Retest Statement & Closure Letter
Issued after the retest. It records, finding by finding, whether the fixes hold, states the limits of that statement, and closes the engagement.
1. Engagement
1.1 Engagement ID: VF-2026-001. Client: Client legal name. Service: ☐ Validate ☐ Assess ☐ Resolve ☐ Monitoring.
1.2 Original report: report version and date. Retest date(s): dates. Retest performed by: tester name, Verfend.
1.3 Assets covered by the retest: assets, exactly as in the Authorisation to Test (Document 04) and its addenda. Access level at retest: ☐ External ☐ Grey-box ☐ White-box.
2. Findings and status after retest
| SEC-ID | Title | Severity (CVSS v3.1) | Status after retest | Note |
|---|---|---|---|---|
| SEC-001 | title | Critical / High / Medium / Low (score) | ☐ Closed ☐ Mitigated ☐ Open ☐ Accepted risk | note |
| SEC-002 | title | severity (score) | ☐ Closed ☐ Mitigated ☐ Open ☐ Accepted risk | note |
| SEC-003 | title | severity (score) | ☐ Closed ☐ Mitigated ☐ Open ☐ Accepted risk | note |
2.1 Status definitions. Closed: the original proof no longer works and the root cause is fixed. Mitigated: exploitation is prevented or materially harder, but the root cause remains (for example a WAF rule instead of a code fix); residual risk is described in the note. Open: the original proof, or a trivial variant of it, still works. Accepted risk: the client has decided in writing not to fix the finding; recorded, not verified.
2.2 Summary: n Closed · n Mitigated · n Open · n Accepted risk.
3. Method of verification
3.1 Each finding was retested using the method and evidence from the original report, from the tester source IPs in the Authorisation to Test (Document 04), with the same access level unless noted above.
3.2 For each finding Verfend also checked obvious variants of the same flaw (alternative parameters, encodings, roles or endpoints noted in the original finding) and recorded the result in the note column.
3.3 Evidence for each status is limited to the minimal proof needed, redacted where it contains personal data, stored encrypted and retained for 90 days after delivery of this statement, then deleted; no personal data is kept beyond that proof.
4. Limits of this statement
4.1 This retest covers the original findings within the tested scope at the retest date. It is not a new assessment and does not guarantee the absence of other vulnerabilities, in the listed assets or elsewhere.
4.2 Changes made after the retest date — new features, new dependencies, configuration changes — may introduce new weaknesses or reopen closed ones.
4.3 Findings marked Mitigated or Accepted risk remain the client's responsibility to track; they are not closed.
5. Recommendations
5.1 e.g. Replace the WAF mitigation for SEC-002 with a code fix within 60 days.
5.2 e.g. Add the SEC-001 payload to the automated test suite so a regression is caught before release.
5.3 e.g. Schedule the next assessment before the next major release or within 12 months, whichever is sooner; consider Monitoring for the public surface in between.
6. Closure statement
6.1 Verfend confirms that engagement VF-2026-001 is complete: the flaws were found, their impact proved, and the fixes confirmed as recorded above. Findings with status Closed have been verified as described in section 3; findings with any other status are listed with their residual risk.
6.2 Test accounts, tokens and VPN access provided for this engagement have been ☐ revoked by the client ☐ confirmed deleted by Verfend on date.
6.3 The client may share this statement in full with customers, partners or auditors. Partial quotation that omits section 4 is not permitted.
7. Signature
For Verfend (Provider legal name): ______________ Role: ________ Date: ________
Received and acknowledged by client (optional): ______________ Role: ________ Date: ________
Verfend · Independent Security Operations · email · website · Document 09 v1.0 · date