# Penetration test request for quote (RFQ) template

Send the same request to every firm you are considering, with your scoping document attached. Asking each firm for the same breakdown is what makes the quotes comparable.

Online version: https://pentesting.org/toolkit/pentest-rfq-template

## The request

**Organisation**:

> 

**Contact for questions** (name and email):

> 

**What we want tested** (one or two sentences, with the scoping document attached):

> 

**Why** (the reason for the test and who will read the report):

> 

**When** (preferred testing window and the date the final report is needed):

> 

**Quotes due by**:

> 

## Our requirements

- [ ] Accreditation, if required: CREST or NCSC CHECK, for the type of testing in scope
- [ ] Named testers, with their experience and certifications
- [ ] Testing carried out by your own staff, or tell us who else will do it
- [ ] Professional indemnity insurance, with the level of cover
- [ ] Willing to sign our non-disclosure agreement
- [ ] Where our data and findings will be stored, and when they will be deleted

## What to include in your quote

- [ ] Total price, and whether it is fixed or based on a day rate
- [ ] Number of testing days for each part of the scope, and the day rate used
- [ ] Days for reporting and project management, shown separately
- [ ] Whether a retest is included, its price if not, and how long after the test it can be booked
- [ ] What would change the price, such as extra users, environments or out-of-hours testing
- [ ] Earliest start date and how long after testing the report is delivered
- [ ] Your testing approach and the standards you follow
- [ ] A redacted sample report
- [ ] Payment terms and how long the quote is valid
- [ ] Anything in our scope you would test differently, and why

## How we will choose

Tell firms what matters to you, so they can answer it. For example:

- How well the quote shows they understood our scope.
- The experience of the people who will do the testing.
- The quality of the sample report.
- Price, including the retest.
- Availability against our dates.

## Confidentiality

This request and the scoping document are confidential. Please use them only to prepare your quote, and delete them if you do not quote.