Written authorization from someone with legal authority to approve testing - Identification of the authorizing individual (name, title, contact information) - Scope of authorization (which systems, networks, applications) - Date range of authorization - Explicit statement that the tester is authoriz