When engaging an external party to perform a penetration test, it is MOST important to:

While an asset inventory is helpful, the scope dictates *which* assets from the inventory are relevant for the test, making scope definition primary.

Notifying employees is a consideration (especially for social engineering), but it's secondary to defining what the testers are allowed to do. In some tests, employees are intentionally *not* notified.

Clearly defining the project scope, including specific targets, permitted methodologies, timing, and out-of-scope assets, is paramount to ensure the penetration test focuses on the intended areas, remains within legal and ethical boundaries, and yields relevant results. A well-defined scope prevents scope creep, unauthorized activities, and potential disruption to critical systems.

Network documentation can be provided as part of the test (e.g., white-box testing), but the decision to provide it and the extent to which it's used is determined by the overall scope.