📖 What is Statement of Work (SOW)?
A Statement of Work (SOW) is a formal document that defines the specific activities, deliverables, and timelines for a penetration testing engagement. It serves as a binding agreement between the tester and the client, outlining the exact scope of work to be performed.
"Be careful not to confuse this with the Rules of Engagement; the SOW focuses on the 'what' and the business terms, while the ROE focuses on the 'how' of the execution."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Statement of Work (SOW)?
- ▸ Scope Definition: Clearly outlines the boundaries of the engagement, specifying which systems, networks, or applications are included or excluded to prevent scope creep.
- ▸ Deliverables: Lists the tangible outputs the client expects, such as a detailed technical report, an executive summary, and a remediation roadmap.
- ▸ Timeline and Milestones: Establishes the start and end dates, as well as key checkpoints for progress reviews and final delivery of the report.
- ▸ Payment and Legal Terms: Includes the cost of the engagement, payment schedules, and legal protections ensuring both parties are aligned on business expectations.
- ▸ Binding Nature: Acts as a legal contract that protects the penetration tester from liability and ensures the client receives the agreed-upon services.
🎯 How does Statement of Work (SOW) appear on the PT0-002 Exam?
You may be asked to identify which document must be finalized and signed before any technical work begins to ensure the business goals and costs are agreed upon.
A scenario might describe a client requesting additional systems be tested mid-engagement; expect questions on which document governs the original scope and requires a formal amendment.
Expect questions that require you to distinguish between the SOW and the Rules of Engagement when determining where payment terms and project timelines are documented.
❓ Frequently Asked Questions
What happens if the scope needs to change after the SOW is signed?
Any changes to the scope typically require a formal amendment or a 'Change Order' to the SOW. This prevents scope creep and ensures additional work is properly compensated and documented.
Why is the SOW considered a business document rather than a technical one?
The SOW focuses on the contractual agreement, budget, and high-level deliverables. Technical specifics, like specific IP addresses and testing windows, are usually detailed in the Rules of Engagement.