Penetration Test Authorization Letter: What It Must Include

One Tuesday morning, the web host of a Montréal law firm suspends its website: its systems have detected what looks like an attack. In a way, it is one. It's the penetration test the firm commissioned, and nobody told the host.

The story ends well because the firm had a signed authorization letter and could produce it within ten minutes. Without it, the episode could have turned into a dispute.

An authorization letter, often paired with rules of engagement, isn't paperwork for its own sake. It's the document that turns an attack into a professional service. Here's what it needs to say and how to build one.

Why written authorization is essential

In Canada, section 342.1 of the Criminal Code makes unauthorized use of a computer an indictable offence punishable by up to ten years in prison (text current to September 30, 2026, according to the Justice Laws Website).

The section targets anyone who, "fraudulently and without colour of right," obtains computer services, intercepts a function of a computer system, uses a computer system with intent to commit those offences or mischief in relation to computer data (s. 430), or uses a computer password that would enable them. A penetration test does exactly these kinds of things: scanning, gaining access, trying passwords.

What separates a test from an attack is documented consent from the person entitled to give it. The letter protects your business too: it's what you show your web host, insurer or IT provider when an alert goes off.

This article isn't legal advice: have your letter reviewed by your legal counsel.

Who signs, and for which systems

The letter must be signed by someone with authority over the systems being tested: usually the CEO or an officer authorized in writing, not just the person in charge of IT.

The most common trap is that you don't own everything you use. A Mississauga distributor whose firewall is managed by its IT provider, whose website sits with a hosting company and whose accounting runs in cloud software can't, on its own, authorize testing of all that infrastructure. You need written consent from each third party, or you must follow its published rules.

Also exclude by default:

• employees' personal devices, unless they consent;
• the network of a shared building or coworking space;
• systems belonging to a parent company or partner, without its agreement.

What the letter and rules of engagement must include

A complete authorization letter answers six questions: who, what, when, how, how far, and what happens to the data. NIST SP 800-115 even includes a rules of engagement template to structure them.

• Parties and signatories: client company, testing firm, names and titles of signatories.
• Type of test: external, internal, web application, wireless, simulated phishing. Our article on external vs internal penetration tests helps you choose.
• Precise scope: IP addresses and ranges, domain names, URLs, applications, test accounts provided.
• Explicit exclusions: fragile systems, phone systems, third-party systems without consent.
• Testing window: dates, hours, time zone, blackout periods (payroll, month-end, tax season).
• Permitted and prohibited techniques: denial of service, social engineering, physical access, password attacks, depth of exploitation, lateral movement.
• Proof without copying: show access to sensitive data without exfiltrating it.
• Testers' source IP addresses: so you can tell the test from a real attack in your logs.
• Contacts and escalation: two reachable people on each side, an emergency number, an immediate stop procedure.
• Critical findings: immediate notice, without waiting for the report.
• Data: encryption, restricted access, short retention, certified deletion.
• Third-party permissions: web host, IT provider, cloud providers, attached as appendices.
• Deliverables: report, debrief, retest, deadlines.

Social engineering deserves its own line. If the engagement includes simulated phishing emails or phone calls, the letter must say so explicitly. Our article on phishing simulations explains how to frame them.

On data, Quebec's Law 25 also applies: if the firm may access personal information, section 18.3 requires a written mandate specifying protection measures, use limited to the mandate and a ban on keeping the information after the contract ends. Outside Quebec, federal and provincial privacy laws set similar expectations for service providers.

Cloud: do you need to notify Microsoft, AWS or Google?

The three major cloud providers don't require pre-approval for most tests on your own resources, but each imposes rules your letter should reference.

Two points from Microsoft Learn matter for a small business. First, Microsoft doesn't grant authorization on the customer's behalf: it's up to you to document the testing firm's authorization before testing begins. Second, if legitimate testing gets flagged, Microsoft says to respond with the customer's authorization and a description of the in-scope activity. Keep the letter within easy reach.

For Microsoft 365, the same unified Microsoft rules apply: you test only your own tenant. For every other provider (web host, accounting software, CRM), read the terms: several prohibit scanning without prior agreement.

Template: the standard structure

Here's a one- or two-page letter structure, plus appendices, to adapt with your legal counsel and testing firm.

1. Title and reference: "Security Testing Authorization," engagement number, date.
2. Declaration: "Company, represented by name, title, who confirms having the necessary authority, authorizes firm and the individuals named in Appendix A to perform the testing described below."
3. Objective: one sentence on what the test should verify.
4. Scope (Appendix A): target systems, addresses, URLs, test accounts, exclusions.
5. Window: start and end dates and times, time zone.
6. Rules of engagement (Appendix B): permitted and prohibited techniques, depth of exploitation, source IPs.
7. Communication: contacts, emergency number, stop code word, critical finding notices.
8. Data and confidentiality: protection, retention, deletion and certificate.
9. Third-party permissions (Appendix C): copies of agreements or applicable policies.
10. Term and revocation: expiry date; revocable at any time by written notice.
11. Signatures: client and firm, dated.

Our sample audit report shows where the authorization reference appears in a deliverable. A serious firm will bring this document to you unprompted; if it doesn't, our guide to choosing a cybersecurity audit firm covers what else to demand.

For our own penetration testing engagements, the authorization letter is signed before any activity, without exception.