Authorisation to test, signed by everyone who must sign
Scope, window, contacts and stop conditions in writing, every party's signature recorded, and the engagement paid for on signing.
- 5/5 on G2
- 4.2 on Capterra
- Building QuoteCloud since 2013
With QuoteCloud a security firm sends rules of engagement and the authorisation to test as one document: scope, testing window, contacts and stop conditions, signed by every party with legally binding eSignatures, an audit trail and a certificate of authenticity. The proposal it belongs to collects a deposit or full payment on signing.
Last reviewed by the QuoteCloud team
A sample rules of engagement and authorisation to test from a fictional firm, Northlatch Security, for Brightfern Software, open in the signing view on a tablet: the cover, then the rules of engagement for a two-week testing window, 16 to 27 November, 8 am to 8 pm, covering what is in scope and out of scope, test accounts, source addresses, how to stop testing, evidence and the signers' authority. Brightfern's CTO, Juno Adeyemi, signs on the screen and the button changes to Signed. Two notes beside it: signed by all three (Brightfern's CTO and CEO and Northlatch's director) and the testing window.
The authorisation to test, part by part
Northlatch's rules of engagement for Brightfern Software: one document the client reads, and everyone who must sign signs.
-
Tester edits
What, when, and the one rule
The cover states the testing window and the rule that matters most: testing starts only when everyone below has signed. The window comes from the test proposal the client already accepted.
Northlatch SecurityAuthorisation to test NL-RoE-0931 Sample · fictional businessAuthorisation to test
Rules of engagement & authorisation to test
What we'll test, when, from where, and how to stop us. Testing starts only when everyone below has signed.
-
Locked block
Rules of engagement, clause by clause
In scope and out of scope, test accounts, source addresses, how either side stops testing, how evidence is kept, and the signers' statement of authority. Write the standard clauses once in your template and lock them, so only the targets and dates change.
Content locking: Business
Rules of engagement
StartsMon 16 NovExpiresFri 27 Nov- In scopeapp.brightfern.example.com, api.brightfern.example.com and the 16 hosts in 203.0.113.16/28.
- Out of scopeDenial-of-service, the payment provider's systems, staff phones, and any third-party service not listed above.
- Test accountsBrightfern creates three test accounts, one per role, with test data only.
- Source addressesAll testing comes from Northlatch's published test addresses, sent to your team before day one.
- Stop and contactEither side can stop testing at any time. Felix Aranda (Northlatch) and Juno Adeyemi (Brightfern) are the contacts.
- EvidenceEvidence is stored encrypted and deleted 90 days after the final report.
- AuthorityThe signers confirm they own the systems in scope or have the hosting provider's written permission to test them.
-
Client signs
Every party signs
Brightfern's CTO and CEO and Northlatch's director each sign online, with no account needed. Each signature is recorded with its date and time in the audit trail, and the signed document carries a certificate of authenticity.
eSignatures: every plan
Authorise the test
3 of 3 signed
- Juno AdeyemiCTO, Brightfern Software Signed30 Oct, 4:22 pm
- Marcus OyelaranCEO, Brightfern Software Signed31 Oct, 8:10 am
- Mara EllwoodDirector, Northlatch Security Signed31 Oct, 9:02 am
This authorisation
- Window
- 16–27 Nov
- Targets
- 3 in scope
- Contacts
- Felix Aranda, Juno Adeyemi
Certificate of authenticity and audit trail attached
A passcode, a signature and a record of both
Ask for a one-time passcode by email before a signer can sign, so the person signing is the person you sent it to. Or sign in person: hand over your laptop or tablet at the kick-off meeting and the client signs there.
The signature page shows what was agreed beside the signature: the window, the targets and the contacts. QuoteCloud records who signed and when. Whether a signer has authority over the systems is their statement in the document, not something QuoteCloud checks.
- Optional one-time passcode by email
- Signing in person on your device
- No account needed to sign
- Audit trail and certificate of authenticity
eSignatures: every plan
Free eSignatures in QuoteCloudAuthorise the test
Juno Adeyemi · CTO, Brightfern Software
Signed online · 30 Oct, 4:22 pm
This authorisation
- Window
- 16–27 Nov
- Targets
- 3 in scope
- Contacts
- Felix Aranda, Juno Adeyemi
Certificate of authenticity and audit trail attached
What to put in your rules of engagement
Your wording and your obligations: what an authorisation must contain is for you and your advisers. These are the parts commonly written down.
In scope
Applications, APIs and address ranges, written exactly, so nobody argues later about what was covered.
Out of scope
The systems and techniques you won't touch: third-party services, denial-of-service, staff devices.
Test accounts
Which accounts the client creates for you, for which roles, and that they hold test data only.
Source addresses
Where the testing comes from, so the client's team can tell your traffic from anyone else's.
Stop and contact
Who can stop the test, how, and the named contacts on both sides for the whole window.
Evidence and authority
How evidence is stored and when it's deleted, and the signers' statement that they may authorise the test.
Get your next authorisation signed by everyone, in one document
Free for 14 days, no credit card required. eSignatures are on every plan, including Free.
The proposal it belongs to, paid on signing
The authorisation carries no price: that's in the penetration test proposal. Brightfern ticked the retest, signed, and paid half of the $22,687.50 through Stripe when they signed.
A Zapier trigger such as Recipient Signed Document can start the next step in your own tools, for example opening the engagement ticket once the authorisation is signed by all three (illustrative: through Zapier or Make where your tool has a connector). QuoteCloud doesn't start or run the test.
- A deposit as a percentage or fixed amount, or full payment
- Stripe or PayPal
- Zapier triggers on signing and payment
Payments, Zapier and the API: Essentials and up
Take payments on signingTesting scope
| Item | Qty | Rate | Amount |
|---|---|---|---|
| Testing | $18,975 | ||
External infrastructure test · 2 days16 hosts in 203.0.113.16/28
|
1 lot | $3,300 | $3,300.00 |
Web application test · 5.5 days (3 roles)Customer, account admin and support staff
|
1 lot | $9,075 | $9,075.00 |
API test · 2.5 days (42 endpoints)Public API, authenticated and not
|
1 lot | $4,125 | $4,125.00 |
Report & readout · 1.5 daysBoard summary, technical appendix, a one-hour readout
|
1 lot | $2,475 | $2,475.00 |
| Extra tests Tick to add | |||
| 1 lot | $1,650 | $1,650.00 | |
| 1 lot | $2,400 | $2,400.00 | |
- Subtotal
- $20,625.00
- Tax (10%)
- $2,062.50
- Total
- $22,687.50
- Plus, monthly
- $0.00/mo
- Payment on signing (50%)
- $11,343.75
Accept, sign and pay
Juno Adeyemi · CTO, Brightfern Software
Signed online · 30 Oct, 4:20 pm
Payment on signing (50%)
$11,343.75
Paid via StripePay with card or PayPal
Certificate of authenticity and audit trail attached
From a signed proposal to day one of testing
A typical order of work. QuoteCloud handles the documents, the signatures and the payment.
Proposal signed and paid
The client accepts the test proposal and pays the deposit on signing.
Send the authorisation
From your locked template: add the targets, window, contacts and every signer.
Every party signs
Each signer signs online or in person, with an optional passcode.
Your next step starts
A Zapier trigger on the signature can open your engagement ticket (illustrative).
Testing in the window
Your team tests within the agreed scope and dates, with the signed copy on file.
Questions about authorisation and signing
Can several people sign one rules of engagement document?
Yes. Add every signer to the document, such as the client's CTO and CEO and your director. Each signs online with no account needed, and the document shows who has signed and who hasn't. Each signature is recorded in the audit trail, and the signed document carries a certificate of authenticity.
Does QuoteCloud check that a signer owns the systems in scope?
No. QuoteCloud records who signed and when. Whether a signer owns the systems, or has the hosting provider's permission to authorise testing, is their statement in your document. What an authorisation must contain is for you and your advisers.
Can I make signers confirm their identity before signing?
You can ask for a one-time passcode by email before someone signs, so the person signing is the person the document was sent to. The passcode is optional, set per document, and eSignatures are available on every QuoteCloud plan.
Can the client sign at the kick-off meeting?
Yes. Signing in person on your own device is supported: hand over a laptop or tablet and the client signs there. The signature is recorded in the audit trail like any other.
Can a signed authorisation start our test automatically?
QuoteCloud doesn't run or start tests. A Zapier trigger such as Recipient Signed Document can start a step in your own tools, for example opening an engagement ticket, where your tool has a Zapier or Make connector. Your team still decides when testing begins.
More for security firms
Every page of QuoteCloud for cybersecurity services.
-
Penetration test & assessment proposalsScope by IPs, apps and APIs, days worked out in your scoping sheet, and extra tests as options.Explore
-
Penetration test reportsExecutive summary, findings with evidence and retest status, and the client's sign-off in one document.Explore
-
Remediation quotes priced from findingsFindings by severity × hours × rate in a Spreadsheet block that sets the price lines, plus a retest the client ticks.Explore
- AI-drafted reports & quotes with MCPYour AI assistant, connected through QuoteCloud's MCP service, drafts the report and the priced quote for an analyst to review.
- Vulnerability scan reportsMonthly and quarterly scan results as a branded report: severity summary, findings, trend and what to fix first.
- Compliance gap auditsControls against your chosen framework, current and target maturity, and the roadmap priced as options.
- Monthly managed security reportsThe month in alerts, incidents and patching from your monitoring platform, with next month's recommendations to tick.
- Managed security service proposalsEndpoints and users × service tier → the monthly price, on a term, with renewals you can see coming.
- vCISO & advisory retainersAdvisory days a month as packages the client chooses, with the board reporting and roadmap in writing.
- Integrations & automationMCP, the API, Zapier and Make, plus CRM, accounting, Slack and Teams, connected the way each one really connects.
- Cybersecurity templatesReal QuoteCloud cybersecurity, SLA and consulting templates, ready for your report and quote layouts.
- QuoteCloud implementation for security firmsReport and quote templates, your pricing sheet, the MCP connection and analyst training, step by step.
- FAQAnswers to the questions MSSPs, pen-testers, security consultancies and vCISO firms ask most.
Every signature in place before testing starts
Start a free 14-day trial: build your rules of engagement template and send your next authorisation for every party to sign.