Service Agreement

Overview

Overview

The Service Agreement is the working document for a single engagement. It fixes the scope of work, meaning the specific systems, applications, or networks to be tested; the methodology, whether black-box, white-box, or grey-box; the timeline from kick-off to delivery; and the deliverables you receive. These four items are what the testing team is held to, and they are also what the Refund Policy refers back to when calculating which work has been performed. Read it as a checklist for what your engagement document should contain.

What the Client Provides

Before testing starts you supply written authorization listing in-scope IP addresses, domains, and systems, any out-of-scope systems or sensitive areas, acceptable testing times and blackout periods, and emergency contact details. For white-box or grey-box work you also provide VPN or network access, application credentials and test accounts, system documentation and architecture diagrams, and access to development or staging environments where relevant. You nominate a primary technical contact for coordination, an emergency contact for critical findings, and a business stakeholder who reviews the final report.

In Scope and Out of Scope

Included by default are network vulnerability scanning, web application security testing, API security assessment, authentication and authorization testing, and wireless testing where applicable, with social engineering only where requested. Excluded unless separately agreed are physical penetration testing, destructive testing or denial of service attacks, testing of third-party systems without authorization, production database modifications, and source code review. Anything moved from one list to the other is handled as a documented change with its own quote, so the boundary is never left to interpretation mid-engagement.

Rules of Engagement

The rules of engagement set how testing behaves in a live environment. Critical findings are reported within four hours of discovery rather than held back for the final report. Exploitation stops at proof of concept and no data is exfiltrated. Stop conditions are agreed in advance so either side can halt work immediately if production stability is at risk. Testing hours and notification requirements are recorded per engagement, and clients who need tighter constraints agree them during scoping, where they can be written into the document.

Deliverables

Three deliverables are standard. The executive summary gives leadership an overall security posture assessment with risk ratings, business impact, and strategic recommendations. The technical report documents methodology and tools, each vulnerability with description and proof of concept, CVSS scores and risk ratings, and evidence such as screenshots and logs. Remediation guidance gives step-by-step instructions, code and configuration examples, and prioritisation by risk, plus validation testing recommendations. An executive presentation, retest after remediation, staff training, and compliance mapping are available on request and may carry additional fees.

Commercial Terms and Insurance

Payment is 50% on signature and 50% within 30 days of final report delivery, by bank transfer, credit card, or cryptocurrency. Late payments carry 1.5% monthly interest. Data is encrypted in transit and at rest and retained for 90 days after the engagement unless you request otherwise. Cyberlord maintains professional liability (E&O) cover of $2,000,000, cyber liability of $1,000,000, and general liability of $1,000,000, with a certificate of insurance available on request for your vendor risk file.

Changes, Termination, and Disputes

Scope changes are requested in writing, reviewed for feasibility and impact, approved by both parties, and recorded in a change order covering any additional systems, extended timeline, or extra deliverables. Either side may terminate for material breach with 15 days written notice, for convenience with 30 days written notice, or immediately for illegal activity or fraud; on termination you pay for work completed. Disputes go to good faith negotiation, then mediation, then binding arbitration or litigation in Vienna, Austria.