Final answer:
When drafting a report post penetration testing, it's crucial to state the standards or guidelines used such as PCI DSS, NIST, or ISO/IEC 27001 early in the document to provide context for the testing framework.
Step-by-step explanation:
When creating your written report of findings after completing a penetration test, it is essential to identify the standard or guidelines you used to conduct the test in the opening sections of the report. This establishes the framework and context in which the penetration testing activities were performed and ensures that the findings are interpreted correctly by the report's readers. Common standards include the PCI DSS for payment card industry, NIST guidelines for federal information systems, and ISO/IEC 27001 for information security management. By mentioning the standards or guidelines early in the report, you set a professional tone and demonstrate compliance with industry best practices.