Penetration Test Report Template

Standard Operating Procedure: Penetration Test Report Template

Document ID: SEC-OPS-PT-001
Classification: Internal/Restricted
Last Updated: 2023-10-27

1. Document Control & Revision History

2. Executive Summary & Scope

This template provides the mandatory structure for reporting penetration test results to stakeholders. It serves as a clinical assessment of the security posture of the Target of Evaluation (ToE).

• Operational Boundaries: Testing is strictly limited to assets defined in the signed Rules of Engagement (RoE). Any scope creep requires a formal amendment signed by the Technical Lead.
• Regulatory Alignment: Reports must provide mapping to relevant controls (e.g., NIST SP 800-115, PCI-DSS v4.0 Requirement 11.3, ISO/IEC 27001:2022).
• Tone: Objective, evidence-based, and actionable. No anecdotal observations are permitted without technical supporting artifacts (logs, screenshots, command outputs).

3. Prerequisites & Tool Requirements

• Equipment: Encrypted workstation (FDE), secure VPN client for exfiltration of evidence, hardware token for MFA.
• Software/Tooling: Approved testing suite (e.g., Burp Suite Professional, Nessus, Metasploit, Nmap, custom automation scripts).
• Certifications: Testing personnel must hold valid industry-standard certifications (OSCP, CISSP, or equivalent).
• Safety/Legal: Signed Rules of Engagement (RoE), Non-Disclosure Agreement (NDA), and Proof of Authorization (PoA) on site.

4. Roles & Responsibilities (RACI Matrix)

5. Step-by-Step Operational Procedure

• Phase 1: Evidence Aggregation: Collect all raw outputs, screenshots, and logs. Sanitize data to remove non-essential PII.
• Phase 2: Risk Scoring: Assign a CVSS v3.1 score to each identified vulnerability.
• Phase 3: Executive Summary Drafting: Compose a high-level summary detailing the overall security posture and business impact.
• Phase 4: Technical Deep-Dive: Document findings in the standardized format: Vulnerability Name, Proof of Concept (PoC), Impact, Remediation, and CVSS Vector.
• Phase 5: Quality Peer Review: Second-tester validation of all exploit paths and remediation advice.
• Phase 6: Encrypted Delivery: Transmit report via secure, time-limited portal (e.g., Tresorit, encrypted PDF).

6. Quality Assurance & Verification Criteria

• Tolerance Threshold: Zero tolerance for undocumented findings or unverifiable exploits.
• Acceptance Benchmark: Report must be validated against the "Client Expectations Matrix" defined in the project kickoff.

7. Practical Troubleshooting Scenarios

Scenario 1: Asset Unreachable During Testing

• Identification: Target IP unresponsive to ICMP/TCP probes.
• Immediate Corrective Action: Pause testing immediately. Verify if the asset has undergone unplanned maintenance or if the WAF/IPS has blacklisted the testing IP. Contact Client POC to whitelist testing source.

Scenario 2: Unexpected Production Degradation

• Identification: System performance drops below 20% or service crash observed during active scanning.
• Immediate Corrective Action: Cease all intrusive testing operations. Notify the client emergency contact via phone. Assist incident response team with logs to identify the triggering payload.

Scenario 3: Findings Mismatch (Client Dispute)

• Identification: Client denies the existence or exploitability of a high-risk finding.
• Immediate Corrective Action: Re-run the PoC in a sandbox environment or on a live screen-share session to provide visual evidence. If the environment differs, document the "Environmental Variance" in the report appendix.