal penetration testing engagements
- Mapping attack surfaces across legacy systems, cloud deployments, and hybrid infrastructure
- Creating threat models for risk-based testing prioritization
- Developing rules of engagement and scope boundaries with ambiguous or overlapping client requirements
- Structuring multi-phase engagements with staged scope expansion
- Documenting out-of-scope items to manage client expectations and reduce liability
You might also like
You can systematically evaluate acute and chronic musculoskeletal injuries using validated clinical protocols and generate detailed, defensible documentation that meets professional standards. Claude structures your examination findings, produces rehabilitation recommendations grounded in current evidence, and organizes complex injury data into clear reports suitable for medical records and insurance submission.
by pikkujs
You can conduct rapid ergonomic assessments of industrial workstations and processes to identify injury risks, then develop comprehensive prevention strategies tailored to your workplace. The skill analyzes task demands, environmental factors, and worker capabilities to prioritize interventions by impact and feasibility, helping you reduce musculoskeletal injuries, absenteeism, and workers' compensation costs.
by pikkujs
You can design rigorous exercise intervention research protocols from concept to IRB submission, ensuring alignment with peer-review standards and best practices. The skill helps you evaluate the methodological quality of exercise studies using structured frameworks, identifying potential biases, confounding variables, and design threats. You'll receive comprehensive assessments of study designs against CONSORT, STROBE, and discipline-specific standards.
by pikkujs
You can conduct comprehensive assessments of team cohesion, identify specific dysfunctional group processes like poor communication or misaligned goals, and receive tailored intervention strategies grounded in organizational psychology research. The skill generates actionable recommendations that strengthen psychological safety, improve collaboration, and boost overall team performance.
by pikkujs
Design comprehensive rehabilitation protocols grounded in current sports medicine research and best practices. You'll generate individualized programs that account for specific injuries, athlete characteristics, and return-to-play timelines. The skill helps you structure progressions, select evidence-backed interventions, and document clinical reasoning for professional accountability.
by pikkujs
You'll create formally documented penetration testing scope and ROE frameworks that establish clear attack surface boundaries, authorization limits, and testing methodology parameters. The skill generates client-ready documents that address regulatory requirements, define in-scope/out-of-scope systems, document restraint parameters, and create decision matrices for edge cases—reducing typical scope negotiation from 8-12 hours to 2-3 hours while protecting against legal disputes and failed audits.
by blastgits
Create structured return-to-play (RTP) protocols that incorporate evidence-based clinical frameworks, progressive loading stages, and objective outcome criteria. You'll generate injury-specific rehabilitation plans with clinical decision trees, risk stratification, and documentation templates that meet standard-of-care requirements. This accelerates protocol development from hours to minutes while ensuring consistency and clinical defensibility.
by pikkujs
Upload athlete performance data and get comprehensive analysis identifying your athletes' limiting factors. Claude generates periodized training plans tailored to individual strengths and weaknesses, then tracks progress across key metrics throughout the training cycle. You receive specific workout prescriptions, recovery recommendations, and data-driven insights to optimize athletic development.
by pikkujs