1. Scope
1.1 This Schedule applies to penetration testing, security assessments involving active testing, and digital forensics and incident investigation. It applies in addition to the Professional Services Schedule, and forms part of the Master Services Agreement.
2. Written authorisation
2.1 MAITS will not start testing until the Customer has provided a signed or Portal-accepted authorisation. The authorisation must state:
- the assets in scope (systems, addresses, applications, accounts and locations);
- the testing window;
- the methods permitted and any restrictions;
- emergency contacts; and
- the identity of the authorising person.
2.2 The Customer warrants that:
- it owns, or has the written authority of the owner of, every asset in scope;
- the authorising person has authority to approve the testing; and
- it has obtained any third-party approvals required, including from hosting, cloud and managed service providers.
2.3 MAITS tests only the assets and methods authorised. Any change to the scope must be authorised in writing before it is tested.
3. Testing risks
3.1 Active testing can cause disruption, degraded performance, account lockouts, data changes or outages, even when it is performed with care. The Customer accepts these risks for authorised testing, and must maintain current backups and recovery arrangements before testing begins.
3.2 MAITS is not liable for loss resulting from authorised testing performed in accordance with the agreed scope and methods.
3.3 The Customer indemnifies MAITS against claims by third parties, including asset owners and providers, arising from testing that the Customer authorised, or that it represented it was authorised to approve.
4. Findings and reports
4.1 Testing and assessment results reflect the state of the systems at the time of testing, and the scope and time available. They do not certify that systems are secure, or that every vulnerability has been found.
4.2 Reports are confidential, and are licensed for the Customer's internal use and for sharing with its auditors, insurers and regulators. Remediation is the Customer's responsibility unless it is ordered from MAITS.
4.3 MAITS may retain working papers and evidence for the period needed to support its findings and meet legal obligations, after which they are securely destroyed.
5. Digital forensics and incident investigation
5.1 Investigation services are provided on a best-efforts basis. The outcome depends on the evidence available. MAITS does not guarantee that the cause, actor or extent of an incident will be identified.
5.2 The Customer is responsible for its legal notification obligations, including privacy breach notifications, regulatory reporting and contractual notices. MAITS may assist on request.
5.3 MAITS maintains chain-of-custody records for evidence it collects. Evidence and reports may be required to be disclosed by law or court order.
5.4 Urgent incident response outside Business Days is charged at 1.5 times the applicable rate. A minimum engagement of 4 hours applies.
6. Legal compliance
6.1 Testing is performed only with the authorisation required by law, including under sections 248 to 252 of the Crimes Act 1961 (New Zealand) and the equivalent laws in other jurisdictions. MAITS may refuse or stop testing if it reasonably considers that the authorisation is insufficient or the activity may be unlawful.