An Input Set for Comparable Quotes
All candidates should receive the same scope document with the same date and version number. Totals received before the open questions and assumptions in the document are answered may not represent the same work.
The scope of a quote must cover more than the asset count: the test type, environment, user roles/functions, authenticated or unauthenticated access, test window, prohibited techniques, report language and retest expectations all change the effort.
Asset Type, Count and Test Depth
“One application” or “one network” is not a unit of effort. The number of functions and roles, the API surface, the need for authenticated testing, the IP scope, the environment and manual validation expectations should be shown on separate quote lines.
For web, write down roles, functions and API endpoints alongside URLs; for networks, internal/external location and authenticated scanning alongside IP ranges; for cloud, accounts/subscriptions and permission levels. Third-party assets and out-of-scope items are listed separately.
ROE and Exclusions in the Quote Annex
The ROE is not just a list of prohibited techniques; it also defines when the test will be stopped and who makes that call. Written permission or an explicit exclusion should be required for third-party assets, production data and service disruption risk.
Active testing limits, exclusions such as DoS, social engineering or data exfiltration, the production window, emergency stop, source IPs and the communication model are included in the quote annex. That way price differences are not judged by the total alone.
Quote scope comparison checklist
The table below summarizes the key checks for comparing assets, test method, limits and deliverables across different quotes at the same level of scope:
| Control Area | Expected Output |
|---|---|
| Asset | Type, count, roles/functions and environment |
| Method | Authentication, manual validation and test type |
| Limits | ROE, exclusions, window and emergency contact |
| Deliverables | Report, workshop, retest and data handling |