---
sourceDocument: Brazil Security Management
sourceDocumentLink: https://www.servicenow.com/docs/r/security-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Configure assessment types

# Configure assessment types for penetration testing {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Configure the estimated effort for each type of penetration testing assessment. This enables you to manage the capacity of each sprint, by estimating the effort required for each assessment type.

## Before you begin

Role required: Ethical Hacking

## About this task

Each sprint is assigned to a penetration testing request. Based on the estimated effort for the assessment type, the hours are adjusted to reflect the balance hours for the sprint.

## Procedure

1. Navigate to AllApplication Vulnerability ResponseAdministrationPenetration Testing Configuration.
2. Select Configure for Configure effort estimation to display Assessment types, Application size, and Estimated effort (hrs).
3. **Optional:** Select a record to open it from the Assessment type column and update the fields.  
   Alternatively, select New to create records.

   The Application size values provide you with more options to help estimate test time and effort more accurately. You can edit the hours for these records or select New to create your own
   combinations.

   You can modify Assessment type and Application size values on existing penetration testing request records so that you can schedule tests to match sprint capacity. For example, if you fill out a test request, you might not
   see the number of sprints you configured, because some sprints are already taken for testing. If a sprint's estimated effort hours match the combination required for a test's type and size, they aren't available for new
   requests.

   You can see the sprints that are assigned to test requests on records on the Penetration Testing Sprints list at AllApplication Vulnerability ResponseAdministrationPenetration Testing ConfigurationConfigure sprints. See [Configure sprints for penetration testing](https://www.servicenow.com/docs/bz~NDWyHnEvIuZmctYgqYg "Configure the sprint duration and capacity for the ethical hacking team so they can manage the sprint capacity for penetration test assessments.") for more information on configuring sprints.

   The base values for Assessment type, Application size, and Estimated effort are listed in the following table:
   {#pen-test-config-assessment-types__table_vmy_1sb_2yb__entry__3}

   | Assessment type | Application size | Estimated effort (hrs) |
   |-|-|-|
   | Focused Test | Small | 20 |
   | Focused Test | Medium | 30 |
   | Focused Test | Large | 40 |
   | Focused Test | Standard | 40 |
   | Re-Test | Small | 10 |
   | Re-Test | Medium | 15 |
   | Re-Test | Large | 20 |
   | Re-Test | Standard | 20 |
   | Full Penetration Test | Small | 60 |
   | Full Penetration Test | Medium | 70 |
   | Full Penetration Test | Large | 80 |
   | Full Penetration Test | Standard | 80 |
   [Table 1. Penetration testing assessment type configuration form]

   {#pen-test-config-assessment-types__table_vmy_1sb_2yb}
4. Select Update to save your changes to an existing record or Submit to create a record.
5. Save the changes.
{#pen-test-config-assessment-types__steps_u3w_mns_1tb}

*[\>]: and then