Before commissioning research, agree on the question the work must answer. This guide helps a buyer and research team prepare a statement of work. It is a planning aid, not a contract, legal advice, or permission to access any system.
The research question
Name the decision the engagement should support. Avoid an unrestricted promise to find every weakness.
- Business or security question
- Affected workflow and relevant operating context
- Required deliverables and audience
- Acceptance criteria and explicit exclusions
Authority and access
Confirm who can authorize the work and which assets that authority covers.
- Authorizing organization and accountable contact
- Approved systems, environments, and third-party dependencies
- Permitted test identities, actions, and access levels
- Stop conditions, escalation contact, and access revocation
Information handling
Agree on confidentiality and tooling before transferring material.
- Classification of information to be shared
- Approved storage, transfer, and analysis tools
- Whether any external AI service may process client material
- Access controls, retention, deletion, and handover expectations
Delivery and commercial terms
Commissioned work needs an agreed scope and price, not assumptions made during an initial inquiry.
- Project fee or retainer scope and payment schedule
- Milestones, review points, and change-control process
- Report format, evidence package, and retest allowance
- Intellectual property and publication terms to settle in the agreement
Closure
Decide in advance how the work will end and what remains the organization’s responsibility.
- Deliverable review and acceptance owner
- Residual findings and proposed follow-up work
- Removal of temporary access and test data
- Final retention, deletion, and handover record
Keep the working copy in your environment
This page does not collect your answers. Complete the template within your organization’s approved systems, with access and retention appropriate to the material. Do not use it to store credentials or unnecessary customer data.
A worksheet can help prepare an engagement; it does not replace written authorization or the final commercial agreement. Tervaq’s investigations, assessments, and validation work are paid services.