Appendix: Information, Authorization and Scope Approval
This text summarizes the accuracy of the scope declared in the form, the principles of conducting the tests
and the responsibilities of the parties.
1) Purpose and Work Definition
This form; test scope, test approach (White/Gray/Black Box), time constraints, access needs and reporting
expectations for the selected services
has been prepared to record. Security tests; detection of vulnerabilities in a controlled and planned manner
without causing service interruption in target systems,
aims to verify and report.
2) Scope and Exclusions
- Scope is limited to services selected in this form and assets declared in relevant sections (IP/Subnet,
FQDN, application, API, SSID, etc.).
- If testing of out-of-scope assets is requested, separate written approval and scope update are required.
- Operations that may cause uncontrolled denial of service (DoS) effect will not be applied unless
explicitly requested and written approval is obtained.
- Verification (retest) is not included as a general rule in services such as social engineering, DDoS, web
load testing and continuous vulnerability analysis; it must be requested separately.
3) Authorization and Permission
- Organization/Company declares that it has given the necessary authority to test the systems to be tested;
that the relevant assets belong to it or that it has authorized usage rights.
- Exploitation of vulnerabilities detected during testing (proof generation) is carried out only for
security assessment purposes and with the necessary minimum impact.
- “Malware installation permission” Action is taken according to the selection in the field; unless
permission is granted malware dropping/persistence is not done.
4) Prerequisites and Customer Responsibilities
- While Gray/White Box testing, security devices (WAF/IPS/NAC, etc.) must be configured so that test IPs are not blocked.
- In local network tests, the working environment, network access and necessary technical coordination are
provided by the Organization/Company.
- Required user profiles, test accounts, access permissions and documentation (e.g. Swagger) for
Application/API tests are provided by the Organization/Company.
- In mobile application tests, if the requested technical requirements (e.g., appropriate build/SSL pinning
conditions) are not met, the test scope may narrow or the duration may extend.
5) Data Processing, Records and Report Retention
- Findings, evidence and logs obtained during the test are processed for reporting purposes and shared only
with authorized persons.
- Report delivery is made in password-protected form.
- The report retention/destruction process is applied according to the selection in the "Report retention period" field; if a verification test is to be performed, the report may be requested from the Institution/Company.
6) Operational Risks and Emergency Procedure
- Every security test has certain operational risks (service performance impact, unexpected behaviors,
third-party dependencies, etc.).
- Emergency contact person/number is specified in this form; test can be stopped immediately if necessary.
- Critical business continuity restrictions (off-hours, specific time range etc.) “Time restriction” field
must be specified.
7) Limitation of Liability
Security testing is an assessment activity carried out within the scope declared in the form and the
access/prerequisites provided.
CASPISEC cannot be held responsible for out-of-scope systems, unspecified assets, interruptions caused by
third-party service providers and consequences arising from prerequisites not provided by the
Organization/Company.
