This contract is made between the two parties whose complete details are outlined in the attached contracting form, hereinafter referred to as "the First Party" (Provider of Penetration Testing Services / Security Team) and "the Second Party" (Client / System Owner), collectively referred to as "the Parties". In accordance with the provisions of the Egyptian Civil Law No. 131 of 1948, Commercial Law No. 17 of 1999, Personal Data Protection Law No. 151 of 2020, Anti-Cyber Crime Law No. 175 of 2018, Electronic Commerce Law No. 15 of 2022, and the applicable laws and regulations in the Arab Republic of Egypt, this agreement aims to regulate the relationship of conducting penetration testing between the First Party (Provider of Penetration Testing Services / Security Team) and the Second Party (Client / System Owner), whereby the service provider undertakes to conduct simulated cyber attack penetration tests on the Client's systems, networks, applications, and infrastructure, with the aim of discovering security vulnerabilities, assessing the security level, and providing recommendations for remediation, while defining the scope of testing, methodology, permissions, restrictions, confidentiality conditions, data protection, liability, compensation, indemnity terms and penalties, all within a framework of transparency and adherence to the highest standards of cybersecurity and the governing laws in the Arab Republic of Egypt. The parties have agreed to the following:

Article (1) Definitions of the Agreement
1- The words and phrases listed below – wherever mentioned in this agreement – shall have the meanings indicated next to each of them, unless the context requires a different meaning:
2- Agreement: This penetration testing agreement in its entirety, including its provisions and appendices, and its introduction shall be considered an integral part thereof.
3- Service Provider: The first party to this agreement, which is the team or company specialized in conducting penetration testing and qualified and licensed to undertake this activity.
4- Client: The second party to this agreement, which is the natural or legal person requesting penetration testing on its systems, networks, and applications.
5- Penetration Testing: A process of simulating cyber-attacks on the client's systems, networks, and applications, with the aim of discovering security vulnerabilities, assessing the level of security, and providing recommendations for remediation.
6- Scope of Testing: The systems, networks, applications, infrastructures, and targeted elements in the penetration testing, as specified in Appendix (1) of this agreement.
7- Methodology: The procedures, methods, and techniques used by the service provider in conducting the penetration testing, as specified in Appendix (2) of this agreement.
8- Security Vulnerability: Any weakness or flaw in the systems, networks, applications, or security procedures that can be exploited by an attacker to carry out a cyber-attack.
9- Breach: Any unauthorized access to systems, networks, data, or any violation of security policies that is discovered during penetration testing.
10- Technical Report: The detailed report provided by the service provider to the client after the completion of the penetration testing, which includes discovered vulnerabilities, an assessment of their severity, and recommendations for remediation.
11- Authorization: The prior written consent from the client to the service provider to conduct penetration testing on its systems, networks, and applications.
12- Environment: The environment in which the penetration testing is conducted (Production Environment, Testing Environment, Development Environment).
13- Testing Window: The specified time period during which the penetration testing is conducted, as defined in Article (3) of this agreement.
14- Agreement Period: The time duration during which the parties are committed to the provisions of this agreement, as specified in Article (3) of this agreement.
15- Service Fees: The financial amount that the client is obligated to pay to the service provider for conducting the penetration testing, as determined in Article (5) of this agreement.
16- Related Parties: Includes subsidiaries, parent companies, sister companies, as well as directors, employees, contractors, consultants, agents, and representatives.

Article (2) Subject of the Agreement and Scope of Penetration Testing
1- First: Required Penetration Testing:
2- The service provider shall conduct a security penetration test for the client according to the following specifications, detailed in Appendix (1) of this agreement:
3- Type of Test:  
4- Scope of Test:  
5- Targeted Systems:  
6- Targeted Applications:  
7- Environment:  
8- Testing Methodology:  
9- Level of Test:  
10- Allowed Techniques:  
11- Prohibited Techniques:  
12- Number of Attempts:  
13- Second: Testing Outputs:
14- Technical Report: A detailed report including all discovered vulnerabilities, their severity assessment (Critical, High, Medium, Low), evidence of the vulnerabilities, and recommendations for remediation.
15- Executive Report: An executive summary of the technical report directed to senior management, including key findings, risks, and strategic recommendations.
16- Results Presentation Session: An online or in-person session to present and discuss the results of the penetration test with the client’s team.