In brief
Ask providers to price the same environment, access roles, testing approach, deliverables and retest conditions. Separate included work from optional charges and assumptions. This guide helps evaluate a quotation; it does not provide a market price range. The decision is what evidence the proposed spend will buy and what work remains with your team.
What is the quotation actually covering
Begin with an inventory and the business question. For an application assessment, describe important workflows, user roles, software interfaces, integrations and environments. For infrastructure, identify the agreed assets and boundaries. Mark unknown quantities rather than letting each provider assume a different estate.
The UK National Cyber Security Centre’s (NCSC) penetration-testing guidance includes boundaries, testing effort and reporting requirements in scoping. The US National Institute of Standards and Technology’s (NIST) assessment guide also addresses method selection and assessment planning. Neither establishes a market price for your engagement.
Source: UK National Cyber Security Centre. Penetration testing
Source: US National Institute of Standards and Technology. Technical Guide to Information Security Testing and Assessment
Our suggested quotation brief should distinguish discovery, manual validation, reporting, remediation discussion and retesting. Ask the provider to explain its proposed effort in those terms. Do not infer a quality level from a price or a service name alone.
Which scope differences need clarification
| Area | Question for the provider |
|---|---|
| Assets and roles | Which environments, workflows and access roles are included? |
| Testing approach | What automated and manual work is planned, and what is excluded? |
| Delivery constraints | What access, preparation and operating windows are assumed? |
| Reporting | Which evidence, limitations and review sessions will be provided? |
| Retesting | Which fixes, cycles and time window are included? |
| Commercial conditions | Which items are optional, and how are scope changes approved? |
For web applications, the OWASP Foundation’s Web Security Testing Guide is a reference for discussing testing coverage. Ask how relevant categories will be addressed in your environment. Naming a guide in a proposal is not evidence that every relevant area will be tested.
Source: OWASP Foundation. Web Security Testing Guide project
How do you compare two fictional quotes
Imagine the brief requires a customer portal, its software interfaces, customer and support roles, a technical report and validation of selected fixes. The example below uses no amounts and represents no real provider.
| Requirement | Proposal A | Proposal B | Clarification needed |
|---|---|---|---|
| User roles | Customer role only | Customer and support roles | Ask A whether the support role can be added |
| Interface coverage | Not stated | Listed in scope | Resolve A’s boundary before comparison |
| Retest | Optional | One agreed cycle included | Compare the complete selected scope |
| Assessor discussion | Report delivery only | Review session included | Decide whether a session is required |
| Price decision | Not comparable yet | Subject to final terms | Obtain aligned final offers |
Do not choose B automatically. A may be able to revise its scope, while B may have exclusions elsewhere. The useful outcome is a clarification list and final comparable offers. If the procurement process restricts changes after submission, follow that process rather than assuming every bid can be revised.
What does your team need to budget for
Record the provider fee, internal preparation and coordination effort, and an explicitly assumed allowance for remediation and validation. Keep effort and money separate unless you have a documented internal costing method. An assessment quote does not establish the cost of fixes that are not yet known.
Name the people preparing access, answering assessor questions, reviewing findings and supporting retesting. Agree whether supplier-dependent changes are possible within the proposed validation window. Treat those as delivery dependencies, not reasons to promise a universal completion date.
When is a scope discussion more useful than another quote
If the asset inventory is unreliable, the objective is unclear or proposals keep covering different systems, resolve the brief first. Ask whether a discovery step should be commissioned separately. A narrower assessment may be appropriate if it answers the immediate question; document what remains outside it.
Before approving the purchase, ask whether the work covers the important decision, whether the findings will be usable by the responsible teams and whether follow-through is resourced. Those answers give the price a practical meaning without inventing a market benchmark.
What should you do now
- System owner: prepare the inventory, roles and important workflows.
- Security lead: state the question and evidence expected.
- Procurement: record assumptions, exclusions and optional charges against one baseline.
- Delivery owner: reserve preparation and follow-through capacity.
- Budget owner: approve a defined scope and its limitations.
India and Australia context
For an Indian audit engagement, CERT-In’s 2025 audit guidance identifies scope elements including audit type, assets, reporting, data handling and timelines. Check its applicability to the engagement rather than assuming it governs every purchase.
Source: Indian Computer Emergency Response Team (CERT-In). Comprehensive Cyber Security Audit Policy Guidelines
Australian government vulnerability-disclosure guidance also addresses who tests, what is in scope, confidentiality and how findings are communicated. Use these planning questions to clarify the engagement; the guidance does not establish a universal service package.
Source: Australian Government cyber.gov.au. Vulnerability disclosure programs explained
How Bravewall helps
Bravewall coordinates scoped VAPT and red teaming engagements around agreed requirements. VAPT and Red Teaming
This article is general information for awareness and education. It is not legal, regulatory or professional advice and does not take into account the circumstances of your organisation. Laws, standards and threats change; check the primary sources cited and take qualified advice before acting.