Sample scope of work and rules of engagement: authorised security test
This is a sample for discussion, with blank placeholders. It is not an engagement and gives no authorisation until both parties sign it.
Tester: Mehta Foundry. Client: {legal name, registered address}. Client contact: {name, email, phone}.
1. Authorisation
The Client confirms that it owns, or is authorised to permit testing of, the assets listed in section 2. It authorises the Tester to carry out the activities in section 3 on those assets only, and only during the test window. Any activity outside this document is unauthorised. No scanning, exploitation or active reconnaissance of any kind starts before both signatures below.
2. In scope
| Asset | Identifier | Environment | Notes |
|---|---|---|---|
| Web application | https://app.example-client.test | Staging | Two test accounts (user and admin) provided |
| API | https://api.example-client.test/v1 | Staging | OpenAPI file supplied |
| Mobile app (optional) | Android build {ID} | Test build | Client-owned |
Out of scope:
- anything not listed above
- third-party SaaS without that provider’s written permission
- denial-of-service or load testing
- physical access
- social engineering and phishing, unless listed separately
- destructive payloads
- data extraction beyond a minimal proof of concept
3. Permitted activities
- Passive information gathering on in-scope assets.
- Authenticated and unauthenticated testing against OWASP ASVS and the OWASP API Security Top 10.
- Non-destructive proof of concept to confirm each finding.
4. Rules of engagement
- Window: {start date/time, time zone} to {end}. Rate limit: {max N requests/s}. No-test hours: {…}
- Emergency stop contacts: Client {24h phone/email}; Tester {phone/email}.
- Critical findings: the Tester notifies the Client within 4 hours and pauses that test path if asked.
- Credentials and data: credentials come through {secure channel} and are rotated afterwards. Evidence is stored encrypted and deleted {30} days after the report, unless the Client asks otherwise. Client data is used only for this engagement and is never shared with third parties.
5. Deliverables and timing
- A written report within {5} business days of the end of testing, containing an executive summary, findings rated by severity with steps to reproduce and evidence, and remediation advice.
- A 30-minute walkthrough call.
- One retest of fixed findings within 30 days (included in the Standard and Extended packages).
6. Commercials
| Package | Typical coverage | Fixed fee |
|---|---|---|
| Focused | One web app or API, about 2 testing days | USD 1,500 |
| Standard | Web app and API, about 4 testing days, retest included | USD 3,000 |
| Extended | Web, API and mobile build, about 7 testing days, retest included | USD 5,000 |
Extra work is charged at USD 90/hour and needs prior written approval. Payment terms: 50% on signature, 50% on delivery of the report.
7. Conflict of interest and exclusions
The Tester does not accept defence or government engagements, or any engagement that conflicts with its existing obligations. The Client confirms the systems belong to the Client.
8. Limitations
Testing is point-in-time and does not cover everything. There is no guarantee that every vulnerability will be found. This is not legal advice, compliance certification or an audit (for example SOC 2 or ISO 27001). The Client remains responsible for remediation and for production risk.
Client authorised signatory: Name ________ Title ________ Signature ________ Date ________
Tester (Mehta Foundry): Name ________ Signature ________ Date ________