Cybersecurity Penetration Test Proposal

Cybersecurity Penetration Test Proposal

This Proposal is entered into between Provider Name: and Client Name: (each a "Party" and collectively the "Parties"). Effective Date: .

WHEREAS

WHEREAS, Client seeks to engage Provider to perform authorized penetration testing and associated services in order to identify, validate and document security vulnerabilities in Client systems and applications; and

WHEREAS, Provider represents that it possesses the technical expertise, personnel, tools and insurance necessary to perform the services described in this Proposal in a professional manner and in accordance with industry standard methodologies; and

WHEREAS, the Parties desire to set forth the scope, compensation, schedules, confidentiality and other terms governing the performance of the work described herein.

Scope of Work

Test Types (select all that apply):

External network penetration test
Internal network penetration test
Web application penetration test
Mobile application penetration test
Social engineering / phishing (authorized)
Cloud environment assessment

Test Period: Start Date: End Date: Estimated Effort (hours):

Deliverables and Reporting

Reporting will include an executive summary, detailed findings with risk ratings, proof-of-concept where applicable, remediation guidance, and a prioritized remediation roadmap. A retest of verified findings is included for corrected issues within days following Client notification of remediation.

Payment Terms

Deposit required (if any): Balance due within days of invoice.

Late Payment: Unpaid amounts shall accrue interest at % per month, beginning after a grace period of days from invoice date. Client is responsible for all collection costs, including reasonable attorneys' fees.

Term and Termination

Term: The services described herein shall commence on and shall terminate on unless earlier terminated in accordance with this Proposal.

Termination: Either Party may terminate for cause upon written notice if the other Party materially breaches this Proposal and fails to cure such breach within days after receipt of written notice specifying the breach. Either Party may terminate for convenience upon days' prior written notice. Upon termination, Client shall pay for work performed through the effective date of termination and any non-cancellable third-party costs incurred by Provider.

Confidentiality

Each Party agrees to maintain the confidentiality of Confidential Information disclosed by the other Party. "Confidential Information" includes test results, vulnerability reports, detailed exploit notes, source code and any non-public technical or business information disclosed in connection with this Proposal, but excludes information that is demonstrably (i) publicly known through no fault of the receiving Party, (ii) already in the receiving Party's lawful possession prior to disclosure, or (iii) required to be disclosed by law or court order provided the disclosing Party is given prompt notice and opportunity to seek protective relief. Provider will not disclose vulnerability details to third parties except as required for remediation or legal process and will redact sensitive exploit steps from any public summary.

Upon request or termination, Provider shall return or securely destroy Client Confidential Information and all copies within days, except as required for Provider's internal recordkeeping consistent with applicable law.

Legal and Risk Allocation

Client represents and warrants that it has full authority to authorize testing on the systems and assets listed in the Scope of Work and agrees to obtain all necessary consents from third parties in advance. Client will provide Provider with an up-to-date list of in-scope assets and any environmental constraints prior to testing.

Provider will perform services using generally accepted industry methods; however, security testing involves inherent risks including potential service disruption. Provider shall use reasonable care to minimize impact, but Client acknowledges and accepts the risk of incidental disruption. Provider disclaims any liability for loss of data or interruption of services resulting from Client systems that are not maintained according to industry practices or that contain undocumented dependencies.

Limitation of Liability: Except for willful misconduct or gross negligence, each Party's aggregate liability for direct damages arising out of or related to this Proposal shall not exceed the total amount paid by Client to Provider under this Proposal. In no event shall either Party be liable for indirect, incidental, consequential, special or punitive damages.

Indemnification: Client shall indemnify, defend and hold harmless Provider from claims arising from Client's failure to obtain requisite authorizations or from Client's systems or data, except to the extent caused by Provider's gross negligence or willful misconduct. Provider shall indemnify Client for claims arising from Provider's gross negligence or willful misconduct in performing services.

Compliance, Insurance, and Subcontracting

Provider represents that it maintains commercially reasonable liability and professional liability insurance and will, upon request, provide evidence of insurance coverage to Client. Provider may engage qualified subcontractors to perform all or part of the services provided that Provider remains responsible for performance under this Proposal.

Governing Law

This Proposal shall be governed by and construed in accordance with the laws of the State of , without regard to its choice-of-law principles.

Entire Agreement

This Proposal, together with any accepted Statement of Work and attachments executed by the Parties, constitutes the entire agreement between the Parties with respect to the subject matter and supersedes all prior proposals, negotiations, representations or agreements, whether written or oral. Any amendment must be in writing and executed by authorized representatives of both Parties.

Acceptance and Authorization

By signing below, Client authorizes Provider to perform the testing described in this Proposal during the Test Period. Client further acknowledges that it has reviewed the Scope of Work, Testing Constraints, and Risk Allocation and agrees to the terms set forth herein.

Sign Now