How to Prepare for a Penetration Test: Business Checklist

Booking a penetration test is the easy part. Getting real value out of it takes a bit of groundwork beforehand. Testers who arrive without clear scope, missing access, or an unprepared team end up spending billable hours on admin instead of actually testing your defences. That is time and money you do not need to lose.

This checklist walks through exactly what to sort out before test day so your network penetration testing engagement delivers a report you can actually act on.

What Is a Penetration Test, and Why Prepare for One?

A penetration test is a controlled, authorised attempt to break into your systems the way a real attacker would. Testers actively try to exploit weaknesses in your network, applications, or infrastructure, rather than just scanning for known issues and stopping there.

Preparation matters because a pen test is only as useful as the information and access behind it. Go in unprepared, and you risk one of two outcomes: the test runs into blockers and never covers the ground it should, or it causes disruption you were not expecting. A bit of planning upfront avoids both.

Penetration Testing Checklist: Before You Book

1. Define Your Objectives and Scope

Before contacting any provider, get clear internally on what you actually want tested and why. Are you testing to satisfy a client requirement, an insurance condition, or a framework like Cyber Essentials or ISO 27001? Are you more concerned about external attackers, internal risks, or a specific system you have doubts about?

Write down:

1. Which systems, networks, or applications are in scope
2. What is explicitly out of scope, and why
3. Whether you want an external test, an internal test, or both
4. Any compliance or contractual requirement driving the test

A clear scope protects you from a vague, unfocused engagement and stops testers from wasting time working out priorities that you could have told them upfront.

2. Choose a Properly Qualified Provider

This is where a lot of businesses go wrong. Penetration testing is a largely unregulated market in the UK, and anyone can advertise "expert assistance" testing services without formal credentials behind the claim. The NCSC is direct about this: always check that the people carrying out your test are properly qualified, and it points to accreditations from CREST or individual qualifications such as OSCP as a reasonable benchmark.

For most commercial UK businesses, a CREST-accredited provider is the standard to look for. If your test involves UK government systems or critical national infrastructure, you may specifically need a provider approved under NCSC's CHECK scheme instead, which has its own strict qualification requirements for testers.

Before signing anything, check:

1. Is the provider CREST accredited, and can they show current membership?
2. Do the individual testers hold recognised qualifications, not just the company?
3. Have they tested businesses of a similar size and setup to yours before?
4. Can they explain their methodology clearly, rather than just listing tools?
5. 
   

3. Get Written Authorisation in Place

Penetration testing without proper written authorisation can be a legal problem, both for you and the testing provider. Make sure the scope, dates, and rules of engagement are documented and signed off before any testing begins.

If you use cloud infrastructure or email, check your hosting provider's policy too. Some cloud platforms require advance notification before penetration testing takes place on infrastructure hosted with them, so confirm this is covered before test day arrives.

4. Back Up Your Systems

Reputable testers work carefully, but active exploitation carries some inherent risk, particularly on production systems. Before testing starts, confirm recent backups exist and that you could restore from them if something unexpected happened. This is standard good practice, not a sign you expect problems.

5. Gather Relevant Documentation

The more useful information you can give testers upfront, the more of the engagement they can spend actually testing rather than mapping your environment from scratch. Useful documents include:

1. Network diagrams and a list of in-scope IP addresses or domains
2. An inventory of applications, servers, and cloud services in scope
3. Details of any recent changes to infrastructure or applications
4. Findings and remediation notes from any previous penetration test

6. Decide Who Needs to Know

Work out internally who should be informed that testing is happening. Your IT team usually needs advance notice, so genuine test activity is not mistaken for a live attack and does not trigger an unnecessary incident response. That said, if part of your objective is to assess how well your team detects and responds to an attack, you might deliberately keep only senior leadership informed and let the test double as a detection exercise.

Either way, decide this on purpose rather than leaving it to chance.

7. Set Communication Expectations for Test Day

Agree in advance on how the testing team will reach you if something urgent comes up and how you will reach them. Confirm:

1. A named point of contact on both sides
2. What counts as an emergency that should pause testing immediately
3. How findings will be communicated as testing progresses, if at all
4. The expected format and timeline for the final report

Penetration Testing for Small Businesses: Common Questions

Smaller businesses often assume penetration testing is only relevant once they reach a certain size or hold a certain volume of data. In practice, the preparation steps above matter just as much, if not more, for a small business, because there is usually less internal capacity to absorb a poorly scoped or disruptive test.

If you are a small business considering your first test, keep these points in mind:

1. Start with a realistic scope. You do not need to test everything at once. A focused test on your highest-risk systems is more useful than a broad, shallow one.
2. Ask what happens after the report lands. A good provider should be willing to explain findings in plain terms and advise on priority, not just hand over a technical document and disappear.
3. Budget for remediation, not just the test itself. The real value comes from fixing what the test finds, so leave room in your plan for that follow-up work.

What Happens After the Test

Once testing wraps up, you should receive a report detailing what was found, how severe each issue is, and practical steps to fix it. A good report ranks findings by risk so you know what to prioritise first, rather than leaving you with a long list and no sense of what matters most.

From there, the real work is remediation. Testing without follow-up action does not improve your security position. Many businesses schedule a retest after remediation to confirm the fixes actually worked, particularly for anything rated as high or critical risk.

At NetworkShield, we often see businesses treat the test itself as the finish line, when really it is the starting point for a stronger security setup. Proper preparation on the front end and a clear remediation plan on the back end are what turn a penetration test from a compliance exercise into something that actually reduces your risk.

Final Thoughts

A penetration test is only as valuable as the preparation behind it. Get your scope, documentation, authorisation, and internal communication sorted before test day, and choose a properly qualified provider, and you will get a report that tells you something useful rather than one full of gaps caused by avoidable friction.

FAQs

How long does a typical penetration test take to prepare for?

Most businesses need one to two weeks to gather documentation, agree on scope, and confirm authorisation before testing begins. Larger or more complex environments may need longer, particularly if multiple stakeholders need to sign off.

Do small businesses really need penetration testing?

Yes, particularly if you hold customer data, process payments, or need to meet client or insurance requirements. A focused test on your highest-risk systems is often more valuable than skipping testing altogether due to size.

What is the difference between CREST and CHECK penetration testing?

CREST is the accreditation most UK commercial businesses look for. CHECK is an NCSC scheme specifically for testing UK government and critical national infrastructure systems, with its own strict tester qualification requirements.

Will a penetration test disrupt my business systems?

It can, though reputable testers work carefully to minimise disruption. Backing up your systems beforehand and agreeing on rules of engagement in advance reduces the risk of unexpected downtime during testing.

How often should a business carry out network penetration testing?

Most guidance suggests at least annually, or after any significant change to your network or applications. Businesses in regulated sectors or handling sensitive data may need to test more frequently.