thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Authorization Letter

Written permission from an asset owner allowing testers to attack specified systems, sometimes called a get-out-of-jail-free letter.

Definition

Without written authorization, penetration testing activities can violate computer misuse laws such as the US CFAA or UK Computer Misuse Act. The letter must be signed by someone with authority over the assets, and third-party assets (cloud, hosting, SaaS) may need separate permission from those providers. Testers often carry a copy during physical engagements.

Example

A physical pen tester presents a signed letter from the CISO when stopped by building security.

Exam tip

If the client does not own a target (e.g., a hosting provider's shared server), the correct answer is to obtain the third party's permission or exclude it.

Related terms