# First MSP pentesting engagement: scoping worksheet

Version: 4 November 2026. Published by rootzero, the maker of SpectrAI.
Guide: https://spectr-ai.eu/en/lancer-offre-pentest-msp

This worksheet prepares a discussion. It is not a quote, contract, mandate or
testing authorisation. Do not enter passwords, tokens, private keys, production
personal data or other secrets in this document.

## 1. Need and responsibilities

- Partner and engagement contact:
- Customer and person authorised to approve the assets:
- Decision expected from the report:
- Report recipient and debrief owner:
- Remediation owner:

## 2. Scope to confirm in the proposal

- Application and environment:
- Exact domains and associated APIs:
- Public or private access, internal relay requirement:
- Required roles and test accounts, without secret credentials:
- Demonstration organisations and expected isolation:
- Authorised workflows and test data:
- Exclusions, prohibited operations and third-party dependencies:

## 3. Launch preparation

- Mandate authority and scope confirmed:
- Domain-control evidence and access prerequisites:
- Requested window and availability constraints:
- Reachable contact and agreed stopping procedure:
- Separate channel agreed for account secrets:
- Processing, providers, locations, retention and recipients reviewed:

## 4. Deliverables and follow-up

- Report format and authorised recipients:
- Debrief and questions to prepare:
- Retest scope and window confirmed in the proposal:
- Remediation evidence and closure criteria:
- Untested, blocked or separately assessed areas:

## 5. Partner follow-up

- Consultancy scoping and support effort:
- Outstanding questions:
- Proposal, order and invoicing: distinct statuses:
- Engagement review and next decision:

References:
- https://spectr-ai.eu/en/partenaires
- https://spectr-ai.eu/en/methodologie
- https://spectr-ai.eu/en/exemple-de-rapport