Your ATM document should include the different security tests that you will execute before deploying into production. You need to explain to the project why you're doing the tests and what the necessary details for this task are. For example, you need to specify the environment of the test (Dev, Staging, or Production). Also, will you need credentials for testing? If so, how many? (For example, admin or guest.)