External penetration tests MUST include:

While consultants are often used for penetration tests due to specialized expertise, their use is not a mandatory component for all external penetration tests.

Communicating to end-users is typically avoided in a 'black box' or 'double-blind' test to simulate a real-world scenario more accurately, though it might occur in other testing types.

Penetration tests should generally aim to identify vulnerabilities and exploit them without causing damage, and *modifying* production data is usually explicitly out of scope unless specifically authorized in a test environment.

Penetration tests simulate real attacks and can impact systems, so obtaining explicit, documented advance approval from system owners, business unit leads, and legal counsel is a fundamental ethical and legal requirement before any testing begins. This ensures all parties are aware of the scope, potential impact, and authorization for the activity.