Standards note
What a penetration testing contract should contain
A penetration testing contract is what turns an attack into a lawful assessment. So the paperwork is not a formality: it defines who may test what, when, and what happens to the evidence afterwards.
- Written scope and rules of engagement
- PTES, OWASP and NIST SP 800-115
- Nothing retained after close
Why the penetration testing contract comes first
Computer misuse laws in the US and the UK turn on authorisation. Therefore the system owner's written permission is the legal basis for every test. Without it, the same activity is an offence, however good the intentions.
That is also why we sign your non-disclosure agreement before any technical discussion. As a result, nothing sensitive is shared before the boundary exists.
The documents inside a penetration testing contract
Most engagements rest on four documents. Each one answers a different question.
| Document | Question it answers |
|---|---|
| Authorisation | Who owns the systems, and who permits the test? |
| Scope of work | Which systems are in, and which are out? |
| Rules of engagement | Which techniques, windows and contacts apply? |
| Confidentiality | How is information protected and destroyed? |
Check your penetration testing contract
Tick each clause your draft already contains.
Your result appears here as you tick, so you can see what is still open.
Penetration testing contract clauses buyers often miss
Some terms only matter when something unexpected happens. So it pays to agree them in advance.
- Third-party approval where a host or cloud provider requires it
- An escalation path if a critical issue is found mid-test
- What happens if testing affects availability
- How evidence moves, and when it is destroyed
- Whether a retest is included, and within what window
How the standards shape the contract
The pre-engagement phase of the Penetration Testing Execution Standard covers exactly these points: scope, goals, communication and limits. Likewise, NIST SP 800-115 treats planning and rules of engagement as part of the assessment itself. So a well-drafted penetration testing contract is the first deliverable, not a preliminary.
Fees written into the contract
Full engagements usually settle between $35,000 and $120,000, and the floor is $25,000. The bounded Security Posture Assessment starts at $4,500. Its fee is credited in full against a full engagement commissioned within ninety days. The fee is fixed in the contract, so there are no change orders mid-project.
Penetration testing contract questions
Who must sign the penetration testing contract?
Someone with authority over the systems in scope. Where a third party hosts them, their policy may also apply.
Can a penetration testing contract cover systems we do not own?
No. Only the owner, or someone the owner authorises in writing, can permit testing.
Is a statement of work enough?
Usually not on its own. Authorisation and rules of engagement should be explicit as well.
Do you sign our template?
Often, yes. We review it against the clauses above and suggest additions where needed.
Related guides
Start with a written scope
Send a short description of the estate. We reply with a draft scope and rules of engagement, and the fee is fixed in the penetration testing contract before anything is tested.
Request a written scope