Penetration testing statement of work.

Prepared for: Fishing Rods LLC
Requesting customer: Tackle Warehouse

This Statement of Work defines the external network assessment that Trespass Security LLC will deliver to Fishing Rods LLC. The assessment supports Tackle Warehouse's review of its business relationship with Fishing Rods LLC. The scope, deliverables, and engagement requirements are set out below.

Purpose of the assessment

Trespass Security LLC will assess the external network services on the target below, document verified security findings, and provide a report for Fishing Rods LLC to share with Tackle Warehouse. The scope covers external network services and excludes web application functionality.

Target in scope

www.fishingrods.example
IP address: 23.227.38.74
TCP ports: 1-65,535

Testing boundaries

Testing will be unauthenticated, with no credentials or internal access. Discovery will cover the listed TCP ports. Follow-up examination will focus on exposed service configuration, encrypted connections, and network access controls where applicable.

Not included

Other hosts or IP addresses, UDP services, web application functionality, internal systems, source code, social engineering, denial-of-service testing, and remediation implementation are excluded. Shared hosting does not extend permission to other tenants or hosting-provider infrastructure.

The assessment combines service discovery with hands-on examination. Automated results will be reviewed before they are used to support a finding.

Service discovery and examination

We will identify TCP services reachable on the scoped target and examine relevant configurations and controls. Any validation will remain within the approved Rules of Engagement. Findings will describe the evidence, practical significance, and recommended remediation.

Assessment report

Fishing Rods LLC will receive a PDF report suitable for sharing with Tackle Warehouse. It will include an executive summary, the business context, tested scope, approach and limitations, findings with supporting evidence, and recommended fixes. Any untested or inaccessible areas will be identified.

Findings review

We will review the findings with Fishing Rods LLC, explain their implications, and answer questions about recommended fixes. Fishing Rods LLC remains responsible for implementing changes to its systems.

One consolidated remediation retest

The engagement includes one consolidated retest of originally reported findings, requested within 90 days of report delivery. We will document the items checked and their updated status. Additional targets, new findings, or further testing require a separately agreed scope.

Assessment limitations

The report will describe the evidence obtained within the agreed scope and testing period, including any limitations on coverage. It does not guarantee that all vulnerabilities will be identified. Tackle Warehouse determines whether the scope and resulting evidence meet its requirements.

The following requirements apply to the delivery, scheduling, and management of the work defined in this Statement of Work.

Customer requirements

Fishing Rods LLC is responsible for communicating Tackle Warehouse's assessment requirements. The services and deliverables covered by this engagement are those defined in this SOW. Additional systems, testing methods, or deliverables are subject to the change process below.

Reporting requirements and timing

Fishing Rods LLC will provide any required reporting format, submission deadline, or additional evidence requirements. Testing dates and delivery timing will be confirmed in writing against the final scope, availability, and readiness.

Conditions for commencement

Testing begins after the engagement agreements and Rules of Engagement are executed, permissions are verified, payment requirements are met, and readiness checks are complete. Required hosting-provider permissions must be confirmed. Customer scope confirmation alone does not authorize testing.

Rules of Engagement and changes

The Rules of Engagement will record the targets defined in this SOW, approved methods, testing window, operational contacts, restrictions, and stop procedures. Changes to scope, methods, or timing require written review and any applicable signed changes before the affected work proceeds.

Acceptance and commercial terms

Fishing Rods LLC and Trespass Security will record acceptance of this SOW by its reference and version. Fees and payment terms are documented separately with Fishing Rods LLC. Tackle Warehouse's confirmation addresses its requirements and does not make it a party to the engagement.