Penetration Testing Agreement
A penetration testing agreement is a contract authorizing simulated cyberattacks on a client's systems within strict scope to identify vulnerabilities. Use this before a pentest vendor probes production or staging environments. It defines IP ranges, forbidden attacks, emergency stop contacts, and report confidentiality.
What's included
A ready-to-use penetration testing agreement covering systems and ip scope in/out of bounds, testing window and notification requirements, rules of engagement and stop conditions, with signature fields already placed for Vendor and Client. Fill in the bracketed details (like [Company Name] or [Date]) using Docracy's built-in text editor, then send it out for signature.
This is a general template for informational purposes only and does not constitute legal advice. Consult a qualified attorney to review it for your specific situation and jurisdiction before use.
Key clauses
- Systems and IP scope in/out of bounds
- Testing window and notification requirements
- Rules of engagement and stop conditions
- Handling of discovered data and critical findings
- Report delivery and remediation retest option
- Liability cap and insurance
What you'll fill in
[Testing Vendor][Client Company][Scope Assets/List][Test Window Dates][Emergency Contact 24/7][Fee][Report Delivery Date]Legal summary
Client explicitly authorizes otherwise illegal probing within scope; vendor must avoid destructive tests unless approved. Critical findings trigger agreed escalation paths.
Free for up to 2 signers, no account required. Need unlimited? Flat $10/month.
FAQ
Is this Penetration Testing Agreement legally binding?
Signing through Docracy uses a simple electronic signature (SES), which is legally recognized for everyday business agreements under laws like the U.S. ESIGN Act and the EU's eIDAS regulation. This is a general template, not legal advice — for high-stakes or regulated agreements, have a qualified attorney review it for your situation.
Who needs to sign this Penetration Testing Agreement?
This template includes signature fields for Vendor and Client — already placed — plus 7 placeholder fields to fill in before you send it.
Can I edit this Penetration Testing Agreement before sending it?
Yes — Docracy's editor lets you edit the text, add or remove signature fields, redact sections, and reorder pages before you send it.
Do I need an account to send this Penetration Testing Agreement?
No — it's free for up to 2 signers with no account required. Create a free account only if you want to save it to a dashboard or reuse it later.
Try it with an AI assistant
Paste one of these into ChatGPT, Claude, or your assistant of choice:
“Fill for external web app pentest on staging URL over one weekend.”
“Forbid social engineering and DoS attacks.”
“Require encrypted report delivery within 5 business days.”
Why teams start with Docracy
“Docracy is a great product that I have tested and am using. It is easy to use, has good tools, is always up to date, and implements new features. Highly recommended.”— DACH Advisory
Free for up to 2 signers, no account required. Need unlimited? Flat $10/month.