I'm a lawyer interested in information security, and am collecting templates and examples of security testing agreements to compare. What are some publicly available examples, or nuggets of wisdom from your own practices?

Why I'm asking

I'm looking to compare forms of agreements and then distill their common ingredients. With that, I intend to put together a draft template of my own, or at least publish some thoughts on the subject. I'm not being lazy or doing this for a client project.


I have already Googled the question. (One cannot survive modern law school without expert Googling.) I'm looking for a bit deeper knowledge here.

Is this question on-topic?

I think this question is on-topic because it's about the business of information security -- but if people disagree, I'd appreciate a pointer to a more appropriate place. Quoting directly from this community's "on-topic" help article:

Laws - Answers on laws, regulations and licencing should not be taken as legally binding - we're security professionals so deal with legal issues, but this site is not a law site.

To me, that implies it's fine to ask questions about law as long as you use common sense in interpreting the answers.

  • It took me about 15 seconds to type "example of security testing contract" in google. pwcrack.com/penetration_contract.shtml Hope this helps – Eddie Studer Feb 16 '16 at 17:53
  • 3
    Hi there. I highly doubt that these agreements are publicly available at all. Many times, they contain highly privileged information about client systems and company secrets. I would imagine that reading cyber-law journals would be more helpful than an answer here :) – Ohnana Feb 16 '16 at 18:05
  • Thanks. Templates would be fine--I'm not interested in people's secrets. – Ansel Halliburton Feb 16 '16 at 18:15
  • unfortunately, you've asked for what amounts to be a legal resource – schroeder Feb 16 '16 at 18:25
  • As a formerly practicing attorney who's now a practitioner of infosec (Well, okay, like 65% general IT, 35% infosec stuff), let me suggest (1) as with many types of contract templates using Google to find a number of sample documents or templates and using them as guides for your own judgment to create your own template will often be a good investment of time. At least... – mostlyinformed Feb 17 '16 at 2:33