Check whether vulnerability assessment and penetration testing practices cover scope, attack surface, web, API, cloud, mobile, reporting, and retesting.

Is the VAPT scope formally approved with in-scope assets, exclusions, test windows, and rules of engagement?

The scope should cover IPs, domains, applications, APIs, cloud accounts, mobile apps, and business constraints.