Testing Window: Start / End Notices & Incident Protocol
Three short notices Verfend sends during the testing window, plus who to call and how escalation works. Notices go by email to the named contacts; the incident notice is also phoned through.
1. Testing Start Notice
1.1 Sent before the first request, no later than hours hours before the window opens.
Subject: [VF-2026-001] Testing starts date time time zone
Dear technical contact,
Testing under engagement VF-2026-001 starts on start date and time and ends on end date and time (time zone), as set out in the signed Authorisation to Test (Document 04).
Assets in scope: asset list, exactly as in the Authorisation
Access level: ☐ External ☐ Grey-box ☐ White-box
Testing traffic will come only from: tester IPs
Verfend contacts: lead tester name, phone, email; emergency: name, phone
Reminder: either named contact may say or write STOP at any time; we halt within 15 minutes and confirm in writing. If you see unexpected behaviour, use STOP first.
Please reply to confirm that thevf-test-*accounts and any whitelisting are in place. If anything in the scope above looks wrong, tell us before the start time and we will not begin.
name, Verfend
2. Testing Completed Notice
2.1 Sent on the last day of the window, or when testing finishes early.
Subject: [VF-2026-001] Testing completed — window closed date time time zone
Dear technical contact,
Testing under engagement VF-2026-001 finished at date and time. There will be no further testing traffic from tester IPs.
Please now: revoke thevf-test-*accounts, tokens and VPN access within 24 hours; remove any temporary WAF or rate-limit allowances; and tell us if your logs show anything from our addresses you would like explained.
On our side: credentials deleted from our vault ☐ (confirmed date); evidence is stored encrypted and retained for 90 days after report delivery, then deleted.
Report: the report and debrief are expected by report ETA. ☐ No Critical findings were observed ☐ Critical findings were reported separately on date — please do not wait for the report to act on them.
name, Verfend
3. Incident / Pause Notice
3.1 Sent whenever testing is paused — stop-word, suspected impact on availability or integrity, blocked tester IP, or an observation that needs a client decision. Phoned through first whenever availability or integrity may be affected.
Subject: [VF-2026-001] Testing PAUSED at time time zone — one-line reason
Dear technical contact,
What was observed: factual description — what was seen, on which asset, from which tester IP
Time observed: date, time, time zone
Actions taken by Verfend: all testing traffic halted at time; further actions, e.g. test data reverted, logs preserved
What we ask you to do: e.g. check service health on asset X; confirm whether alert Y relates to our traffic
Likely cause: ☐ Related to testing ☐ Not related to testing ☐ Unknown
Resume conditions: testing resumes only when technical contact confirms in writing that condition; the window ☐ continues unchanged ☐ is extended to date by mutual agreement.
We are available by phone on phone until this is resolved.
name, Verfend
4. Who to call
| Situation | Client calls | Verfend calls | Channel | Response target |
|---|---|---|---|---|
| Routine question during the window | Verfend lead tester, phone | Client technical contact, phone | Email or chat | Same working day |
| Stop-word (STOP) | Verfend lead tester, phone | Client technical contact, phone | Phone + email | Halt within 15 minutes |
| Suspected availability or integrity impact | Verfend emergency contact, phone | Client emergency contact, phone | Phone first, then email | Immediate |
| Critical finding with active exposure | — | Client decision-maker, phone | Phone + encrypted email | Same day |
| Evidence of compromise by a third party | — | Client decision-maker, phone | Phone + encrypted email | Same day |
5. Escalation steps
5.1 Halt. Whoever notices a problem says STOP; Verfend stops all traffic within 15 minutes and confirms in writing.
5.2 Notify. Verfend phones the contact for the situation in the table above, then sends the Incident / Pause Notice.
5.3 Assist. Verfend stays available, shares its activity log for the period, and helps tell testing traffic apart from anything else.
5.4 Document. Both sides record times, actions and outcome; the record goes into the final report's engagement log.
5.5 Resume or close. Testing resumes only on written confirmation from the client's technical contact. If the window cannot resume, Verfend sends the Testing Completed Notice and the report states what was not covered.
Verfend · Independent Security Operations · email · website · Document 06 v1.0 · date