My company is going to start to provide penetration testing services pretty soon, in fact, we are just missing the legal aspects of it.

I'm wondering if is there any template which states the most common get-out-of-jail things? Or should we write a custom document for each client? If so, what should include?

  • Something along the lines of, We, ____, hereby grant yzT unrestricted access to the servers, ____, ____, ____, and any gateways, NATS, routers, or other devices used to mediate data to and from these servers during the time beginning on ___ and ending on ___ and will not hold yzT in contempt or in violation for any form of access or manipulation of the specified devices, excluding lost data or the publishing of proprietary data, and yzT agrees to maintain confidentiality of any information that is owned by ____. Although definitely find some improvements and/or better answers, it's a start.
    – JVE999
    Commented Jul 24, 2014 at 19:43

2 Answers 2


SANS has a pretty nice white paper on the subject here.

GIAC also has white paper geared towards managment of pen test which covers some of it here.

I would keep in mind that you may need to have both general and specific legal agreements depending on the scope and offerings you provide. Your focus should be on the laws pertaining to doing an engagement, the risks associated to both you and the client which may come up during an engagement, and having the right personal approving your work.

  • I read both documents, but they are rather a pentesting guide. The GIAC's document has a template though, but it's a template for tests within the same organization. The SANS's document has some good points I'm going to take in consideration when writing the contract.
    – user15194
    Commented Jul 30, 2014 at 20:51

Because there's both civil and criminal risk associated with performing a penetration test, this feels like one of the areas where you should not go cheap, and should in fact obtain legal advice from a lawyer. If you attack systems that are not in scope, you might technically be violating the CFAA or other locally applicable laws, and if you (inadvertently) delete data, cause the client to have downtime, or otherwise negatively impact their business operations, might end up getting sued for damages. There's also the risk of errors & omissions, where the client could potentially sue you when they get hacked and it's determined that the vulnerability used was one where you did not warn them.

(I'm not a lawyer, this isn't legal advice, and you should definitely engage a qualified attorney.)