Direct answer
Identify who owns and operates every component affected by the proposed test, then obtain the permissions required for the specific activity. A customer's permission to test its application does not automatically authorize testing another customer's shared infrastructure.
Map each operational boundary
For a SaaS application, list the application, cloud accounts, identity provider, payment processor and email service. Record who controls each environment and which calls or data flows could be exercised during a test. An integration used by your application may belong to a separate organization.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Review applicable provider rules
Ask the service owner to check the current provider testing policy, contracts and any notification or approval requirements. Provider rules vary by product and can change. A general policy that permits testing a service does not expand the customer's scope to other tenants.
- Name the in-scope customer account and environment.
- List excluded provider services and neighboring assets.
- Agree how test payments, emails and external callbacks are handled.
Design a bounded test
Use a vendor sandbox or test mode for transactions when available and agreed. For a payment workflow, specify whether a test may create a test charge, whether refunds are permitted and who will watch for unexpected production activity. Keep a stop contact for each relevant party.
Reference: NIST SP 800-115: Technical Guide to Information Security Testing and Assessment.
Handle discoveries
If a test reveals an apparent issue outside the agreed application or a third-party asset appears in the path, stop the affected activity and notify the engagement owner. Do not actively verify an out-of-scope issue without the proper authorization and a revised plan.
Assessment limits
This planning process does not substitute for provider agreements or legal advice. Shared infrastructure and delegated operations can make authorization more complex than a domain ownership check.
Frequently asked questions
Does owning a domain authorize testing its cloud provider?
No. Specify the customer's assets, permitted methods and relevant provider conditions; shared infrastructure and other tenants are separate.
Can test emails be sent to real customers?
Use agreed test recipients and controls. Real recipient contact requires explicit scope and an appropriate operational process.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.