Draft an authorisation letter and an escalation policy

applied · 90 min · Objective 1.2

Task

Produce the two documents that make testing lawful and safe: an authorisation letter you would not start without, and an escalation policy that says what stops the engagement. Then run five findings past the policy and record which ones you must report immediately. Objective 1.2 is legal and ethical compliance, and it is examined because these decisions have exactly one defensible answer.

Steps

  1. Write /tmp/authorisation.md: who is authorising and their standing to do so, what may be tested, the window, the techniques permitted (naming anything with an availability risk), and emergency contacts. Use concrete lab values.
  2. Add the clause that matters most: nothing — including reconnaissance — begins before this is signed.
  3. Write /tmp/escalation.md: the path (who to call, on each side, out of hours) and the categories that stop the work immediately rather than waiting for the report.
  4. Now triage. In /tmp/triage.md, take five findings and mark each immediate or report: (a) a missing security header; (b) evidence that an attacker is already in the environment; (c) exposure of regulated personal data; (d) a default password on an internal printer; (e) apparent illegal content on a share.
  5. For every immediate, name who you call and why it cannot wait.

Verify

grep -ciE "before.*sign|not.*(begin|start).*(until|before).*sign|signed" /tmp/authorisation.md
grep -cE "^(finding|verdict|contact):" /tmp/triage.md
awk '/^verdict:\s*immediate/{i++} END{print i" immediate escalation(s)"}' /tmp/triage.md

The first must be non-zero — an authorisation letter that does not say "not before it is signed" is missing its point. The second must be at least 10 — five findings, each with a verdict and, where immediate, a contact. The third must be at least 3: (b), (c) and (e) all carry an immediate obligation. If it is under 3, you have let something that stops the work sit in a report queue, which is the failure this lab exists to catch.

Notes

(b) contaminates an incident scene and destroys the evidence their responders need; (c) often starts a statutory clock measured in hours; (e) is usually reported to law enforcement rather than the client. (a) and (d) are real findings that wait for the report. Intent is not a defence to unauthorised access, which is why the authorisation letter is the first artifact and not the last.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.