How to prepare for an offensive assessment — CTO checklist

Before you start

1. System owner and escalation contact.

2. RoE: allowed techniques, windows, out-of-scope.

3. Attestation: written authorization.

4. Environments: prod vs staging, test accounts.

5. Success criteria and report format (evidence, not a wishlist).

Assessment without RoE is not an engagement — it is legal risk.