Scope of Work
Precise list of targets, network ranges, applications, and excluded assets; scope boundaries prevent unintended testing outside authorized systems.
A formal offer aligns expectations, limits legal exposure, and documents client authorization to test systems. It clarifies scope, test windows, and responsibilities so operational teams, legal counsel, and external testers share the same constraints and deliverable criteria.
Ensure a single authorized signer and a documented approval chain are named in the offer to prevent ambiguous authorization or scope creep.
Precise list of targets, network ranges, applications, and excluded assets; scope boundaries prevent unintended testing outside authorized systems.
Permitted testing methods, hours of operation, safety controls, and escalation procedures to limit operational impact and avoid service disruption.
Written client authorization identifying the authorized signer, their authority, and the effective period for tests to establish legal permission to probe systems.
High-level description of testing approach (blackbox/graybox/whitebox), tools to be used, and evidence collection standards for reproducible results.
Report formats, timelines for draft and final reports, evidence retention terms, and remediation retest criteria and deadlines.
Pricing, invoicing schedule, liability caps, confidentiality, and any insurance or indemnity provisions that allocate financial risk.
| Field | Configuration |
|---|---|
| Document Template | Use saved SOW template |
| Signer Order | Define sequential signers |
| Authentication | Email plus optional SMS code |
| Notifications | Auto reminders enabled |
Ensure the chosen platform can produce a timestamped certificate of completion and supports retention controls aligned with your compliance obligations.
Offer valid for 30 days from issue unless stated otherwise
Client must accept within the proposal validity period
Testing scheduled within agreed 14–60 day window
Draft report due within 7–14 business days after test
Retest scheduled within 30–90 days per agreement
Offer circulated with scope and fees
Client signs and returns the offer
Active testing within authorized windows
Deliver final report and evidence archive
| Criteria | Pentesting Offer | Vulnerability Assessment |
|---|---|---|
| Authorization Required | ||
| Testing Depth | full‑scope exploitative | discovery and scanning |
| Deliverable Detail | narrative with exploit proof | scan list with severity |
| Frequency | ad hoc or scoped | regular scheduled |
Their teams needed straightforward document workflows for security approvals
Security and compliance were deciding factors for vendor selection
| signNow | DocuSign | Adobe Sign | PandaDoc | HelloSign | |
|---|---|---|---|---|---|
| Starting Price | $8/user/mo | $15/user/mo | $14/user/mo | $19/user/mo | $15/user/mo |
| Free Trial | 7‑day free trial | Varies | Varies | Varies | Varies |
| Bulk Send | Yes (Business Premium) | Yes | Yes | Yes | Yes |
| Audit Trail | Yes | Yes | Yes | Yes | Yes |
| HIPAA Compliant | Yes | Yes | Yes | Varies | Varies |