Pen Testing Report

PENETRATION TESTING REPORT & ENGAGEMENT AGREEMENT

WHEREAS

WHEREAS, Client Name: (the "Client") desires a security assessment consisting of penetration testing and related reporting; and

WHEREAS, Service Provider: (the "Provider") represents that it has the technical capability and qualifications to perform such testing under the terms set forth herein;

NOW, THEREFORE, the parties agree that Provider will perform penetration testing services and deliver a written report in accordance with the terms and conditions in this agreement and the technical scope described below.

PARTIES & CONTACTS

SCOPE OF WORK

The Provider will perform authorized penetration testing limited to the assets, systems and application components described below and in any attachments. Work will include vulnerability discovery, exploit attempts where safe and authorized by the Client, risk analysis, and remediation recommendations.

TEST OBJECTIVES & METHODOLOGY

Objectives include identification of exploitable vulnerabilities, verification of security controls, demonstration of impact consistent with permitted testing methods, and provision of actionable remediation guidance.

From:    To:

FINDINGS & RISK ASSESSMENT

Findings are categorized by risk and include evidence, likelihood, impact, and reproducible steps where applicable. Each finding below shall be accompanied by recommended remediation.

Severity:    Likelihood:

EVIDENCE & ATTACHMENTS

The Provider will include an evidence summary in the report and may provide separate encrypted attachments for logs and exploit data. All attachments are subject to the confidentiality obligations below.

LIMITATIONS & EXCLUSIONS

The testing is limited to the assets and techniques specified in the scope. Provider will not remediate issues unless explicitly contracted for post-report remediation. Provider will avoid destructive testing except where pre-authorized and agreed in writing.

PAYMENT TERMS

Client shall pay Provider the fees described below in exchange for performance of the services and delivery of the final report. All amounts are due in U.S. dollars unless otherwise agreed in writing.

Interest on overdue amounts at % per month (or the maximum lawful rate), plus reasonable collection costs.

TERM AND TERMINATION

This engagement commences on the Effective Date and continues until completion of deliverables unless earlier terminated as provided below.

Effective Date:    Scheduled Completion Date:

CONFIDENTIALITY

The parties acknowledge that the report and all evidence are Confidential Information. Provider shall not disclose the Report or evidence to third parties except as required by law, as necessary to remediate findings with authorized third parties, or with Client's prior written consent. Client shall not publicly disclose the Report or Provider's proprietary testing methods without Provider's written consent.

Report treated as Confidential:   I acknowledge that the report and attachments are to be handled as Confidential Information under the terms above.

LIMITATION OF LIABILITY

Except for wilful misconduct or gross negligence, Provider's aggregate liability arising from or in connection with this engagement shall not exceed the total fees paid by Client for the services under this agreement. In no event shall Provider be liable for incidental, consequential or punitive damages.

GOVERNING LAW; ENTIRE AGREEMENT

This Agreement shall be governed by the substantive laws of the jurisdiction specified below without regard to conflict of laws principles.

This document, including any attachments and scopes of work referenced herein, constitutes the entire agreement between the parties and supersedes all prior representations, negotiations and agreements, whether written or oral, concerning the subject matter.

REPORT DELIVERY & DISTRIBUTION

CERTIFICATIONS

Provider certifies that the testing team is appropriately authorized and that testing will be conducted only with Client authorization specified in this Agreement. Client certifies that it has the authority to permit testing of the systems identified in the Scope.

By signing below, the parties acknowledge they have read, understand, and agree to be bound by this Penetration Testing Report & Engagement Agreement.

Sign Now