This repository is TrustedSec language used when conducting physical penetration tests. This wording was created utilizing a third party law firm on behalf of TrustedSec to apply protections around conducting physical security assessments due to the Iowa arrests regarding Coalfire. Our goal with releasing this documentation is to hopefully help others that conduct physical security assessments and help them structure the engagements in a way that protects them as much as possible.
We are releasing this as is, and it is up to you to ensure that you are adequately protected. TrustedSec does not place a guarantee on any of the information, which is provided to be used as a template that can be used with other organizations.
The three documents are not joined together, if you only have a statement of work - adding the SOW verbiage is fine. For master service agreements, there is the MSA section. The authorization form should be created with your letterhead and the company's and make it look professional looking. We recommend only having an officer of the company sign and a notary to validate that the person that is signing the document is the actual person giving authorization to conduct the assessments.
Some words of advice, while it is on the customer to authorize you to conduct a physical penetration test, there are some things to consider:
- Ensure that the authorizing party owns the facility that you are conducting the assessment on. If it is a shared building, you will need to ensure that the customer contacts and notifies the building owner and also that both the customer and the building owner sign authorization to conduct the work.
- An officer of the customer company should sign the document as they typically have authority to conduct such testing. Directors and people within IT and the security department might not always have the authorization to conduct physical security tests.
- When conducting a physical penetration test, if there are hour windows in which to conduct them, ensure that you stay within the confines of these hours.
- Clearly outline the scope of what is acceptable and what is not, for example - lockpicking, physical damage, social engineering, and more.
- Discuss with the customer what a typical physical penetration test is and explain the scenarios and situations.
- Consider notifying law enforcement ahead of time if acceptable by the customer.
- Ensure that the contact information on the authorization letter is correct and check that contact information before actually conducting the assessment.
- The customer should notify law enforcement of such activity and this discussion should occur. Company performing the assessment should also push for law enforcement to be notified and should contact law enforcement on behalf of the customer if necessary.
Our intent with this release is to help other companies and organizations provide langauge around conducting physical security assessments. We have added a LICENSE file which essentially grants full usage, modification, selling, or anything else to you without any tie to TrustedSec. This means use this to help your organization anyway you can, and use it for whatever purpose you see fit. This documentation comes without a warranty or guarantee in any fashion.
More information here: https://www.trustedsec.com/blog/a-message-of-support-coalfire-consultants-charged/