<section id="waiver-example">
<title>ANNEX 2 Example Pentest Waiver</title>

<p><b><i>(Full Client Name)</i> (“<i>(Client)</i>”)</b>, with its registered 
office at Somestreet, Somecity, Earth,
Milkyway, and duly represented by <i>(Client's CISO)</i></p>

<p><b>WHEREAS:</b></p>

<p>A. <i>(Client)</i> wants some of its systems tested, <company_long/> 
(“<company_short/>”) has offered to perform such testing for <i>(Client)</i> 
and <i>(Client)</i> has accepted this offer. The assignment will be performed 
by <company_short/>'s core-team members, external freelancers, and/or volunteers 
(the “Consultants”).</p>
<p>B. Some of the activities performed by <company_short/> and the Consultants 
during the course of this assignment could be considered illegal, unless 
<i>(Client)</i> has given permission for these activities. <company_short/> 
and the Consultant will only perform such activities if they have received the 
required permission.</p>
<p>C. <i>(Client)</i> is willing to give such permission to <company_short/>, 
the Consultants, and any other person <company_short/> might employ
or engage for the assignment.</p>

<p><b>DECLARES AS FOLLOWS:</b></p>
<p>1. <i>(Client)</i> is aware that <company_short/> will perform penetration 
testing services on the <i>(Client)</i>'s following systems, as
described below. The services are intended to gain insight in the security of 
these systems. To do so, <company_short/> will access these systems, attempt to 
find vulnerabilities, and gain further access and elevated privileges by
exploiting any vulnerabilities found. <company_short/> will test the following 
targets (the “Targets”):
<ul>
  <li>Target system</li>
</ul>
</p>
<p>2. <i>(Client)</i> hereby grants <company_short/> and the Consultants on a 
date to be confirmed by email the broadest permission
possible to perform the assignment, including the permission to:</p>

<p>a. enter and use the Targets;</p>
<p>b. circumvent, breach, remove, and turn off any security measures protecting 
the Targets;</p>
<p>c. copy, intercept, record, amend, delete, and render unusable or inaccessible 
any data stored on, processed by, or transferred via the Targets; and</p>
<p>d. hinder the access or use of the Targets,</p>

<p>but <i>(Client)</i> only grants the permission for these activities to the 
extent that (i) such activities are necessary to perform the assignment and 
(ii) such activities do not disrupt the normal business operations of <i>(Client)</i>.</p>
<p>3. The permission under Article 1 extends to all systems on which the Targets 
run, or which <company_short/> or the Consultant might encounter while performing 
the assignment, regardless of whether these systems are owned by third parties.</p>
<p>4. <i>(Client)</i> warrants that it has the legal authority to give the 
permission set out under Articles 1 and 2. It also warrants it has obtained the 
necessary permissions from any third parties referred to under Article 3.</p>
<p>5. Should the public prosecutor initiate an investigation or criminal proceedings 
against <company_short/> or any of the consultants it engaged or employed as a 
result of the performance of the assignment for the customer, then
<i>(Client)</i> will co-operate fully with <company_short/> in defending against 
this investigation or proceedings, including by providing any evidence it has 
which relates to this investigation or these proceedings.</p>

<br/>
<table cols="48 433">
   <tbody>
                    <tr>
                        <td rowspan="4">
                            Signed
                        </td>
                        <td>
                            on __________________________________
                        </td>
                    </tr>
                    <tr>
                        <td>
                            in __________________________________
                        </td>
                    </tr>
                    <tr>
                        <td>
                                    by __________________________________
                        </td>
                    </tr>
                    <tr>
                        <td>
                            for <i>(Full Client Name)</i>
                        </td>
                    </tr>
  </tbody>
</table>

</section>

