VAPT Scope Definition Template
Most VAPT engagements fail because of bad scoping — not bad testing. This template is the exact scoping document our auditors use when starting a VAPT engagement. Use it to brief internal stakeholders, evaluate vendor proposals, or define your own internal scope.
The Checklist
1. Engagement purpose
- Why are we doing this VAPT? (annual audit / pre-release / regulator-driven / post-incident)
- Which framework(s) does the report need to satisfy? (CERT-In / RBI / SEBI / ISO 27001 / SOC 2 / customer requirement)
- Who signs off the report? (internal CISO + external regulator + customer auditor)
2. Asset inventory
- All in-scope domains and subdomains (including non-prod if relevant)
- All in-scope IPs / IP ranges (internal and external)
- All in-scope mobile apps (Android + iOS, store URLs)
- All in-scope APIs (REST / GraphQL / gRPC) with auth model
- All in-scope cloud accounts (AWS / Azure / GCP — account IDs / subscription IDs)
- All in-scope container registries / Kubernetes clusters
- Out-of-scope inventory (3rd-party SaaS, owned-but-not-tested, regulatory exclusions)
3. Test depth
- Black-box / grey-box / white-box (default: grey-box authenticated)
- Authenticated roles to test (admin / standard / partner / customer / unauthenticated)
- Source code review in scope? (Y/N — language coverage)
- Cloud infrastructure review in scope? (Y/N — CSPM scope)
- Phishing / social engineering in scope? (Y/N — channels)
- Red team / assumed breach in scope? (Y/N — duration)
- DAST/SAST/SCA tool-assisted in addition to manual? (Y/N)
4. Standards & coverage
- OWASP Top 10 (web)
- OWASP ASVS L2/L3 (depth)
- OWASP API Top 10
- OWASP MASVS (mobile)
- NIST SP 800-115
- PTES (Pre-engagement → Reporting)
- MITRE ATT&CK (for red team)
- CIS Benchmarks (for OS / cloud)
- Regulator-specific (RBI / SEBI / UIDAI / IRDAI) extensions
5. Rules of engagement
- Test windows (24×7? business-hours only?)
- Production testing allowed? (Y/N — typically Y for VAPT, with care)
- Denial-of-service testing? (typically N)
- Brute-force testing? (typically Y but rate-limited)
- Stop-the-test triggers (production outage, data exposure beyond test scope)
- Emergency contacts on both sides
- Data-handling agreement (NDA + DPA + return / destruction of artefacts)
6. Deliverables expected
- Executive summary report (for board / regulator)
- Technical report with CVSS scores + reproduction steps + screenshots
- Auditor sign-off letter / certificate
- Re-test (typically 30 days) and closure letter
- Optional: video walkthroughs of critical findings
- Optional: SBOM / dependency report
7. Timeline & milestones
- Kick-off date and pre-engagement meeting
- Testing window start and end
- Daily status report cadence
- Critical-finding disclosure SLA (typically 24h)
- Draft report delivery
- Final report delivery
- Re-test window
- Closure letter delivery
Frequently asked questions
Black-box vs grey-box vs white-box — which one?
Grey-box (authenticated, no source) is the default — best ROI for buyers. Black-box only for external-only scoping (e.g., perimeter test). White-box (with source code) for high-assurance engagements like fintechs, banks and ISO 27001 readiness.
Should production testing be in scope?
Yes — most VAPTs need production testing because non-prod often diverges from prod. Define a stop-test trigger and emergency contacts so any incident can be paused quickly.
How long is a typical VAPT?
Web + mobile + API + cloud: 3-4 weeks of testing + 1 week reporting. Network VAPT: 2-3 weeks. Red team: 4-8 weeks. Large multi-product: 8-12 weeks.
What's the right authenticated coverage?
Test every role separately. Common failure: only tested as 'admin' and missed horizontal privilege escalation between two same-role users. At minimum: unauthenticated + standard user + admin + cross-tenant (if multi-tenant).
Should we share source code with the vendor?
For high-assurance engagements, yes. Most VAPTs run grey-box without source. Sharing source improves coverage but you must ensure your vendor's data-handling agreement covers IP.
Need help executing this?
Talk to Digital Defense — India's CERT-In Empanelled cybersecurity team.
Book a consultation