1. Parties
This Rules of Engagement (RoE) is entered into by Izkuna S.A.S. (“Izkuna”) and the client identified in the order (“Client”).
2. Authorized scope
Domain or application: ______________________. Environments included: ______________________. Any system, subdomain, or provider not expressly listed is excluded.
3. Window and contacts
Testing window: ______________________. Technical contact: ______________________. Emergency contact: ______________________. Izkuna may pause testing if it identifies operational risk.
4. Permitted and prohibited techniques
Permitted: configuration review, authentication and authorization testing, input validation, business-logic review, and controlled web vulnerability testing within scope. Prohibited unless authorized in writing: denial of service, social engineering, physical access, exfiltration of real data, testing third-party data, and unauthorized persistence.
5. Evidence handling
Evidence is stored securely and shared only with authorized contacts. Reports will not include unnecessary personal data. After completion, evidence is retained under the applicable retention policy.
6. Confidentiality
Both parties will keep findings and exchanged information confidential. Izkuna will not publish findings without written authorization.
7. Limitations
The assessment is point-in-time and does not guarantee the absence of future vulnerabilities. Izkuna is not responsible for changes made by the Client or for systems outside scope.
8. Authorization and signature
The Client represents that it has authority to authorize testing and confirms that its infrastructure provider has been informed where required. This authorization is granted under Colombian Law 1273 of 2009 on computer crimes and Law 1581 of 2012 on personal data protection; Izkuna will process information in accordance with its Privacy Policy.
Client: ______________________ · Name: ______________________ · Role: ______________________ · Date: ____________
Izkuna: ______________________ · Date: ____________