Penetration test request for quote (RFQ) template

Organisation

Contact for questions

name and email

What we want tested

one or two sentences, with the scoping document attached

Why

the reason for the test and who will read the report

When

preferred testing window and the date the final report is needed

Quotes due by

• Accreditation, if required: CREST or NCSC CHECK, for the type of testing in scope
• Named testers, with their experience and certifications
• Testing carried out by your own staff, or tell us who else will do it
• Professional indemnity insurance, with the level of cover
• Willing to sign our non-disclosure agreement
• Where our data and findings will be stored, and when they will be deleted

• Total price, and whether it is fixed or based on a day rate
• Number of testing days for each part of the scope, and the day rate used
• Days for reporting and project management, shown separately
• Whether a retest is included, its price if not, and how long after the test it can be booked
• What would change the price, such as extra users, environments or out-of-hours testing
• Earliest start date and how long after testing the report is delivered
• Your testing approach and the standards you follow
• A redacted sample report
• Payment terms and how long the quote is valid
• Anything in our scope you would test differently, and why

Tell firms what matters to you, so they can answer it. For example:

• How well the quote shows they understood our scope.
• The experience of the people who will do the testing.
• The quality of the sample report.
• Price, including the retest.
• Availability against our dates.

This request and the scoping document are confidential. Please use them only to prepare your quote, and delete them if you do not quote.