Cybersecurity audit quotation
Quotation template for security consultants: vulnerability assessment, penetration testing and remediation plan report. Download it as Excel or Word.
Templates by industry
- Vulnerability assessment
- Penetration testing
- Remediation plan report
Preparation guide
Example workflow
Confirm scope and quantities
Example: start with "Vulnerability assessment", confirm the required quantity and client inputs, then agree completion criteria for each item.
Review and approve the quotation
Confirm acceptance evidence for "Remediation plan report", all line quantities, exclusions and quote validity with the customer, and retain the approved version.
Deliver and prepare billing
Deliver the agreed test results and configuration notes, and assign owners for outstanding items. When the agreed milestone is complete, prepare an invoice using actual quantities and approved changes.
A security audit quotation does two jobs: it prices the work and it records what the client has allowed you to test. The second part matters, because testing a system nobody authorized in writing puts both sides at risk. The template splits the engagement into a vulnerability assessment, a penetration test and the report with a remediation plan, so a client on a small budget can start with the assessment and add the rest later.
Fields to prepare
- Deliverables and line items
- Vulnerability assessment, Penetration testing, Remediation plan report: specify the planned quantity and delivery scope for each item.
- Vulnerability assessment
- Name the targets by count and type, such as 2 web applications and 40 external IP addresses, and the scanning method.
- Penetration testing
- State the test days, the approach, such as black-box or grey-box, and the testing window agreed with the client’s IT team.
- Remediation plan report
- Say what the report contains, such as findings ranked by severity and a fix plan, and whether one retest of fixed items is included.
- Environment and dependencies
- Record target systems, integration counts, data volume and who supplies test access.
- Acceptance and support
- Set acceptance scenarios, the review window, support duration after handover and excluded work.
- Scope to agree
- Document authorized targets, testing windows, supplied access and the number of vulnerability retests.
Before sending
- Does “Vulnerability assessment” say what is included and what quantity the price assumes?
- Would the customer read “Penetration testing” the way you do, including what it leaves out?
- Can you still honour the price of “Remediation plan report” on the last day the quotation is valid?
Show 3 more
- Separate third-party service charges from implementation fees.
- Agree who handles the production transition and what recovery work is included if it fails.
- Check quote validity, the customer approval method and payment milestones.
Worked example with sample figures
The figures below are invented to show how the template adds up: 3 lines in USD, with an example tax rate of 8%.
| Item | Quantity × unit price | Amount |
|---|---|---|
| Vulnerability assessment | 5 × $120.00 | $600.00 |
| Penetration testing | 8 × $450.00 | $3,600.00 |
| Remediation plan report | 12 × $120.00 | $1,440.00 |
| Subtotal | $5,640.00 | |
| Sales tax (8%) | $451.20 | |
| Total | $6,091.20 | |
Quoted net amount $5,640.00, sales tax $451.20, quoted total $6,091.20.
What the document must show
The details a quotation has to show, and why each one matters, are set out in the guide below.
The sales tax depends on where the work is supplied, so set the rate that applies to your customer before sending.
Official rate reference: US government: state and local taxes
Full requirements: How to write a quotation: format, example and checklist
Frequently asked questions
Is the signed quotation enough permission to start testing?
Treat it as the commercial agreement only. Before any test begins, get a separate written authorization that lists the targets, dates and contacts, signed by someone entitled to give it for those systems.
How do I quote a retest after the client fixes the findings?
Offer it as its own line with a fixed number of days, valid for a set period after the report is delivered. A retest requested months later usually needs a fresh scope, because the systems will have changed.
Can the quotation offer a rate for emergency incident work?
Yes, but put it in the notes as an optional rate with the response time you offer, rather than as a priced line. The audit total then stays comparable with competitors’ offers.
How is the sales tax worked out on this quotation?
The worked example above uses an example rate of 8%: $451.20 on a net amount of $5,640.00, for a total of $6,091.20. The editor recalculates all three when you change a quantity, a price or the country.
Can I download it as Excel, Word or PDF?
Yes. A PDF needs no account: fill in the template and use Print / PDF. The Excel and Word files download from this page with a free account, and the spreadsheet keeps its formulas, so changing a quantity updates the tax and the total.
Read next
Reading for the Cybersecurity audit quotation: How to write a quotation: format, example and checklist and Estimate vs quote: what binds you, with a remodeling example. The VAT and GST calculator adds tax to your quoted prices.