There's only one difference between hacking and penetration testing: PERMISSION.
BEFORE CONDUCTING A PENETRATION TEST :
GET A WRITTEN AGREEMENT BETWEEN YOU AND THE ORGANIZATION
AGREE UPON AN EXACT TIME AND DATE
NOTIFY ALL AFFECTED PERSONNEL
WHO DO I CONTACT FOR MATTERS OF URGENCY?
AFTER CONDUCTING A PENETRATION TEST :
CREATE A WRITTEN REPORT OF FINDINGS
SECURELY SEND THE REPORT TO SENIOR MANAGEMENT