The rules of engagement for how Maverick Security conducts testing, applied whenever a Statement of Work references this agreement.
This Testing Agreement ("Agreement") governs the conduct of security testing performed by Maverick Security, LLC ("Maverick") for the client identified in the applicable Statement of Work ("Client"). Where a project commences within ten (10) days of the original start date, or where the Statement of Work references this Agreement, its terms apply to the engagement. This Agreement is read together with, and does not replace, Maverick's Standard Terms and Conditions.
Maverick recognizes the potential risks associated with security testing, including possible impacts on business operations, the time required for investigations, and the effort needed to restore affected services. Maverick also acknowledges the significant trust the Client places in its assessment team to handle sensitive information with exceptional care and discretion.
All testing activities are non-destructive by default and adhere to pre-approved safety parameters. No disruptive exploit will be executed without explicit Client authorization. Maverick will use commercially reasonable efforts to minimize service disruption and to limit exposure to sensitive data during the course of the engagement.
Testing evaluates the state of the in-scope environment as of the testing window. It does not guarantee ongoing security, and changes made to the environment after testing, or factors outside the defined scope, may affect the findings. The results represent what a similarly skilled adversary could exploit under comparable circumstances.
Security testing simulates the techniques of a real-world adversary. The Client acknowledges that certain activities inherent to this work, including but not limited to authentication testing, injection testing, network protocol manipulation, credential handling, and proof-of-concept exploitation, carry a residual risk of unintended effects on systems, data, and availability, even when performed with due care.
Maverick will conduct testing in accordance with recognized industry methodologies and will not intentionally perform denial-of-service attacks, destructive actions, or data exfiltration beyond the minimum necessary to demonstrate a finding, unless expressly authorized in writing by the Client. Where a proof of concept could materially affect a production system, Maverick will seek Client confirmation before proceeding.
The Client is responsible for maintaining current backups of in-scope systems and data prior to the testing window. To the extent permitted by the Standard Terms and Conditions and applicable law, Maverick shall not be liable for interruptions, degradation, or loss arising from testing activities conducted within the authorized scope and in accordance with this Agreement.
Prior to project kickoff, the Client shall provide Maverick with a fully validated and approved scope of testing, including all target systems, applications, hosts, network ranges, credentials, and any assets requiring separate authorization. The Client represents that it owns, or has obtained all necessary rights and authorizations to permit testing of, every asset included in the scope.
Maverick shall be entitled to rely, without independent verification or investigation, on all instructions, information, and materials provided by the Client. Scoping considerations are based on and subject to the terms of this Agreement. Where scope is inaccurate, incomplete, or includes assets the Client is not authorized to submit for testing, responsibility for the resulting consequences rests with the Client.
Assets that are shared, hosted by a third party, or that contain customer-branded or customer-owned content may require additional written authorization from the relevant party before testing. The Client is responsible for identifying such assets and obtaining that authorization in advance.
By executing the applicable Statement of Work and providing the validated scope, the Client authorizes Maverick to perform the security testing described therein against the in-scope assets, during the agreed testing window, in accordance with the agreed rules of engagement. This authorization constitutes the Client's consent to the activities contemplated by this Agreement.
Maverick will identify the source addresses used for testing where requested, so the Client may distinguish authorized testing traffic from genuine malicious activity. The Client is responsible for notifying its relevant internal teams and any third-party providers, such as hosting, cloud, or managed security providers, of the scheduled testing where such notice is required.
Requests to test assets outside the authorized scope will be handled through a written change order and are not covered by the original authorization.
Cancellation and/or rescheduling of a scheduled engagement within ten (10) business days of the original start date is subject to Maverick's rescheduling and cancellation terms. Because testing resources are reserved in advance, late changes may be subject to a rescheduling fee or a portion of the engagement fee to offset reserved capacity.
Retest activities must be scheduled to begin within ninety (90) days of receipt of the initial draft report. If a retest is not scheduled within this period, and Maverick has made two unsuccessful attempts to reschedule within that window, retest rights will expire and the assessment will be considered complete. Retests requested beyond the ninety (90) day window require a change order.
If the Client makes significant changes to the environment during the remediation period that make direct comparison difficult, retesting will be limited to findings where comparison is still possible, or a change order may be required to cover the additional effort and cost.