Security Intrusion Test Request

Security Intrusion Test Request

Parties

Client Name:

Provider Name:

Recitals

WHEREAS, Client requires an assessment of its information systems and infrastructure to identify potential security weaknesses and to validate controls through controlled intrusion testing; and

WHEREAS, Provider represents that it has the experience, personnel, and technical capability to perform controlled security intrusion testing in accordance with the parameters set forth in this Request; and

WHEREAS, the parties desire to define the scope, timing, payment, and legal terms governing the requested testing engagement.

Request Details

Scope of Work

The Provider shall perform the intrusion testing services described below. The parties agree that tests will be performed only against systems and assets explicitly listed as targets and during the agreed test window. Provider will refrain from actions that are outside the authorized scope and will immediately cease any activity upon receiving a written stop order from Client.

Payment Terms

Client shall pay Provider for services as set forth below. All monetary amounts are stated in U.S. dollars unless otherwise specified.

Term and Termination

This Request commences on the Start Date and continues until the completion of the Services or the End Date specified below unless earlier terminated in accordance with this section.

Start Date:   End Date:

Either party may terminate this engagement for material breach that is not cured within days' written notice. Termination does not relieve Client of payment obligations for work performed prior to termination.

Confidentiality

Provider will treat all non-public information obtained from Client in the course of the engagement as Confidential Information. Provider will not disclose such information except to personnel and subcontractors who have a need to know and who are bound by confidentiality obligations at least as protective as those herein. Client and Provider will implement reasonable technical and organizational measures to protect Confidential Information. Test findings, exploit details, and vulnerability data shall be disclosed only to Client and its authorized representatives unless otherwise required by law, in which case notification to the other party will be provided to the extent permitted.

Liability, Indemnification, and Risk

Client acknowledges that intrusion testing carries inherent risk of service disruption. Client authorizes Provider to perform the authorized tests and accepts responsibility for obtaining any third-party consents necessary to permit testing. Provider will exercise commercially reasonable care to avoid unnecessary disruption. Provider's liability for direct damages arising from Provider's gross negligence or willful misconduct is limited to the total fees paid under this Request. Neither party will be liable for indirect, incidental, consequential, special, or punitive damages. Client shall indemnify and hold Provider harmless from claims arising from Client's failure to obtain required consents or incorrect target listings.

Data Handling and Retention

Provider will retain logs, exploit artifacts, and copies of Client data only for the period necessary to complete deliverables and for no longer than days, except as required by law. Upon Client request or upon expiration of the retention period, Provider will securely destroy or return such data and provide certification of destruction when requested.

Governing Law; Entire Agreement

This Request shall be governed by and construed in accordance with the laws of the state specified below. Any legal action relating to this Request shall be brought in the state and federal courts located in that jurisdiction.

Governing State:

This Request, together with any incorporated attachments, exhibits, and the parties' written agreements referenced herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior representations, negotiations, and agreements, whether written or oral.

Representations and Authorization

By submitting and signing this Request, Client represents that it is the owner or authorized representative of the systems and assets identified herein and that it has obtained all necessary consents to permit the Provider to conduct authorized testing. Provider represents that it will conduct testing in a professional manner in accordance with industry standard methodologies.

Additional Terms or Special Instructions:

By signing below, the undersigned authorized representatives of each party acknowledge and agree to the terms set forth in this Security Intrusion Test Request and certify that the information provided is true and accurate.

Sign Now