External Penetration Testing and Remediation Validation Firm Required

A business software provider is seeking an independent cybersecurity firm to perform external network and web application penetration testing before a major customer security review. The engagement covers internet-facing infrastructure, customer portals, APIs and selected cloud-hosted services.

The provider should include scoping, rules of engagement, testing, evidence collection, risk rating, technical reporting and a remediation retest. Proposals should identify methodology, tester qualifications, schedule, fixed fee, reporting format and handling of sensitive findings and credentials.

Published by the B2Base based on common business procurement needs.

Testing must be authorized, controlled and designed to avoid unnecessary disruption to production services. The provider must document source IPs, communication and emergency stop procedures. Findings must include affected asset, evidence, business impact, severity, reproduction steps and practical remediation guidance. Data collected during testing must be encrypted, access restricted and securely destroyed according to agreed retention terms.