Sample document
Authorization and scope of work
One page. Signed by someone with authority to bind the asset owner. Without it, testing a server you do not own is unauthorized access — and “we were only verifying a patch level” is not a defense.
Template — not a contract until completed and signed by both parties.
- Asset owner (Client)
- Tester
- Luis Angel Garcia, luisangelgarcia.com
- Effective window
- From ______________ to ______________ (maximum 30 days)
1. Assets in scope
Every hostname and IP address explicitly permitted, listed below. Anything not listed is out of scope, including other subdomains, staging environments, and mail servers.
| # | Asset (hostname / IP) | Environment | Notes |
|---|---|---|---|
| 1 | prod / staging | ||
| 2 | prod / staging | ||
| 3 | prod / staging |
2. Permitted actions
Only the items ticked below are authorized.
- ☐ Passive fingerprinting of public HTTP responses (headers and HTML only)
- ☐ Authenticated review with credentials supplied by Client
- ☐ Reading server configuration and php -v on hosts Client controls
- ☐ Non-destructive validation of a named CVE in a Client-provided staging environment
- ☐ Denial-of-service or memory-exhaustion testing — requires separate written approval; can take production offline
- ☐ Other: ____________________________________
3. Prohibited by default
Port scanning outside the listed assets; credential attacks; data exfiltration; testing production during business hours; any action likely to cause an outage; publishing findings in any form.
4. Data handling
Findings and any captured data are confidential, delivered only to the contact named below, and deleted within ______ days of the engagement ending.
5. Emergency stop
Client contact: ____________________ / ____________________. The tester halts immediately on request, by phone or email, with no penalty and no further work.
6. Signatures
- Client
- Authorized signatory ____________________________ Date __________
- Tester
- Luis Angel Garcia ____________________________ Date __________
Public entities: a signed scope from an individual employee is often not sufficient on its own. Procurement or a purchase order is usually required before work begins, and I will wait for it rather than start early.
Want this for your organization?
Send the domain and the owning organization. The scope comes back filled in, with the fee stated before anything is signed.