Put the legal boundaries around a penetration testing engagement

The biggest problem is usually uncertainty about what the tester is authorised to do, on which systems, during what period, and with what limits. If those boundaries are unclear, disputes can arise over service scope, access rights, outages, handling of discovered vulnerabilities, or whether certain activity went beyond permission. Privacy and confidentiality issues can also become serious if personal or sensitive business information is exposed during testing. A well-structured agreement helps define the engagement clearly, but the legal position still depends on how the work is carried out in practice.

These agreements commonly deal with the systems and environments in scope, the type of testing permitted, timing windows, client approvals, access credentials, reporting obligations, confidentiality, ownership and use of deliverables, data handling, liability allocation and what happens if testing reveals critical issues. Depending on the engagement, the agreement may also need to address third-party platforms, subcontractor involvement, or restrictions on live-environment testing. We draft or review the document with those practical issues in mind, rather than relying on generic service terms that may leave key permissions unclear.

A standard IT services contract may cover fees and basic confidentiality, but penetration testing usually involves authorised attempts to identify weaknesses in live or sensitive systems. That creates a different risk profile from ordinary support or software work. Templates often fail to deal properly with testing boundaries, evidence capture, treatment of discovered vulnerabilities, handling of personal information, and the line between reporting issues and fixing them. A tailored agreement is usually the better option where the engagement includes sensitive environments, regulated data, or a client that expects precise wording around permissions and liability.

We usually need to know who is engaging whom, what systems or environments are being tested, whether testing is internal or client-facing, whether subcontractors are involved, how findings will be reported, and whether the engagement includes any follow-up advisory work. It also helps to understand how your business collects, uses and shares information during the engagement, because that can affect the privacy wording. The best approach depends on how the parties work together, what has already been agreed and where the main risks sit, not just the service label on the proposal.

Not automatically. The fixed-fee is for the penetration testing agreement itself and the legal issues tied to that document. If your engagement also includes remediation work, retesting, managed security support, or a longer-term advisory relationship, those extra elements may need additional drafting so the contract reflects the full commercial arrangement. The service does not include technical implementation, security remediation, or ongoing representation. If you need broader contract support beyond the testing engagement, we can discuss a separate scope once we understand the setup.

Submit an enquiry on this page or click 'Get started'. One of our legal consultants will review it within 1 business day and get in touch to understand what you need.

Your consultant will then email you a fixed-fee quote setting out the cost, scope and timing. If you're happy with it, you can accept the quote and sign our engagement letter online.

Once you've accepted, one of our Australian-qualified lawyers will work with you to complete your project. They'll contact you by email or phone if they need anything.

Sprintlaw works on fixed-fee pricing wherever possible, so you can review the scope and cost before you decide whether to proceed. For the Penetration Testing Agreement service, pricing starts from $900.00.

After you enquire, a legal consultant will confirm what is included, the expected timing and whether any extra work is needed before you engage us.

We work online, so we can help wherever you are in New Zealand. Our team works remotely, mainly from Australia.

Your work is done by our Australian-qualified lawyers, who hold Australian practising certificates and specialise in business law. None of them are New Zealand lawyers or hold a New Zealand practising certificate.

Sprintlaw NZ Limited is a legal consultancy, not a law firm, and is not regulated by the New Zealand Law Society. We don't act in court or tribunal matters, conveyancing (including leases and business sales) or other reserved areas of work. Communications with Sprintlaw are unlikely to be protected by legal professional privilege. We still keep everything confidential under our engagement letter.