Penetration Testing Agreement

PENETRATION TESTING AGREEMENT

This Penetration Testing Agreement (the Agreement) is entered into as of by and between Client Name: , with address: (Client), and Service Provider Name: , with address: (Service Provider).

WHEREAS

WHEREAS, Client desires to engage Service Provider to perform authorized penetration testing and related services against Client systems and assets as set forth in this Agreement; and

WHEREAS, Service Provider represents that it possesses the technical skill, experience and necessary personnel to perform such services in a professional manner and in accordance with industry-standard methodologies; and

WHEREAS, the parties wish to set forth the scope, limitations, compensation, reporting, confidentiality, and legal terms governing such engagement.

SCOPE OF WORK

Testing types authorized (check all that apply):

External network testing
Internal network testing
Web application testing
Mobile application testing
Physical/social engineering (if permitted)
Phishing or social-engineering campaigns

Authorized test window: From through . Tests performed outside this window are unauthorized and constitute a breach of this Agreement.

RULES OF ENGAGEMENT

Service Provider will conduct all testing using methods described in the scope of work, will make reasonable efforts to avoid disruption of Client operations, and will immediately cease any action that is reasonably likely to cause material disruption upon notification by Client. Service Provider will not intentionally access, modify, exfiltrate or destroy data except as necessary to demonstrate vulnerabilities as set forth in the scope of work.

PAYMENT TERMS

Client shall pay Service Provider the total fee of $ for the services described herein, subject to the schedule below.

Overdue payments will accrue interest at a rate of per month or the maximum rate permitted by law, whichever is lower. Client is responsible for reasonable collection costs.

DELIVERABLES AND REPORTING

Service Provider will deliver a written report summarizing findings, risk ratings, exploit details, and remediation recommendations within calendar days after completion of testing. The report will be classified as Confidential and will include an executive summary suitable for non-technical stakeholders.

TERM AND TERMINATION

This Agreement commences on Start Date: and, unless earlier terminated pursuant to this Section, will terminate on End Date: .

Either party may terminate this Agreement for convenience upon written notice at least days prior to the desired termination date. Either party may terminate immediately for material breach that remains uncured for a period of days after written notice.

CONFIDENTIALITY

Each party acknowledges that Confidential Information disclosed by the other constitutes proprietary information and agrees to maintain such information in strict confidence and not to use or disclose it except as required to perform under this Agreement. Confidential Information includes vulnerability reports, exploit details, remediation steps, and any non-public system data. Standard exclusions apply to information that is publicly known, rightfully received from a third party, or independently developed.

Confidentiality obligations will survive termination for a period of years, except that Confidential Information constituting trade secrets will be protected for as long as such information remains a trade secret under applicable law.

DATA HANDLING AND DESTRUCTION

Upon request or upon expiration of the retention period, Service Provider will return or securely destroy Client data and confirm destruction in writing.

REPRESENTATIONS, WARRANTIES AND AUTHORIZATION

Client represents and warrants that it is the owner or authorized custodian of the systems to be tested and has full authority to request testing and to grant the access and permissions described in this Agreement. Client will provide any required written authorization to third-party owners where necessary to permit testing.

Service Provider represents and warrants that it will perform services with reasonable care and skill in accordance with prevailing industry standards, and that personnel performing testing have been authorized to perform such tasks.

LIMITATION OF LIABILITY AND INDEMNIFICATION

Except for willful misconduct or gross negligence, neither party will be liable to the other for incidental, consequential, punitive, or special damages. Service Provider's aggregate liability for any claim arising from or relating to this Agreement will not exceed the total fees paid by Client under this Agreement for the applicable engagement.

Client agrees to indemnify and hold harmless Service Provider from claims, liabilities, and costs arising from Client's breach of representations or from unauthorized modifications to systems by Client or third parties.

INSURANCE

Service Provider will maintain commercially reasonable liability and errors & omissions insurance and will provide evidence of such coverage upon Client request. Minimum coverage amounts and additional insured status may be specified here:

GOVERNING LAW; DISPUTE RESOLUTION

This Agreement will be governed by and construed in accordance with the laws of the State of without regard to its conflict of law principles. The parties will attempt in good faith to resolve disputes promptly by negotiation between senior executives.

ENTIRE AGREEMENT

This Agreement, together with any attachments and the Scope of Work, constitutes the entire agreement between the parties relating to the subject matter hereof and supersedes all prior agreements and understandings. Any amendment or modification must be in writing and signed by authorized representatives of both parties.

MISCELLANEOUS

If any provision of this Agreement is held invalid, the remainder of this Agreement will continue in full force and effect. Neither party may assign this Agreement without the prior written consent of the other, except to an affiliate or in connection with a merger or sale of substantially all assets.

Sign Now