Terms of Engagement & Authorized Testing Policy.
All Vulnerability Assessment and Penetration Testing (VAPT) services performed by esecnet are governed by formal commercial, operational, and safe-harbor authorization agreements executed prior to testing.
Active offensive security testing involves probing systems, evaluating authentication boundaries, and attempting controlled exploitation. To protect client infrastructure and ensure full compliance with computer security laws, esecnet never initiates testing without signed authorization from the verified asset owner.
Mandatory pre-engagement documents
- 1. Mutual Non-Disclosure Agreement (MNDA)
- Executed prior to sharing target architectures, credentials, or source code
- 2. Master Services Agreement (MSA) & SOW
- Defines commercial terms, liability limits, deliverables, and retesting schedule
- 3. Rules of Engagement (RoE)
- Specifies in-scope targets, excluded systems, testing windows, and source IPs
- 4. Letter of Authorization (LoA)
- Formal safe-harbor authorization signed by an executive of the asset owner
Official engagement documentation lifecycle
Every esecnet assessment follows a structured documentation sequence from initial scoping through final remediation attestation and data destruction.
| Document | Stage | Purpose & Operational Scope |
|---|---|---|
| Mutual Non-Disclosure Agreement (MNDA) | Pre-Scoping | Establishes bilateral confidentiality covering target architecture, source code, credentials, and discovered vulnerabilities. |
| Technical Scoping Questionnaire | Scoping | Captures asset metrics across Web, API, Mobile (Android & iOS), AI/LLM, Network, Server/AD/Cloud, or Thick Client targets and selects Black-Box, Grey-Box, or White-Box methodology. |
| Master Services Agreement (MSA) & Statement of Work (SOW) | Contracting | Governs commercial terms, limitation of liability, intellectual property ownership, project milestones, and included patch verification retesting. |
| Rules of Engagement (RoE) | Pre-Execution | Defines exact in-scope FQDNs, IP/CIDR blocks, API schemas, binary hashes, out-of-scope exclusions, testing hours, rate limits, esecnet egress IPs, and 24/7 emergency escalation contacts. |
| Letter of Authorization (LoA) | Pre-Execution | Standalone legal authorization signed by the asset owner granting esecnet explicit permission to perform security testing during the authorized window. |
| Critical Vulnerability Flash Advisory (P0/P1) | Active Testing | Issued immediately during testing if a critical remote code execution, authentication bypass, or active data exposure is identified. |
| Executive Summary & Technical PoC Report | Reporting | Comprehensive deliverables containing executive compliance mapping (SOC 2, ISO 27001, PCI-DSS, HIPAA) and step-by-step reproducible proof-of-concept evidence with remediation guidance. |
| Remediation Verification Report & Letter of Attestation | Post-Remediation | Updated assessment report confirming closure of patched vulnerabilities, accompanied by an external-ready Letter of Attestation for auditors and enterprise customers. |
| Data Sanitization & Destruction Certificate | Engagement Closeout | Written confirmation that all client binaries, logs, captured traffic, credentials, and temporary testing artifacts have been permanently purged from esecnet environments. |
1. Written authorization and asset ownership warranty
esecnet performs vulnerability assessments and penetration testing exclusively against targets explicitly listed in a signed Statement of Work (SOW), Rules of Engagement (RoE), and Letter of Authorization (LoA). By signing the LoA, the client warrants that it is the legal owner of the target systems (or has obtained binding written consent from any applicable third-party hosting, cloud, or upstream infrastructure providers) and grants esecnet safe-harbor authorization to conduct security testing under applicable laws.
2. Rules of Engagement (RoE) and safe testing boundaries
Before active testing begins, esecnet and the client agree upon a written Rules of Engagement (RoE) document specifying:
- In-scope assets: Explicit domain names, subdomains, IPv4/IPv6 CIDR blocks, API endpoints, mobile application package identifiers and SHA-256 binary hashes, cloud account IDs, and desktop binaries.
- Excluded assets: Systems, third-party integrations, or production workflows explicitly excluded from testing.
- Testing windows and rate limits: Permitted hours of testing, timezone constraints, and maximum request rates.
- Source IP allowlisting: Dedicated esecnet testing source IP addresses for client firewall, WAF, and SOC/SIEM correlation.
- Emergency stop protocol: Direct 24/7 escalation contacts enabling either party to pause testing immediately if unexpected system behavior occurs.
3. Prohibited activities and system availability precautions
Unless explicitly requested in writing for an isolated non-production environment, esecnet does not perform volumetric Denial of Service (DoS/DDoS) attacks, physical intrusion, or intentional destruction/modification of production customer records. While esecnet exercises industry-standard care aligned with PTES and NIST SP 800-115, the client acknowledges that active security testing carries inherent operational risks and agrees to maintain current backups of target systems prior to testing.
4. Critical finding escalation (P0/P1 notification)
If esecnet discovers a critical vulnerability during active testing, such as unauthenticated remote code execution, cross-tenant authentication bypass, active compromise indicators, or exposed production credentials, esecnet will notify the client's designated security contact immediately via an encrypted flash advisory rather than waiting for final report delivery.
5. Deliverables, intellectual property, and attestation
Upon full payment of engagement fees under the SOW, the client receives ownership and right to use the final VAPT deliverables (Executive Summary, Technical Vulnerability & PoC Report, Remediation Verification Report, and Letter of Attestation) for internal remediation, regulatory compliance, and customer assurance. esecnet retains all intellectual property rights in its pre-existing testing tools, custom scripts, methodologies, and report templates. Clients may share the standalone VAPT Letter of Attestation with third-party prospects and auditors without disclosing confidential technical payloads.
6. Website terms of use
The materials on the esecnet website are provided for informational and service-scoping purposes. Unauthorized scanning, scraping, or offensive testing against esecnet's own website or infrastructure outside our responsible disclosure channel (/.well-known/security.txt) is prohibited.
7. Contact for legal and engagement documentation
To request our standard Mutual NDA, Master Services Agreement, Rules of Engagement template, or a redacted sample VAPT report, contact [email protected].