Get written authorisation before testing a computer system

The Computer Misuse Act 1990 applies across the UK. It makes no exception for good intentions, and it has no defence for security research. What separates a lawful test from an offence is whether the person who controls the system has agreed to what you do.

Know what counts as an offence

Attacking an attacker's systems in return is an offence too, because your access is still unauthorised.

Get authorisation in writing before you start

The authorisation must come from someone entitled to control the system, which means the owner or whoever is responsible for it, not just the IT department. Agree a written plan of action with them that sets out:

• the technical boundaries of the test, such as the IP addresses, domains and applications in scope and any systems that are excluded
• the types of test and methods allowed, for example scanning, manual testing, social engineering or physical access
• the timeframe and the effort involved
• any critical systems that need special handling, or any need for out-of-hours testing
• what the report must contain
• a technical contact who will be reachable at short notice throughout the test, so you can raise critical findings and sort out problems that block you

The Act does not say that consent must be in writing, but a signed record is the only practical proof that you had it. Keep a copy. The National Cyber Security Centre's guidance on penetration testing describes the scoping meeting, which brings together the people who own the risk, the technical staff and the testing team.

Stay within the scope you were given

Authorisation covers only the systems and acts it names. A hosting provider, cloud platform or content delivery network controls its own infrastructure, so testing it needs that provider's consent as well. Check the provider's own rules for security testing first.

If you find a system outside the scope that affects what you are testing, do not touch it. Ask the person who owns the risk to change the scope in writing, which will change the time and cost, or record the exclusion as a limit on the test. That decision is theirs.

Set out the rules if you invite researchers to test your systems

Access outside the limits you give is still unauthorised, so spell the limits out.