Business Pentest Letter

BUSINESS PENTEST LETTER

Date of Letter:

Client Name:    Provider Name:

Client Address:

Provider Address:

RECITALS

WHEREAS, Client seeks to engage Provider to perform authorized security testing, including discovery and exploitation of vulnerabilities, for the purpose of identifying and documenting security weaknesses in Client systems and supporting remediation efforts; and

WHEREAS, Provider represents that it possesses the technical competence, experience, and insurance necessary to conduct penetration testing in a professional manner and in accordance with accepted industry standards, and Client desires to authorize such testing under the terms set forth herein; and

WHEREAS, the parties agree that testing will be conducted only on systems expressly identified in Scope of Work and under conditions designed to minimize interruption to Client operations.

SCOPE OF WORK

External network   Internal network   Web application   Mobile application   Social engineering (if authorized)

PAYMENT TERMS

Total Fee:

Invoice Terms: Payment due within days of invoice.

Late Fee: on overdue amounts.

TERM AND TERMINATION

Commencement Date: . Expected Completion Date: .

Either party may terminate this Letter for material breach if the breaching party fails to cure within days after written notice. Provider may suspend testing immediately if testing materially harms Client operations or if testing falls outside the agreed Scope of Work.

CONFIDENTIALITY & DATA HANDLING

Provider shall treat all information gained in the course of testing as Confidential Information of Client and shall not disclose such information except to persons who have a need to know to perform the services and who are bound by confidentiality obligations at least as protective as this clause. Confidential Information does not include information that is publicly known through no fault of Provider or that Provider is compelled to disclose by lawful order, provided Provider gives Client prompt notice of the order.

Data Handling: Provider will segregate test data, limit retention to the period necessary for reporting and remediation, and securely destroy or return all Client data within days following final report delivery unless otherwise agreed in writing.

REPORTING, REMEDIATION & LIABILITY

Final Report Delivery: Provider will deliver a written technical report summarizing findings, risk ratings, exploitation details, and remediation recommendations within calendar days after completion of testing.

Remediation Period: Client shall have a reasonable period to remediate critical vulnerabilities; Provider will provide reasonable follow-up verification work at rates set forth in the Payment Schedule or as otherwise agreed in writing.

Limitation of Liability: Except for willful misconduct or gross negligence, Provider's aggregate liability under this Letter shall not exceed the total fees paid by Client to Provider under this Letter. Neither party shall be liable for incidental, consequential, or punitive damages.

Indemnification: Each party shall indemnify and hold harmless the other against third-party claims arising from that party's breach of this Letter or negligent acts or omissions in performance.

INSURANCE

GOVERNING LAW; ENTIRE AGREEMENT

Governing Law: This Letter shall be governed by and construed in accordance with the laws of the State of , without regard to conflicts of law principles.

Entire Agreement: This Letter, including the Scope of Work and Payment Terms, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior negotiations and understandings, whether written or oral.

POINTS OF CONTACT

AUTHORIZATION

By signing below, Client authorizes Provider, its employees, contractors and agents to perform the penetration testing described in this Letter within the designated Scope of Work and testing window. Provider shall exercise reasonable care to minimize disruption to Client systems and shall adhere to the terms set forth herein.

Sign Now