Plain English
Penetration test procurement, in the order it happens
Penetration test procurement follows the same path as other professional services, with one extra step. Before any testing, the owner of each system must sign authorization. So the buying process and the legal process run side by side.
- Authorisation before any test
- Plain-English guidance
- Written scope on every engagement
How penetration test procurement differs from other buying
Most services are bought once the price and terms are agreed. Here, a signed contract is not enough. The work is legal only with the system owner's written authorization, as laws such as the US Computer Fraud and Abuse Act guidance make clear.
In addition, the supplier will hold sensitive information about your weaknesses. Therefore security and legal teams usually review the firm more closely than a typical vendor.
The penetration test procurement steps
Each step has an owner and a document. If you know both in advance, the process moves faster.
Also run some steps in parallel. For example, the vendor review can start while the scope is still being drafted.
| Step | Document | Usual owner |
|---|---|---|
| Request | Short brief or request for proposal | Security lead |
| Compare | Written scopes and fees | Security lead and procurement |
| Vendor review | Security questionnaire | Security and legal |
| Contract | Agreement and NDA | Legal |
| Purchase | Purchase order | Procurement |
| Authorize | Signed authorization and rules | System owners |
Penetration test procurement checklist
Tick what is already in your folder.
Your result appears here as you tick, so you can see what is still open.
Common delays in penetration test procurement
The usual delay is the vendor review starting late. Another is a system owner who was not told they must sign. Both are easy to prevent with a short plan at the start.
Similarly, a purchase order can take longer than expected in large organizations. So ask your procurement team about lead times on day one.
What to send with the request
Send the reason for the test, a list of systems and any deadline. Then ask each firm for a written scope, a fixed fee and its standard terms.
Because every firm answers the same brief, the comparison is fair. As a result, the decision is easy to explain later.
Closing penetration test procurement cleanly
Keep one folder with the brief, the chosen scope, the contract, the purchase order and the signed authorization. Auditors often ask to see the authorization next to the report.
Finally, add the report and retest letter when the work ends. Next year, that folder becomes the starting point.
Working with us
We take a limited number of engagements, with named senior practitioners. The owner signs authorization before any testing, and the method follows the Penetration Testing Execution Standard.
Full engagements run from $35,000 to $120,000, while the floor is $25,000. Also, the bounded External Attack Surface Review starts at $4,500. Moreover, its fee is credited in full against a full engagement commissioned within ninety days. Every fee is agreed in writing before anyone starts.
Penetration test procurement questions
How long does penetration test procurement take?
Often two to six weeks, depending on internal approvals.
Who owns penetration test procurement?
Usually the security lead, with procurement and legal in support.
Is a contract enough to start testing?
No. The system owner must also sign authorization.
Can penetration test procurement steps run in parallel?
Yes. The vendor review can start while the scope is drafted.
Related guides
Start penetration test procurement with a brief
Send the reason, the systems and your deadline. We reply with a written scope, our standard terms and a fixed fee.
Ask about authorised testing