Which networks, IP ranges, and domains are in scope? - Which applications and APIs will be tested? - Are cloud environments (AWS, Azure, GCP) included? - Is social engineering in scope? Physical testing? - Are third-party systems or shared infrastructure involved?