Security Assessment Procedure.

Work Description (SOW) · Scope · Engagement Rules (ROE).

Work document for planning, defining and executing security assessments.

Work Description

At AlcaNox, we structure our security assessment services through this Statement of Work (SOW), the official document that defines the scope, objectives, activities, rules, and deliverables agreed upon between both parties. Its purpose is to ensure complete clarity from planning through to project closure, establishing verifiable expectations, defined responsibilities, and work boundaries before any activity begins.

Objective of the service

Each assessment is designed according to the needs expressed by the client. Its purpose is to identify and validate risks and vulnerabilities exclusively in systems explicitly authorized by the client in writing. The scope, depth of testing, and expected outcomes are defined based on the type of assessment contracted and the client's environment characteristics.

Essential condition: No testing will be performed without the client’s written authorization for the assets to be assessed. The specific execution rules are documented in the separate Rules of Engagement (ROE), which supplement this SOW.

2. Scope of work

2.1 Key components included

Explicitly outlines the assets covered, which may encompass:

  • Web applications and programming interfaces (APIs).
  • Network infrastructure, systems, and cloud services.
  • Any other component explicitly agreed upon.

The description includes domains, IP addresses, routes, environments, versions, and any identifiers necessary to precisely define what will be evaluated.

2.2 Excluded Elements

Remain explicitly outside the scope, except for formal written modification

  • Systems, applications, or assets not listed in this SOW.
  • Assets owned by third parties.
  • Denial of service (DoS/DDoS) tests, unless explicitly authorized.
  • Any activity not described in the present document.

The incorporation of new assets or activities requires a signed update of the SOW before execution.

Project assumptions

The work is based on the following assumptions:

  • The information provided by the client about their environment is accurate and complete.
  • Access to operational access to assets is available during agreed windows.
  • Third parties involved have given their consent when appropriate.

2.4 Windows and test restrictions

The tests will be executed during the agreed days and hours in the SOW. Any execution outside these intervals requires prior written approval. Technical and operational restrictions that limit the type of tests to be performed will also be indicated.

2.5 Third-party assets, external providers, and shared services

Third-party assets are excluded from evaluation unless their inclusion has been explicitly agreed upon in writing and appropriate authorizations are in place for the tests.

This condition may apply, among others, to web hosting providers, cloud infrastructure, SaaS services, CDN, external APIs, identity providers, payment gateways, and any other service or technological component operated or managed by a third party distinct from the customer.

Before initiating tests involving third-party assets, the following conditions must be considered.

Supplier identification
The customer must identify external suppliers related to the assets included in the assessment and communicate the restrictions they are aware of.
Sufficient authorization
You must verify that the customer authorization covers the assets and activities planned. The authorization to evaluate an application does not automatically imply authorization to test the entire infrastructure it runs on.
Additional permissions
When the provider's conditions, applicable agreements, or the customer's rights require it, additional authorization from the corresponding owner or provider must be obtained before initiating the affected tests.
Provider policies
They must adhere to the policies and restrictions applicable to security testing, including those related to shared services, production environments, and permitted techniques.
Shared infrastructure.
Authorization over an asset does not allow evaluating systems belonging to other clients of the provider or components outside the approved scope.
Lack of authorization
When I cannot believe the required permission is not available or there is uncertainty about permitted activities, the asset or activity will remain excluded until the situation is resolved.
Expansions of scope
The introduction of new assets, suppliers, or activities will require updating and written approval of the SOW and, when applicable, the ROE, in addition to any additional necessary authorizations.

AlcaNox may suspend tests involving third parties when insufficient authorization, a provider restriction, or a risk of affecting external systems is detected. The situation will be communicated to the client to agree on the necessary steps.

The client's authorization will not be considered a general permission to evaluate external assets that are not covered by their capabilities or the authorizations obtained.

Methodology and planning

The activities are organized in defined phases. AlcaNox can consider standard references recognized internationally, such as NIST SP 800-115, OWASP Web Security Testing Guide (WSTG) and other specialized technical guides. These references do not constitute a complete list nor limit the working methodology, as their application will depend on the nature, objectives, and characteristics of each assessment.

The professionals responsible for execution will have technical autonomy to apply their knowledge, experience, and professional judgment in selecting and implementing methodologies, evaluation techniques, research, and penetration testing methods that are relevant to the contracted service, even when these are not explicitly described in the referenced guidelines, as long as they remain within authorized scope, established constraints, and the agreed-upon Engagement Rules (ROE).

The work plan details:

  • Project phases and estimated timeline.
  • Client access requirements and technical dependencies.
  • Milestones and review points.
  • Specific responsibilities by phase.

4. Responsibilities of the parties.

From the customer.

  • Establish legitimate authorization over the assets to be assessed.
  • Provide access, credentials, technical information, and contact points as agreed.
  • Manage third-party permissions when assets involve external entities.
  • Review and approve deliverables within the set deadlines.
  • Notify in advance of any circumstances that may impact service execution.
  • Maintain backups and contingency measures regarding your systems throughout the assessment.

From AlcaNox

  • Execute only the activities described in this SOW and within the approved windows.
  • Preserve the confidentiality and integrity of all information obtained during the project.
  • Communicate findings clearly, technically, and in an understandable manner.
  • Notify immediately of any critical findings requiring urgent attention.
  • Inform the customer if during execution the need to broaden the scope is identified; such expansion will only proceed after written approval.

4.1 Exclusion and limitation of liability

AlcaNox runs the tests within the boundaries and using the agreed-upon techniques in this SOW and the Engagement Guidelines (ROE). Therefore:

AlcaNox will not assume liability for damages, disruptions, failures, or impacts that existed prior to the start of the assessment or that result from pre-existing conditions of the evaluated systems.

The client is responsible for notifying prior about the vulnerability, limited stability, operational restrictions, or special conditions of the assessed assets, as well as maintaining backups and contingency measures throughout the assessment.

The occurrence of an incident, damage, disruption, or impact during the execution of the service will not, by itself, waive the payment or the reimbursement of agreed amounts. The cost of contracted services will remain enforceable in accordance with the agreed commercial terms.

The exception to the above will occur when it is demonstrated that the impact was directly caused by an operation of AlcaNox executed for malicious purposes. In such a case, the corresponding liability will be determined in accordance with the contract between the parties and applicable law.

Deliverables

At the end of the assessment, AlcaNox provides a technical report tailored to the contracted service, including the following where applicable:

Executive summary
Overview of the security posture, global risk level observed and priority recommendations.
Technical findings
Detailed description of each vulnerability, affected asset, evidence, potential impact, and severity level.
Mitigation recommendations.
Practical steps to correct or reduce each identified risk.

A closing meeting to review results is included when specified in the commercial proposal.

Change Control, Timelines, and Acceptance

Timelines: Estimated start and end dates are set, along with testing windows. Delays caused by late access, client information, or responses may extend the schedule without responsibility for AlcaNox.

Modifications to Scope: Any modification, addition, or removal of activities requires updating the SOW and obtaining written approval from both parties before proceeding.

Criteria for acceptance: The service is considered complete once the reports are delivered in accordance with the agreed scope and after verification of receipt by the client. If no written observations are made within the established timeframe, acceptance will be deemed achieved.

Commercial terms: The pricing, payment method, and invoicing are governed by what is stated in the commercial proposal and the contract signed between the parties.

7. Confidentiality and handling of information

All data, credentials, records, evidence, and documentation exchanged or obtained during service are confidential information. Appropriate technical and organizational measures are implemented to protect their integrity and availability. At the end of the project and as agreed, we will proceed with the secure deletion of collected data, in accordance with applicable data protection policies and the current confidentiality agreement.

Post verification / Re-run of tests

Once the client has made the necessary corrections or adjustments to remediate the vulnerabilities identified during the initial assessment, they may request a re-run of tests from AlcaNoxretestingto verify if such vulnerabilities have been effectively corrected.

During this assessment, AlcaNox will verify the previously reported findings within the agreed scope and document the outcome of each, indicating whether the vulnerability has been fixed, if it persists, or if verification was not possible. When applicable, residual risks observed during the verification will also be highlighted.

Professional commitment

We conduct our assessments with technical rigor, respect for the law, and strict adherence to the agreed terms. The SOW aims primarily to ensure that both parties have a clear, precise, and verifiable instrument, so that the outcomes of the work are useful and actionable for improving your organization's security posture.

Supplementary documents: This SOW operates alongside the Engagement Guidelines (EG), the commercial proposal, and the service agreement signed by the parties.

Clarification on the nature of the document

This document serves as a work reference to describe the scope and operational conditions proposed for AlcaNox's security assessment services. By itself, it does not constitute legal advice nor replaces the corresponding legal review, service provision agreement, necessary written authorizations, or agreements that must be formalized between the parties. Its use must be adapted to applicable law and to the documents officially subscribed by the parties.

Technical Annex

Scope and Engagement Guidelines

AlcaNox — Security Assessments

Supplementary Work Document Aligned to the Statement of Work (SOW). Does not constitute, by itself, a legal document nor replaces contracts, written authorizations, or agreements that must be formalized between parties.

This annex supplements the Work Definition (WDF) and outlines the authorized assets, permitted activities, operational constraints, and execution conditions for the assessment.

No test may commence without written authorization, approved scope, and acceptance of these rules by the parties.

Part I. Scope — Technical Scope

1. Authorized Assets

The assessment will be limited exclusively to the identified and written-approved assets. The technical relationship between systems, the appearance in recognition tools, or the belonging to the same infrastructure do not imply authorization.

Project / Client
Authorized Assets
Environment
Owner
Authorized Activities
Specific Exclusions
Authorization

Unidentified assets, pending approval or belonging to third parties without sufficient permission will be excluded from scope.

2. Activities and exclusions

The permitted activities will consist solely of those selected and approved for the project. They may include recognition, service identification, vulnerability analysis, and controlled validation of findings.

With express authorization and documentation, the following are excluded:

  • Service denial, stress testing, and load testing.
  • Social engineering, phishing, and physical testing.
  • Malware installation, persistence, and backdoors.
  • Modification or deletion of data and configuration changes.
  • Mass extraction of information and real transactions.
  • Testing of unauthorized third-party systems.

Exploitation of vulnerabilities will require explicit authorization and defined boundaries. Testing must cease once sufficient evidence is obtained, as continuing could unnecessarily increase risk.

Accesses and data

The customer will provide the accesses, test accounts, roles, and restrictions needed. AlcaNox will use only authorized permissions and will not access, copy, or disclose sensitive information that is not necessary for documenting findings.

If accidental access is granted to third-party information or a condition is detected that could cause harm, the affected activity will be suspended and the ROE procedure will be applied.

Part II. Rules of Engagement (ROE) — Engagement Rules

4. Initial Conditions

Before starting, the SOW, Scope, ROE, and necessary authorizations must be approved. Also, accesses, restrictions, and operational and emergency contacts need to be verified.

The availability of a system, a verbal instruction, or the absence of a customer's response does not constitute authorization to expand the scope.

5. Operating Hours and Execution

Date of Start:

Completion date:

Authorized working hours:

Time zone:

Source of the tests:

Traffic limits:

Tests will be executed within the approved timeframes and limits. Any relevant modifications will require prior written approval.

Communication and emergencies:

Customer contact information:

Alternative contact or emergency contact:

AlcaNox Contact:

Emergency channel:

In the event of an interruption, exposure of sensitive information, activity outside scope, critical vulnerability or potential interference with a real incident, AlcaNox must:

  1. Halt the affected activity and prevent actions that increase risk.
  2. Contact the designated responsible party by the customer.
  3. Notify about the affected asset, the observed situation and the measures taken.
  4. Record the events and retain only the necessary evidence.
  5. Maintain the suspension until written authorization is received to resume operations.

If the primary contact does not respond, the alternative contact will be used. The contact details and escalation procedure must be verified before starting.

7. Suspension and resumption

AlcaNox may suspend partial or full evaluation when there is a risk of damage, insufficient authorization, violation of rules, or reasonable security concerns about the tests.

The resumption will require written confirmation from the authorized representative of the client and verification that the execution conditions remain valid. If modifications are necessary, the corresponding change must be approved before proceeding.

Evidence and confidentiality

AlcaNox will collect only the necessary evidence to support the findings. Records and results will be handled confidentially and delivered in accordance with the terms outlined in the SOW.

At the end of the assessment, AlcaNox will securely destroy all collected evidence and data, or return them to the customer as agreed. No copies will be retained beyond the timeframe specified in the SOW, except with written explicit authorization.

If a security incident unrelated to our tests is detected, we will notify the customer and avoid interfering with their investigation. Incident responses and forensic investigations are not included unless expressly contracted.

Acceptance Statement

The parties declare they have reviewed and accepted the scope, restrictions, and operational rules of this annex.

CustomerName:Role:Signature:Date:
Security AlertName:Role:Signature:Date:

End of document

Usage note: This document consolidates the service description (SOW), technical scope (Scope), and commitment guidelines (ROE) into a single document structure. Its inclusion does not substitute the formalization of agreements, authorizations, and contractual conditions applicable to each project. The legal effectiveness of its provisions will depend on the definitive content, the circumstances of acceptance, and the relevant legislation.