Security Penetration Test Template

SECURITY PENETRATION TEST AGREEMENT

This Security Penetration Test Agreement ("Agreement") is entered into between Client Name: and Service Provider Name: . Engagement Title:

WHEREAS

WHEREAS, the Client operates and maintains certain information systems, networks, applications, or physical infrastructure that the Client wishes to have assessed for security vulnerabilities and resiliency;

WHEREAS, the Service Provider is engaged in the business of conducting authorized security assessments and possesses the technical expertise, personnel, and tools necessary to perform penetration testing in a controlled and professional manner;

WHEREAS, the parties desire to set forth the terms, scope, conditions, and responsibilities under which the Service Provider will perform the penetration testing engagement described below.

ENGAGEMENT CONTACTS

SCOPE OF WORK

The Service Provider will perform penetration testing services limited to the assets and scope expressly authorized by the Client below. The Service Provider's work shall be conducted using industry-standard methodologies and in a manner designed to minimize operational impact.

Test Type: External Internal Black-box (no credentials) White-box (source/credentials) Credentialed

Testing Window Start:    End:    Preferred Testing Hours:

DELIVERABLES

The Service Provider shall deliver the following reports and artifacts in electronic format, subject to the Confidentiality provisions below:

Draft Report Delivery (business days):    Final Report Delivery After Client Comments (business days):

PAYMENT TERMS

Client shall compensate Provider in accordance with the following terms:

Payment Due Within:    Late Fee:

All fees are exclusive of taxes and reasonable travel or third-party expenses unless otherwise specified. Client shall reimburse Provider for pre-approved expenses upon submission of receipts.

TERM AND TERMINATION

This Agreement commences on Start Date: and shall continue until End Date: unless earlier terminated as provided herein.

Either party may terminate this Agreement for convenience upon written notice delivered at least days prior to the effective date of termination. Either party may terminate immediately for material breach that remains uncured for a period of 15 days after written notice.

CONFIDENTIALITY

All information, findings, reports, exploit data, and evidence provided by the Service Provider to the Client or discovered during the engagement constitute Confidential Information of the Client. The Service Provider shall: (a) treat such information as strictly confidential; (b) limit access to personnel with a demonstrated need-to-know; (c) implement reasonable administrative, technical, and physical safeguards; and (d) not disclose vulnerabilities or reports to any third party without the Client's prior written consent, except as required by law. Aggregated, non-identifying statistics that do not permit reconstruction of Client-specific vulnerabilities may be disclosed by Provider for internal benchmarking provided no identifying information is revealed.

Exceptions: Confidential Information does not include information that: (i) was already known to the recipient without restriction; (ii) becomes publicly available through no fault of the recipient; or (iii) is rightfully received from a third party without breach of any obligation of confidentiality.

AUTHORIZATION, COMPLIANCE, AND INDEMNITY

The Client represents and warrants that it has the full right and authority to permit testing of the assets identified in this Agreement and that such testing will not violate any applicable law or the rights of any third party. The Client shall indemnify, defend, and hold the Service Provider harmless from any claims, damages, losses, liabilities, or costs arising from the Client's failure to obtain required authorizations from third parties or from unauthorized testing outside the scope defined herein.

The Service Provider will perform testing in accordance with applicable laws, industry standards, and the instructions of the Client, and will not intentionally perform activities designed to destroy or permanently alter production data unless explicitly authorized in writing.

LIMITATION OF LIABILITY AND INSURANCE

To the extent permitted by law, each party's aggregate liability to the other for claims arising out of or related to this Agreement shall not exceed the total fees paid by the Client to the Provider under this Agreement. Neither party shall be liable for consequential, incidental, indirect, punitive, or special damages, including lost profits, even if advised of the possibility of such damages.

Provider shall maintain commercially reasonable liability and professional liability insurance coverage for the duration of the engagement and shall provide insurance details upon Client request.

DATA HANDLING AND EVIDENCE

The Service Provider may collect logs, screenshots, and evidence necessary to document findings. Such evidence will be treated as Confidential Information. Unless otherwise agreed, Provider will retain evidence for a period not to exceed days following final report delivery and will then securely delete or return evidence to the Client.

REMEDIATION TESTING

The parties may agree to a remediation retest to verify mitigation of identified vulnerabilities. Remediation retesting fees and timelines will be agreed in writing; if the retest is restricted to previously identified issues, Provider shall provide reduced scope pricing as agreed in advance.

SUBCONTRACTING AND PERSONNEL

Provider may engage subcontractors to perform portions of the Services provided that Provider remains responsible for the performance and confidentiality obligations of such subcontractors. Provider represents that individuals performing the Services possess appropriate qualifications and will adhere to Client policies reasonably communicated in writing prior to testing.

COMPLIANCE WITH LAW

Each party will comply with applicable laws, regulations, and contractual obligations relating to privacy, data protection, export controls, and computer misuse. Provider will notify Client promptly if testing activities uncover evidence of actual wrongdoing or breach of law.

GOVERNING LAW

This Agreement shall be governed by and construed in accordance with the laws of the State / Jurisdiction: , without regard to conflict of law principles.

ENTIRE AGREEMENT

This Agreement, together with any schedules, exhibits, and attachments expressly incorporated herein, constitutes the entire agreement between the parties with respect to the subject matter and supersedes all prior and contemporaneous agreements, proposals, and communications, whether written or oral. Any amendment or modification must be in writing and signed by authorized representatives of both parties.

MISCELLANEOUS

If any provision of this Agreement is held invalid or unenforceable, the remaining provisions shall continue in full force and effect. Notices under this Agreement shall be delivered to the contact information set forth above and shall be effective upon receipt.

Sign Now