Direct answer
Agree on explicit stop conditions, named contacts and a restart decision before testing. A tester should pause the affected activity when an agreed threshold is reached, preserve the relevant evidence and contact the owner through the agreed route.
Name the people who can act
Record the test lead, system owner, incident response contact and an alternative for each. Include a channel that works outside normal business hours if the engagement covers that period. Agree who is authorized to stop a test and who can approve its restart.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Choose measurable triggers
Examples include unexpected service degradation, reaching an excluded asset, a finding that exposes real customer data, or signs of an unrelated compromise. Use thresholds the operations team can observe, such as a sustained error-rate increase above the owner's normal range, rather than vague language like 'too much traffic'.
- Record the affected target and the current action.
- Define the monitoring owner and communication channel.
- Distinguish pausing one test from stopping the whole engagement.
Practice the escalation
For an API assessment, a tester who sees an unexpected production error should stop the triggering requests, note the time and request identifier, and contact the owner. Do not keep retrying to improve a reproduction while a service incident is unfolding. The operations owner decides how to investigate and restore service.
Reference: NIST SP 800-61 Rev. 3: Incident Response Recommendations.
Document permission to resume
Record the incident outcome, revised rate or excluded path, and the person approving resumption. If the original activity remains unsafe, mark it as not tested rather than treating a pause as a passed check. Add the limitation to the final coverage record.
Assessment limits
Stop conditions reduce operational uncertainty but cannot predict every failure. Testing still needs monitoring, a rollback process and a decision by the system owner.
Frequently asked questions
Can a tester resume after the service recovers?
Only under the agreed approval process. Record the cause, changed conditions and authorized restart before resuming the affected activity.
Is a paused test a passing result?
No. Record what was not completed and why so the owner can decide on follow-up.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.