Pentest Authorization

Which tests do you authorize?

Tick every type you approve. Anything left unticked will not be performed.

External network (internet-facing systems)

Internal network (from inside your office)

Web application

Wireless network

Cloud identity (Microsoft 365 / Google Workspace)

Phishing simulation against employees

Physical intrusion attempt (needs a separate Site Access Letter)

How much information will GNSIT receive first? *

Black box — no information provided

Grey box — limited information / a standard user account

White box — full documentation and credentials

Will your IT staff be told a test is running? *

Unannounced testing also measures how your team and monitoring detect and respond.

Announced — staff informed in advance

Unannounced — only the signatory and emergency contact know

Authorized targets — IP ranges, domains, applications, locations *

One per line. Anything not listed here will NOT be tested, even if we discover it.

EXCLUDED — systems that must never be touched *

For example: clinical imaging server, practice management system during clinic hours, point-of-sale during business hours, backup appliances.

Third-party consent — which apply to your environment?

Where systems are hosted by someone else, their rules also apply. GNSIT will confirm what is required.

Microsoft 365 / Azure

Google Workspace / Google Cloud

External web hosting or cloud provider

Shared office building / landlord network

Line-of-business vendor (practice management, ERP, accounting)

None — we own and host everything in scope

Do systems in scope hold regulated data? *

If yes, we record only proof that access was possible — never copies of records.

No regulated data in scope

Yes — patient records (HIPAA)

Yes — cardholder data (PCI-DSS)

Yes — other regulated data

Preferred start date *

Preferred end date *

Permitted hours *

Business hours only

After hours (evenings)

Weekends only

Any time (24/7)

Blackout periods — when testing must NOT happen

For example: payroll runs, month-end close, surgery days, seasonal peak, holidays.

Techniques you authorize

We always use the least disruptive method that proves a finding.

Passive reconnaissance and public information gathering

Port scanning and service enumeration

Automated vulnerability scanning

Manual exploitation to prove real-world impact

Privilege escalation and lateral movement inside the approved scope

Offline cracking of password hashes obtained during the test

Online password guessing / spraying (account-lockout risk)

Wireless attacks (rogue access point, offline crack of captured key)

Temporary persistence, documented and removed at test end

If online password guessing is authorized: max attempts per account

Do current, restorable backups exist for all systems in scope? *

Testing does not begin without this.

Yes — verified recently

Not sure — please verify for us first

No — we need backups in place first

Please confirm you understand and accept

All five must be ticked before we can proceed.

Denial-of-service and destructive testing are NOT included

Testing may trigger alerts from our security monitoring

Any security testing carries a residual risk of unintended disruption

We own, or are lawfully entitled to authorize testing of, every system listed above

The person completing this form has authority to consent for the company

Do you authorize GNSIT LLC to perform this testing? *

This form records your intent. We then send the final authorization document for electronic signature — testing starts only after it is signed.

Yes — I authorize this testing within the scope above

Not yet — I have questions first

Penetration Testing Authorization

1. Client and Contacts

2. What May Be Tested

3. Scope

4. When

5. Permitted Techniques

6. Safety and Consent

Social Media

Follow u