1 · Parties
This Statement of Work ("SOW") is entered into between ("Client") and REDTEAM ("Service Provider"), together "Parties", for the offensive security engagement described below.
This SOW is effective only when accompanied by a signed Authorization Form and Rules of Engagement. The documents together form the complete engagement agreement.
2 · Background & Objectives
3 · Scope of Work
3.1 In-Scope Assets
| Asset / Target | Type | Environment | Notes |
|---|
| | | | |
| | | | |
3.2 Out of Scope
4 · Services & Methodology
Engagement tier:
Methodology: Testing follows OWASP Top 10, OWASP ASVS, PTES, and OSSTMM-informed workflows, adapted to the engagement tier. A governed AI-assisted pipeline supports reconnaissance and exploit validation; every action remains scoped, authorized, and audit-logged.
Approach: Proof-of-concept only. Exploitation demonstrates risk without destruction, and no data is exfiltrated beyond what the report evidence requires.
5 · Deliverables
- Executive summary report — risk in business language
- Technical report — each finding with reproduction steps and evidence
- Evidence pack — audit logs and artifacts supporting the findings
- Remediation guidance and one retest pass to confirm fixes
6 · Timeline & Milestones
| Milestone | Description | Target Date |
|---|
| M1 | Authorization, ROE, and access confirmation | |
| M2 | Reconnaissance complete | |
| M3 | Testing complete | |
| M4 | Draft report delivered | |
| M5 | Retest and final report | |
7 · Team & Contact
Lead: · ·
Escalation: · ·
8 · Assumptions & Dependencies
- Client provides access, credentials (where agreed), and a single point of contact before testing begins.
- Testing window is within the agreed hours in the Rules of Engagement.
9 · Fees & Payment
10 · Compliance & Legal
- All testing is conducted under written authorization and within the scope of the service provider's license and registration.
- Data handling complies with the Personal Data Protection Act 2010 (Malaysia); production data is masked and minimized.
- Findings and evidence are delivered under the confidentiality obligations in the NDA and are retained per the retention period agreed in the Rules of Engagement.
- This SOW is governed by the laws of Malaysia.
11 · Acceptance
By signing below, the Parties agree to the scope, deliverables, timeline, and terms in this Statement of Work, together with the accompanying Authorization Form, Rules of Engagement, and NDA.
For the Client
Name: ______________________
Title: ______________________
Date: ______________________
For REDTEAM
Name: ______________________
Title: ______________________
Date: ______________________
COMPANY STAMP