Checklists and Runbooks for Every Phase of a Pentest

Checklists track which checks a phase has covered; runbooks hold a procedure as ordered steps. Both are templates you attach to the phases of an engagement, where your testers work through them. They live in Settings, Checklists & Runbooks, and the module is on for every new firm.

Start from the curated library

The Curated library holds one template for each default type of phase. Each is a coverage checklist: every item names a check or a stage, says what done looks like, and links to the published methodology behind it.

Import copies a template into your own list (Import all takes every one left), where you can edit it freely without affecting the source. It is opt-in, and each copy can be deleted at any time. A phase of one of these types is offered its template even before you have imported it.

Make your own

+ New template, under Your templates, opens the editor. Choose Checklist (tickable items) or Runbook (step-by-step), then give it a name, a description and a Phase hint, which makes it suggested on phases of that type. Two switches follow: Visible to clients, and Record who/when on tick (audit trail). Items, or steps, are added, moved up and down and removed in place, each with a title, a description and a reference link. Edit, Duplicate and Delete sit beside each template in the list.

On an engagement

Each phase shows its Checklists & Runbooks below its findings. Where the curated template for the phase’s type is not attached yet, the phase offers it as Suggested for this phase, with Add; + Attach a checklist or runbook... lists your own templates, with the ones whose phase hint matches marked [phase match] and listed first.

Open a template on the phase and your testers tick its items, one by one or with Tick all and Clear all, and its progress shows in its header. With the audit trail on, each tick says who ticked it and when. Detach takes a template off the phase. The ticks belong to that engagement’s phase, so the same template can be half done on one engagement and finished on another.

What the client sees

A template marked Visible to clients shows on the client’s view of the phases it is attached to, with its progress and each item’s tick, which they can read but not change. Leave it unmarked and it stays with your team: your database does not let a client login read it at all. What your clients see covers the rest of their portal.

Import and export

Import and export, beside + New template, moves templates in and out of Pental. Export writes the ones you tick as an Excel workbook, a Word document laid out by your layout, or a JSON file that keeps everything exactly. Import reads any of the three in the shape they are written: a template whose name and type are already in Pental is updated, and its items keep the ticks made on engagements; the rest are added. What will change is shown before anything is saved, and nothing is saved until you press Import.

To fill in gives you a start outside Pental: a workbook with its columns ready and an example of each, a Word document with a blank checklist and runbook, or an example JSON file. Under Word layout, Download the layout, restyle it in Word (fonts, colours, a cover, your header) and an administrator or a senior puts it back with Upload a layout, so exports and the document to fill in come out in your style. Keep its placeholders as they are, and Use the built-in layout goes back.

Switching it off

Untick Enable Checklists & Runbooks at the top of the tab, or the module in Settings, Feature Modules. The per-phase checklist dropdowns and tester panels are then hidden everywhere, and your templates remain saved. A checklist is a record of coverage; what was tested still belongs in the report’s methodology and scope, and the platform overview shows where both sit in an engagement.