Is an electronic signature valid here?

Yes. Electronic signatures are enforceable under the federal ESIGN Act (15 U.S.C. ch. 96) and state UETA laws when intent, consent, attribution, and retention are documented.

Do testers need written authorization?

Yes. Written authorization signed by an authorized representative documents legal permission and reduces the risk of unauthorized access claims during or after testing.

What if the scope changes during testing?

Stop activities beyond the original scope, record the request, obtain amended written authorization, and document consent before proceeding to avoid legal and contractual exposure.

When is notarization or RON required?

Not typically required for standard penetration test authorizations; verify state or contract-specific clauses and use RON only if a jurisdiction or counterparty explicitly requires notarized consent.

How should evidence be stored?

Keep logs, timestamps, and screenshots in tamper-evident storage with restricted access and an audit trail to support remediation and any regulatory review.

Can I correct a signed document?

Amendments should be documented with a written amendment signed by the same authorized parties or executed as a new authorization to preserve chain-of-custody and intent.

Electronic Signature
Templates
Miscellaneous
Penetration Testing Document

Penetration Testing Document

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

PENETRATION TESTING DOCUMENT

This Penetration Testing Agreement (the "Agreement") is made effective as of Month Day Year (the "Effective Date"), by and between Client Name: (the "Client") and Provider Name: (the "Provider").

WHEREAS

WHEREAS, the Provider represents that it has the technical skill, experience and capacity to perform penetration testing and related security assessment services in accordance with recognized industry standards; and

WHEREAS, the Client desires to retain the Provider to perform penetration testing of certain systems, applications and infrastructure as set forth herein, and the Provider agrees to perform such services pursuant to the terms and conditions of this Agreement; and

WHEREAS, the parties intend that this engagement be conducted under defined rules of engagement to minimize business disruption and to preserve the confidentiality and integrity of Client data.

PARTY INFORMATION

Client Legal Entity Client Address Primary Client Contact Provider Legal Entity Provider Address Primary Provider Contact

SCOPE OF WORK

Provider shall perform penetration testing services as described below. Testing shall be limited to systems expressly identified as in-scope and shall be conducted pursuant to the Rules of Engagement set forth in this Agreement. Provider shall exercise reasonable professional care to avoid material disruption to Client operations.

Detailed Scope of Work Systems and Assets In Scope (list hosts, IP ranges, applications) Systems Excluded from Testing

TESTING TYPE AND METHODS

The Provider will perform the testing types selected below. Provider shall not perform any additional testing techniques not listed without prior written authorization from Client.

Testing Types (check all that apply)

External network penetration testing Internal network penetration testing Web application testing Mobile application testing Social engineering (phishing, pretext) — requires explicit authorization Cloud environment testing

RULES OF ENGAGEMENT

Provider shall adhere to the following Rules of Engagement. Any deviation requires prior written approval from Client.

Authorized testing window start: Month Day Year ; end: Month Day Year .

DELIVERABLES

Provider shall deliver the following items to Client within the timeline specified in Payment Terms and Deliverables below.

Executive summary for leadership Detailed technical report with findings and exploitation evidence Vulnerability inventory with risk ratings and remediation guidance Retest of remediated findings (if selected)

Additional Deliverable Notes

PAYMENT TERMS

Client shall pay Provider the fees for the services described in this Agreement in accordance with the following terms.

Total Fee Amount Payment Schedule Late Payment Fee

TERM AND TERMINATION

This Agreement commences on the Effective Date and continues until completion of the services described herein or until terminated in accordance with this Section.

Term Start: Month Day Year .

Term End: Month Day Year .

Termination Notice Period (days)

Either party may terminate this Agreement for material breach if the breaching party fails to cure the breach within the notice period set forth above. Payment obligations for services performed through the effective date of termination shall survive termination.

CONFIDENTIALITY

Each party acknowledges that, in connection with the performance of this Agreement, it may receive or have access to Confidential Information of the other party. "Confidential Information" means non-public information that the disclosing party designates as confidential or that, given the nature of the information, a reasonable person would understand to be confidential.

The receiving party shall: (a) use Confidential Information only to perform its obligations under this Agreement; (b) restrict disclosure to those employees, contractors or agents with a need to know and under obligations of confidentiality no less protective than those herein; and (c) implement reasonable technical and organizational measures to protect Confidential Information. Confidential Information does not include information that is publicly available through no breach of this Agreement, independently developed without use of Confidential Information, or rightfully obtained from a third party without restriction.

DATA HANDLING AND REPORTING

Provider shall safeguard any Client data obtained during testing using industry-standard encryption and access controls. Provider shall not retain raw sensitive data beyond the retention period specified below and shall securely delete or return data at Client's direction upon completion.

Data Retention Period (days)

Reports will be delivered in electronic form to the Client contacts identified above. Reports shall include an executive summary and a technical appendix describing discovered vulnerabilities, risk ratings, impact, and recommended remediation steps.

LIMITATION OF LIABILITY & INDEMNIFICATION

Provider shall indemnify and hold Client harmless from third-party claims arising from Provider's gross negligence or willful misconduct in performing the services. Client shall indemnify and hold Provider harmless from claims arising from Client's provision of false or misleading information, or Client-directed activities outside the agreed scope.

Except for liability arising from gross negligence, willful misconduct, or indemnified third-party claims, each party's aggregate liability under this Agreement shall not exceed the total fees paid by Client to Provider under this Agreement. Neither party shall be liable for incidental, special, punitive or consequential damages.

Liability Cap Amount

INSURANCE

Provider shall maintain professional liability and cyber liability insurance in commercially reasonable amounts during the term of this Agreement and shall provide evidence of such insurance upon Client request.

Minimum Insurance Coverage (per occurrence)

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the state or jurisdiction indicated below, without regard to conflict of law principles.

Governing Law (State or Jurisdiction)

ENTIRE AGREEMENT

This Agreement, including any exhibits, schedules and attachments expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter hereof and supersedes all prior and contemporaneous agreements, understandings and negotiations, whether written or oral. No amendment or modification shall be effective unless in writing and signed by authorized representatives of both parties.

MISCELLANEOUS

Notices under this Agreement shall be in writing and delivered to the addresses specified above or to such other address as either party designates in writing. If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

Client Printed Name:

By:

Date:

Provider Printed Name:

By:

Date:

What a Penetration Testing Document Is

A Penetration Testing Document is a formal, written record that defines the scope, objectives, rules of engagement, and deliverables for an authorized security test of an information system. It documents parties, systems in-scope and out-of-scope, acceptable testing hours, escalation contacts, authorization signatures, and evidence requirements such as logs and screenshots. The document creates a legal and operational basis for the test, reduces ambiguity about permitted activities, and supports post-test remediation and contract compliance. It is used by internal security teams, third-party testers, and procurement or legal departments.

Why a Clear Penetration Testing Document Matters

A precise document reduces legal and operational risk by establishing written authorization, explicit scope, and evidence standards; it aligns stakeholders on testing limits and remediation expectations while supporting regulatory compliance such as audit records under ESIGN/UETA requirements.

Who Typically Prepares or Signs This Document

The Penetration Testing Document is completed by technical, legal, and compliance stakeholders before testing begins.

Information security teams and internal IT: define scope, provide access, and approve testing windows.
Third-party penetration testers or MSSPs: accept rules of engagement and confirm evidence collection methods.
Compliance, legal, and procurement: confirm authorization, contract terms, and liability allocations.

Multiple signatories — technical lead, an authorized executive, and the testing vendor — typically sign to document consent and accountability.

Stepwise Completion Checklist

Follow these sequential steps to prepare a complete, enforceable penetration testing authorization.

01

1. Gather Stakeholders: Identify technical, legal, and business approvers.
02

2. Define Scope: List in-scope targets and exclusions.
03

3. Draft ROE: Specify allowed tests and prohibited actions.
04

4. Obtain Signatures: Collect authorized eSignatures with audit trail.

How Authorization and Signing Typically Flow

A typical authorization workflow moves from drafting to technical review, legal approval, signature capture, and secure distribution.

Draft: Author creates document and fields.
Review: Technical and legal reviewers confirm scope.
Sign: Authorized parties sign electronically.
Archive: Store signed copy with audit trail.

Basic Digital Workflow Settings

Configure these workflow settings to capture valid electronic consent and maintain an audit trail.

Field	Configuration
Authentication	Email + optional SMS code
Field Types	Signature, initials, date, checkbox
Routing Order	Sequential or parallel signer order
Retention Policy	Enable audit trail storage and export

Digital Signing and Integration Considerations

Select platform settings that preserve evidence, support required authentication, and integrate with your systems.

Authentication Options: Email, SMS, KBA, SSO
File Formats: PDF, DOCX, HTML, Excel
Integrations: Salesforce, NetSuite, Google Workspace

Ensure the chosen provider supports required compliance features such as audit trails, encryption, and a BAA if HIPAA data is involved.

Essential Components of a Professional Penetration Testing Document

Include these six core elements to ensure clarity, legal authorization, and actionable results from the testing engagement.

Scope Summary

Concise list of IP ranges, hostnames, applications, and environments that are explicitly in scope for the test and those excluded.

Objectives

Specific goals such as vulnerability discovery, privilege escalation testing, or web application exploitation, tied to acceptance criteria.

Rules of Engagement

Prohibited actions, safe testing hours, interaction with live systems, and constraints on data exfiltration or destructive techniques.

Authorization and Liability

Signed authorization statements, insurance or indemnity clauses, and contact points for legal or operational escalation.

Evidence and Reporting

Required evidence artifacts, report format, vulnerability severity classifications, and timelines for draft and final reports.

Remediation and Retest

Expected remediation windows, verification testing approach, and benchmarks for accepting fixes as complete.

Security and Compliance Checkpoints

Encryption: TLS 1.2/1.3; AES-256 at rest

Audit Trail: IP, timestamp, action log

Access Controls: Role-based access only

BAA Available: Required for HIPAA

21 CFR Support: Compliant options exist

Data Residency: Specify storage region

Risks and Potential Consequences of an Incomplete Document

Unauthorized Testing: Legal exposure

Breach Fines: Regulatory penalties

Invalid Evidence: Disallowed in audits

Contract Liability: Indemnity claims

Operational Impact: Service disruption risk

Reputational Harm: Customer trust loss

Common Preparation Pitfalls to Avoid

Unclear scope that lets testers target critical production systems by mistake, causing outages and liability.
Missing explicit written authorization from an authorized signatory, which can make testing unauthorized under law.
Insufficient evidence instructions that leave reports without verifiable logs or timestamps for compliance audits.
Failure to document communication and escalation procedures for unexpected system instability or discovered breaches.

Typical Timelines and Delivery Expectations

Plan scheduling and delivery milestones to coordinate testing, reporting, and remediation without disrupting operations.

Scheduling Window:

Agree on exact start/end dates before testing begins.

Test Duration:

Define expected hours or days for active testing.

Draft Report:

Deliver initial findings within typical 7–14 days.

Remediation Window:

Set a 30–90 day remediation target depending on severity.

Retest Deadline:

Schedule verification testing after fixes are applied.

eSignature Pricing and Feature Comparison

High-level pricing and feature differences for common eSignature options; signNow is listed first per platform comparison guidance.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently Asked Questions and Troubleshooting

Answers to common questions about authorization, electronic signing, and evidence preservation for penetration tests.

Need help? Contact support

Is an electronic signature valid here?
Yes. Electronic signatures are enforceable under the federal ESIGN Act (15 U.S.C. ch. 96) and state UETA laws when intent, consent, attribution, and retention are documented.
Do testers need written authorization?
Yes. Written authorization signed by an authorized representative documents legal permission and reduces the risk of unauthorized access claims during or after testing.
What if the scope changes during testing?
Stop activities beyond the original scope, record the request, obtain amended written authorization, and document consent before proceeding to avoid legal and contractual exposure.
When is notarization or RON required?
Not typically required for standard penetration test authorizations; verify state or contract-specific clauses and use RON only if a jurisdiction or counterparty explicitly requires notarized consent.
How should evidence be stored?
Keep logs, timestamps, and screenshots in tamper-evident storage with restricted access and an audit trail to support remediation and any regulatory review.
Can I correct a signed document?
Amendments should be documented with a written amendment signed by the same authorized parties or executed as a new authorization to preserve chain-of-custody and intent.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now