The ethical hacking project comprises three phases, summarized as follows:

1. Preparation: In this phase, a formal contract that contains a non-disclosure clause as well as a legal clause to protect the ethical hacker against any prosecution that he may face during the conduct phase is signed. The contract also outlines the infrastructure perimeter, evaluation activities, time schedules, and resources available to the ethical hacker.
2. Conduct: In this phase, the evaluation technical report is prepared based on testing potential vulnerabilities.
3. Conclusion: In this phase, the results of the evaluation is communicated to the organization and corrective action is taken if needed.